Flipper Zero Self Destructs an Electricity Smart Meter
rtl-sdr.com
rtl-sdr.com
Calling out Flipper Zero for someone (ab)using the meter's remote control features cuts me the wrong way: you could've done the same with any other SDR, not just the Flipper Zero.
It's not even a surprise this happened, the cut-off is not meant to be operated constantly to cut heavy loads. Similarly you should not use a breaker to turn off heavy (or any, in that matter) loads as you're needlessly wearing down the protective device, instead of a separate cut-off switch that's designed to be replaceable. Especially since it can be positioned downstream from the protective device.
It all boils down to which part of the circuit you can easily repair in case of a fault, in this case the meter is by far the least accessible.
The specialness of the flipper zero is not that it can do more than any other SDR. The specialness is how easy it is to use. The question is what you can do in that 'easy mode'.
That, in the easy mode, you can do this kind of realistic and meaningful damage is noteworthy. Because this potential is brought to the masses. It probably won't be the start of widespread SDR-based cyber-crime, but that brings it one step closer. That is why I consider this noteworthy news about the flipper zero specifically.
Trying to outlaw adversarial devices will not work though.
Citation needed.
Since the advent of cheap SDRs and TI CC1100 devkits it's been a case of "grab code off Github and go do shenanigans". The only specialness here is that it's battery powered, but even previously you could have been running a laptop and HackRF in your backpack.
Now any jamoke can dl a firmware and conceal this in a pocket and go wild. That's "easy to use."
The flipper zero has a screen and buttons, and a defined way to upload new 'attacks' on to it, aswell as a simple way to run those. To normal people that lowers the barrier sooo much.
I don't want to live in a world of max pessimum.
I was arguing that this real-life example of impact is actually important for showing the impact of bad radio security, by putting dangerous tools in the hands of the masses.
But why does the power meter accept commands from something 'outside', something untrusted?
These protocols exist to get current readings from meters for data retrieval ease, and generally have a combination of security through obscurity and simple authentication to enable mass readings (by authorized people) easier. IIRC, these things can talk P2P in densely populated areas, and you can get all meters' readings in mere minutes, tops.
In any way, after and initial PoC, the rest of the video gets into territory of equipment abuse, and I got angry and sad while watching it. You can do it, OK, then why damage things which are not yours? Document your findings and leave.
Because your a terrorist or an AI looking to destroy mankind?
You're drifting off into is/ought territory in why people do things and that is something that is very difficult to predict and control.
I didn't know we reached Ghost in the Shell level cybernetics, sorry. TIL.
> You're drifting off into is/ought territory in why people do things and that is something that is very difficult to predict and control.
No, I'm just asking a question. What he has done has no place in my ethics and morals. I don't tell anyone what to do, either. It's his life, he should deal with the consequences.
I don't disagree, this is why we typically have laws against destruction of property.
Conversely we have an increasingly globally connected world that is wholly dependant on software to keep functioning day to day. If someone figures out how to modulate your wireless router (I mean, long shot, yea) to smoke your neighbors power connection the 'ethics and morals' of said remote attackers is nearly meaningless. Especially in the case they live in a foreign country. Said attackers will be able to harass you with impunity while your power company is walking around with its thumb in its ass trying to figure out what's going wrong.
These are usually placed above the main door, and are made of a lever ending in a loop in which you hook a spear and pull down.
Neighbours unhappy with such places making noise would regularly pull them, cutting power, destroying wares that are in fridges, and whatnot.
The typical (and only, really) defense is to make the lever inoperable so you can frequently see them destroyed.
Having open remote RF access in these cases would be a disaster (until tinfoil is used as a defense)
It's also difficult to update such devices in the field so even if they do fix such issues it's only for new units or a new product line which most customers won't bother with until forced to by regulations / incidents as it's expensive to replace them (you have to send someone out on the field as there are pretty much no OTA updates).
There's an absolute chasm between implementation intervals that can be achieved through pure software systems and those with distributed hardware components. Throw in a few layers of abstraction where those designing, purchasing, installing, operating, and maintaining those components are all unrelated parties with different (and potentially conflicting) motives and any sort of cohesive systems engineering is hard.
This doesn't excuse continued irresponsibilities in product security, because they absolute exist, but "impressively fragile yet surprisingly functional" is a completely logical Nash equilibrium to settle on given the surrounding non-technical components.
But we are not talking about them using too weak RSA keys from 2 decades ago, or even not about transmitting passwords unencrypted, so anyone with a right radio could glean that.
We are talking about a complete lack of any access control. Like two wires instead of an ignition lock. An electric box with a mechanical meter and switches would at least have a padlock on it.
This would be more convincing if not for the fact that smart meters are IIoT. They're a new thing. IIoT is kind of an unholy breed between those hardcore industrial engineers you talk about, designing hardware with multi-decade operational lives, and the people implementing the IoT part using webdev practices, trying to put Docker containers full of NPM modules onto the industrial devices (and if they can't fit there, then plugging them immediately upstream).
