Smart Water Meters Vulnerable To AttackBy Stephanie Hoffman In a speech at Black Hat USA in Las Vegas, McNabb said because wireless water meters are data collecting, embedded devices, they are therefore vulnerable to attacks that could cause service disruption, or even enable attackers to execute malware. There are a lot of inter-dependencies. In many parts of the country, water departments dont have emergency generators. Theres more attention to security for water systems, he said. Essentially, the Achilles heel of the smart meters is that theyre equipped with a small computer or microcontroller which enables a direct electronic reading of the water consumption, said McNabb. Electromagnetic forces detect the flow of water. You put the meter in, and it registers a total volume of water going through, he said. This is what records the data. It turns the water meter into a data collection device. Transmission methods vary, such as phone lines or cable power lines. However the most common transmission method is via radio signals, that operate at about 900 megahertz. If hackers could develop a way to sniff a system running at a 900 megahertz frequency, McNabb said, they would be able to take control of the system. As such, water smart meters, like any other critical infrastructure controlled over a wireless sensor network (WSN), are fraught with many of the same vulnerabilities facing electrical smart meters and other Web-facing systems, including cyber attacks and disruption, McNabb said. For one, AMI controlled water systems are automated but unattended, leaving them susceptible to insider attacks, McNabb said. In addition, most WSNs dont come equipped with basic security measures, such as encryption. Once hackers gained access to the WSN, they could use their privileges to reduce their water bill, increase someone elses water bill, steal water or evading water restrictions by getting away with consuming more than an amount regulated by the city or state, said McNabb. Thus far, the wireless water meters dont pose a significant threat, as smart meters are only present on about 7 percent of water utility systems, McNabb said. But that number is growing, driven by the necessity to reduce costs, provide increased meter reading accuracy and more frequent billing. In the U.S., advanced metering infrastructure, or AMI, is expected to grow from $2.54 billion in 2010 to 5.82 billion in 2015, representing an 18 percent compound annual growth rate. Meanwhile, the smart meter install base is expected to be around 31.8 million by 2016. However, the increasing adoption of water smart meters could pave the way for more serious attack scenarios. In addition to enabling attackers to conduct surveillance of an individuals activities, water smart meters could potentially be a path to routemalwareinto water SCADA systems, said McNabb. The meters could also serve as an entry point to access a comprehensive network that incorporates all critical infrastructurewater, electricity and gaswhere everything is controlled by the utility, McNabb said. Water controlled by smart meters also could open doors for potential terrorist attacks, in which water supplies were shut down or poison the water supply, McNabb said. The mesh system smart grid is also very wormable, McNabb said, referencing IOactive, which successfully ran awormin a simulated city of 25,000 smart electric meters. A water smart grid could be just as vulnerable, he said. Image Credit Article first appeared at HamletHub.com Also Read: Smart Homes Reveal User Behavior, Prone to Hacks: Study 