Powerline Adapters – the security threat (2020) | Hacker News Reader

Powerline Adapters – the security threat (2020)

community.spiceworks.com

38 pointswalterbell44 comments

Fun fact! EVs use powerline networking for vehicle<->charger communication. Since multiple chargers and cars might share the same circuit (and L2 network), in order to identify the connected car's network endpoint, they've invented a "sounding" protocol to determine the physically closest network node based on signal strength.

Read ISO 15118 for more details. Here's a paper where they built a sniffer and explore the protocol: https://www.sstic.org/media/SSTIC2019/SSTIC-actes/v2g_inject...

Why not distribute ad-hoc networks over powerline / similar constructs? Probably a bandwidth issue. But I’m curious what the specifics are. Take a whole city like NYC? Hmm.

Shoutout to MoCA which is a better technology than AC power line Ethernet but remains relatively little known.

https://en.m.wikipedia.org/wiki/Multimedia_over_Coax_Allianc...

I wish MoCA was around when i was wiring up my house. I have a lot of abandoned COAX which was for cable-TV in my house i could have used.

I actually looked into this many years ago as i have a cable modem, so ethernet over coax via some sort of "modem" should be possible. Sort of a throwback to the old 10-base-2 system?

Wasn't able to find anything that would ave worked so i caved in and eventually ran ethernet.

The annoying thing about moca is it's still really expensive and the boxes are huge. It would be nice if you could get them in a form factor where they replaced the coax plate/box, even if they stuck out of the wall more.

I looked into MoCA as I have some coax runs in my house that I don’t use, but when I saw how much power the adapters drew 247, I ditched that idea quickly. Instead I used the old coax as a pull rope to pull Cat6 through instead.

That works great unless your lines are stapled for some reason.

Do homes in the US have an abundance of coax cable?

It's used by cable companies here in the UK, but it's not something homes come with as standard.

Sounds like the author just needed to set a non-default network key.

Powerlines suck, but when you have no other option, they suck a little less than no connectivity at all.

If your VDSL line runs anywhere near your mains wiring, they can cause crazy interference and erroring as the frequencies overlap. Some kit has a notch-out mode to avoid this (Devolo I think).

In theory, newer powerline adapters can use encryption to isolate networks. As usual with such protocols, the devil is in the implementation details.

There appears to be no affordable physical (L1) firewall for powerline networking. There are "EMI power filters" in the 14khz to 40Ghz range for hospital MRI rooms (https://www.astrodynetdi.com/mri-shielded-facility-emi-filte...) and mil-spec SCIF isolation, with starting prices of a few thousand $.

MoCA offers affordable ($10) devices to block ethernet traffic between your home cable modem and the external coax, e.g. https://www.ppc-online.com/products/coaxial/filter-SNLP-1G70... & https://www.amazon.com/gp/product/B08HJ4F4D4/

Powerline networking is <100 MHz and a pretty pedestrian filter will effectively block it. I'd wager that a pair of clamp-on ferrites[0] between your meter and your panel would work just fine.

[0] https://www.digikey.com/en/products/detail/fair-rite-product...

Lots of meters use bus bar to the panel that wouldn’t fit a ferrite. Also the lack of a listing would make using that ferrite a violation anywhere that observes NFPA70 (NEC). Although I don’t personally see a risk in adding one.

There's thousands of products in the category, I'm sure something can be found. I clicked right past flat ferrites and wasn't seeking any particular stamp.

This is arising from the convenience of single press setup, isn't it? Powerline should still have passwords and such to stop two unrelated networks from connecting, so it's more that the default settings are a little too hands-off.

I've found the firmware on TP-Link is a bit lacking. For a while they had a rogue DHCP server on their newer connectors that couldn't be switched off, until the most recent firmware update. This would cause all sorts of issues with that device.

Powerline networking is unreliable, and emits huge amounts of noise/interference that make shortwave listening a disaster. Just use WiFi, or run ethernet. It's really not as hard as you think to run ethernet, often it can be run along existing HVAC ducting.

> It's really not as hard as you think to run ethernet, often it can be run along existing HVAC ducting.

As someone who had replaced a powerline adapter after a few days of trying and went with hard wired ethernet..It depends on your house layout.

I have an open-concept home which is also missing a room to create really high ceilings in the dining room.

To run an ethernet line from the upstairs to the basement i had to use 30 feet of string and tie a bolt to it. I then did some "fishing" in the cold air return to eventually reach the basement.

It can be done, but can also be very challenging.

Wifi is getting better and better as time goes on. These "mesh" wifi systems are amazing. I've tried many wifi routers before but due to the size and layout of the house they always left really bad dead spots.

We now use NETGEAR's Orbi system , and it provides high-speed access all over the house including the deck.

An alternative that actually performs quite well is Multimedia over Coax (MoCA). Cost has come down quite a bit too, a pair of 2.5Gbps adapters runs about $100. In a situation where you're renting, or a two story house with no good way to link upstairs and downstairs, it's a great choice.

> often it can be run along existing HVAC ducting.

This presupposes that you have HVAC ducting, which is much less ubiquitous outside the US in homes, which are usually the primary market for powerline networking. Add to that that people in rented accomadation often can't start drilling holes to run anything in wall, and there's your powerline target market.

> It's really not as hard as you think to run ethernet, often it can be run along existing HVAC ducting

In the UK we typically have brick/stone walls and no HVAC. Cable ducting above a skirting board is the only option I can think of but it doesn't solve crossing the floor or doorways.

This was an interesting read but doesn't make sense.

