Comment by iancarroll | Hacker News Reader

Comment by iancarroll | Hacker News Reader

> Most utilities are switching customers to smart meters that allow remote disconnection of electricity.

I learned about this 3-6 months ago when PG&E erroneously remotely disconnected a large number of people in the Bay Area, including my apartment. I walked outside my unit and the entire building had power except for me -- the maintenance team was mystified and said the meter specific to my apartment reported it had been remotely killed.

It was impossible to figure out what had happened, and after many hours of vague outage status messages, I was finally able to reach the billing department who said they had been fixing this issue all day, and they remotely reactivated my meter as I was still on the phone with them (they had a whole disclaimer about turning it on remotely too).

I got a vague letter and $100 statement credit a month later that admitted an issue accidentally cut off a lot of meters, but no further details on how or why. Very strange experience and made me question the whole smart meter thing.

This also exposes the risk of hackers (state-sponsored or otherwise) to selectively or indiscriminately deny power to people just by flipping off their meter(s).

I wonder do those meters have remote software update. And if so when we will see hack where as many as possible of them are bricked... Requiring massive operation to reconnect and replace each...

Jumper cables: not just for cars!

(don't do this)

The architecture of the GB smart grid only allows any given meter to be remotely disconnected on certain days. This is to make it impossible for an attack to disconnect more than a fraction of all meters with any one attack.

What is the mechanism by which this is allowed or disallowed? Could that also not be hacked?

Maybe downlinks can only be sent as a response to uplinks (similar to LoRaWAN class A?) and uplinks are every few days?

So it's a two-stage attack; increase the frequency of up/downlinks, and then send the bricking payload!

It's built into the meters based on a hardware ID code, so any particular meter will only accept a certain set of highly sensitive operations on particular days. So if you need to shut off Mrs. Miggins for non-payment (not legal to do remotely without sending an engineer at present but technically possible) or switch her meter to pre-pay (which is legal) then that command might only be acceptable to the meter once every 20 days. That does mean you can't immediately do it if you're the supplier but also limits the damage that a catastrophic compromise of the smart metering security system can do.

The trend should be clear now, everything that's marketed as "smart" isn't for your benefit, but for the $$$ of someone else.

I don't understand this sentiment. Utilities already can and do sacrificially shut off parts of the grid to prevent greater outages, this isn't giving them a capability they don't already have except for increased granularity and hopefully inconveniencing fewer people.

More granular targeting is potentially concerning in itself depending on your threat model - e.g. if it's only possible to attack an entire town, then you're safe as long as any actor is not willing to attack the entire town, and likely to have allies in your neighbors if they do. If it's possible to attack all of the people who I don't like in that town specifically, that changes things.

Also, the smart meters do more than just enable remote shut-off on a per unit basis, they also allow for more granular data capture around your usage patterns throughout the day, which someone might not appreciate for a number of reasons, e.g. viewing that data as private, or preferring flat-rate billing as opposed to the time of day based pricing schemes that it enables.

More generally, these sorts of systems are not without their advantages, but they are characterized by an increase in centralized control and surveillance.

The claim wasn’t that there was an increase in control beyond that which you acknowledge (improved granularity) - it was about how that new power will be used.

It could be used to avoid unnecessarily inconveniencing customers, as you suggest, or it could be used to improve the strength of utility companies’ positions in disputes. Perhaps both?

I finished a project on a smart meter with a remote disconnect in late 2021 for an African client.

You would not believe how much more money they began to make once they started selling power using scratch cards. It was n-times the difference.

People, paradoxically, spend more when they can easily see how much they spend.

This is the "You don't need to pay the whole price, pay only what you use" scam. Based on the fact that people don't know how much they need and when they need it. Like electricity being cheaper at night or at certain hours but being mainly used during the day (those people cannot afford electric cars, they have to wash during the day with a noisy washing machine and they have to cook during the day).

Reply on news.ycombinator.com