I tried these powerline adapters and found they were very unreliable across the two phases in my own home. By this i mean if i plugged one adapter into an outlet, i had to find another outlet on the same side of the panel to get it to work.

To hear that it is working across homes means it must have went back to the transformer??

I have power line adaptors just to link a printer in my conservatory to the rest of my home network.

One month my internet was incredibly flaking. After finally getting down to debugging I was horrified to find mine and my neighbours networks had coalesced.

I tore the power line adaptors out and got a WiFi printer.

I have no idea how it could happen only that at some point we'd both pressed the connect buttons within the discoverable phase.

My experience was also very short lived.. I ran an ethernet cable after fighting with that stupid thing for a few days. i came to realize i've spent more time on it vs running a wire.

You really should have had a physical filter. They’re cheap and easy to install.

Could you share a pointer to one of these, or good search terms? "Powerline filter" doesn't return much.

Search for surge protector. Power line filters are really transient blocking / low pass filters.

Not sure how it applies in this context. You could plug both power line adaptors into the same surge protected extension but to what end?

> I was horrified to find mine and my neighbours networks had coalesced.

Is there a physical filter that could "firewall" local AC wiring powerline communication from the neighbor's AC wiring?

> a printer in my conservatory

This may be a different use of the word, but I am picturing a detached greenhouse. My mental picture has the humidity too high for electronics and the only safe outlets being outdoor-rated outlets.

Perhaps a sunroom may be a better word in this case, in the U.K. a conservatory is a recreational room with large amounts of glass built to face the sun. So one can enjoy the sun and brightness of a sunny day without having to go outside if it’s not warm, or too windy. Frequently they’ll open onto a patio or other paved outdoor space and from there into the garden proper.

What would stop the signal from getting to the distribution transformer through the wires? This is why things like power factor and harmonic distortion are regulated (specifics depend on country and customer type). You can mess up the power for everyone else. Or share a network.

> What would stop the signal from getting to the transformer through the wires?

The answer is obviously nothing stops it from going to the transformer. You seem to have completely missed my point so let me restate it.

It is odd how in this case the system works across a transformer and into another home yet i found it had difficulties on the two phases of my own home?

It would be interesting to hear for an actual electrician on how this would be possible, and why it didn't work properly for me?

Signal is usually lost going across a tranformer, from one winding to anotner. But usually whole residential areas, consisting of many streets, share a 24kV to low voltage 220V transformer. Meaning you and your neighbour in most cases share a single transformer, to which you are connected to in parallel.

Different phases are never interconnected, have separate windings on a transformer and are on different cables, since there's a voltage between different phases, as they represent three different points on a generator axis and are offset by pi2/3.

At least in North America (and I’d guess elsewhere, but I’ve been surprised before) there’s not a transformer per dwelling in anything besides low density rural areas.

It wasn’t having to go back out to or through a transformer, just back out along the common wire serving that phase to his and his neighbour’s houses.

It’s functionally equivalent to connecting two outlets on the same phase within your house, just a bit longer distance.

I’m guessing neighbor in an apartment / multi-unit?

These days powerline networks have key exchange / encryption and so this problem should be fixable, no?

The one good “place” I found for it is two outlets on opposite sides of the same wall. I use that as a bridging point rather than “network” — backhaul to an AP, wired connection to a computer where I care about latency (e.g. gaming), etc.

In those few cases it works really well, adding just a few milliseconds and getting good speeds.

But after reading about accidental bridging and remembering that one unknown PC in “Network Places” that one time, I installed TP-Link’s powerline utility and keyboard mashed a new key, just in case.

Could powerline work with electrical cables which aren't connected to AC power, e.g. two outlets on opposite sides of the same wall, connected to each other, but disconnected from the breaker panel?

Sure, you would need a suicide cord to power the pair through one side though.

If you know what you are doing, you could probably decouple the AC from the radios or power both sides with 5vdc or similar.

You'd need some power for the actual powerline adapters. But if you have two outlets directly linked I would just remove the panel and pass an ethernet cable through the same pipe used for the power cord.

Shouldn't they have an encryption sequence that's required to be performed in sync for them to join? If that's not happening, then it's some really bad model.

My friend said once "this is very bad idea, to use another's wires", but this was more than 20 years ago, when this technology was extremely rare and expensive, so where very small probability of such cases.

Really just transformer with ferromagnetic core is enough to isolate such things.

Now world changed, but there are lot of old tech devices without any security, designed decades ago.

I picked up 4 PL adapters one day, just to see how well it worked. I could never get two of them to talk, even after plugging them into the same wall socket. This is in brand new construction.

I wasn't motivated enough to try harder, so I returned them. If I had to rely on them.

I suspect that the security threat is overrated; if they don't work there aren't any practical security issues with them.

I suspect environment and product really really matters.

I got a set about, oh, 10-15 years ago that were terrible. They connected, sort of, but always dropped out.

Then I got one with a STB and it worked pretty well as a point-to-point device -- it was only providing access to the STB and never had any issues.

I replaced them when I upgraded that home network with four TP-Link devices, and they worked brilliantly and included Mesh-Wifi Repeaters. Once they were all synced up I changed the default powerline encryption keys. I wouldn't trust them to stand up to anyone trying to break in, but it'd be fine for a basic home environment.

I used powerline for a while. I was into Cisco networking at the time and had some spare devices, so I setup an IPSec tunnel over the adapters. Extra overhead and config, but it was fun and made my traffic 'safe' over powerline.

They’re also quite unpredictable on speed - I’ve seen huge variances in same location over years. Presumably depends on what sort of noisy devices are nearby

Reply on news.ycombinator.com