Now that latter group is (mis)using bleeding edge tools to develop greenfield solutions - and thus should very much be able to keep up with basic security practices developed in the last 20 years.
What we want is something in the middle, security but we own the keys!
Technical debt exists in disciplines other than software development.
The manufactures and integrators of these devices are just now beginning to realize that the internet exists and that their devices aren't always connected to perfectly isolated RS-485[2] networks or connected to a network at all. They commonly contain hard coded passwords, passwords with staggeringly limited length and complexity, plain text authentication, default passwords, and other backdoors. Working with such devices is like taking a Delorean back to the early 90s, the eighties, or even earlier... it's the wild west.
It pleases me beyond words that hacking contests like Pwn2Own[4] have begun to include these systems in their competitions. This is a massively important area of security research that has historically been ignored.
[0] https://en.wikipedia.org/wiki/Programmable_logic_controller
[1] https://en.wikipedia.org/wiki/SCADA
[2] https://en.wikipedia.org/wiki/Encoder_receiver_transmitter
I would guess until recently power meters just had no reason to be secured. We live in a multi unit building (I would guess around 120 of them). There is a shared key that goes to the central electricity room where the meters for all units are. I could turn off anyone's electricity by either unscrewing the main fuses there or by switching the breaker. People are a lot more trustworthy in practice than you would think.
In some countries this is crime which might land you in jail.
Because some things work better with trust vs convoluted security.
I think this is something a lot of computer nerds don't get (myself included at one point). It's almost like if something can be accessed we are allowed to access it and it's the fault of the person securing it. But a lot of our society works on trust and I think we'd live in a much more difficult world if everything had to be secure enough to resist any attack.
If this thing was connected to the internet I get it, but you already need physical access to the meter why add another layer of security on top of that? If someone has wants to mess up your power and they have physical access there's plenty of ways they can do it without wireless communication.
If Philips can secure its SoniCare brush heads this way to prevent tampering and counterfeiting, a utility company or meter producer which enables a much more important infrastructure can be a little more mindful about what they are doing.
Other than that I agree 100% to your viewpoint.
Also, you've just made replacement/repair/support far more complicated and dangerous for everyone than it need be. You must be 10% smarter than any piece of equipment you are operating to safely use it, and be "ahead of the machine".
I truly believe we have suffered greatly as a civilization for our willingness to lose sight of that, and to have allowed the siren call of "abstraction" to charm us into making things so absurdly complicated that short of neverending population growth to bring into existence more people to solve all the new problems people have created, one is hard pressed to even read everything necessary to understand why most things are the way they are.
Practically, it doesn’t do anything more complicated. Device provides you an ID without a password, but accepts everything else with a password. In many countries, if not all, infrastructure equipment is already protected property. Nobody except the utility company touch, repair, reconfigure that meter, anyway.
Overcomplicating stuff is indeed a problem, and it’s a combination of poor engineering plus monetary greed in most cases. Also it’s a side effect of evolution of technology. I would love to discuss it to death, but this is not the place and I don’t have much time for it either.
Someone walking around your neighborhood cutting every single electric line on the side of a house, risking electric shock and trespassing on your private land is much more likely to get caught than somebody rolling through your neighborhood with a flipper zero and a high power antenna turning off all of your meters.
If someone had a grudge against you, and they started to "release the magic smoke" from your meter once a week and the power company is upset with you and your HVAC system doesn't work anymore, in addition to the fact that the compressor in your AC is toast because of someone energizing and de-energizing the circuit so rapidly. Now you are out thousands of dollars and, on top of all that, no matter how many cameras you put up, you'll have a hard time figuring out who's doing it.
Case in point the electric substation attacks early this year.
Or on a micro scale, just walking into a store, taking what you want and then walking out.
I don’t think anyone really wants to live in a society that is fully secure but to not have that we need to stop the breakdown of trust.
Arguably, the only reason we have society and not total anarchy is because everyone kinda tacitly agrees to “act right”
But security is rarely found in products where it only might prevent the loss of profit.
The presence or absence of security in a product always reflects the incentive structure of the business that produces the product.
Itron's OpenWay system, for example, has used ECC encryption for quite a while:
https://www.itron.com/pl/company/newsroom/2016/06/09/itron-r...
This on the other hand is quick, can be done away from the meter, away from cameras, and can reach many meter at the same time. Considering the few terrorist acts that have been done to electricity distributions points, it does seems like a good ways for them to do a big impact easily, with the right antenna and amplifier.. you could do quite a bit of damage.
I think most folks don't understand electric components don't like being manipulated under a load.
I was taught the procedure of disconnecting a 10/20kV disconnect for an on-site transformer (alas, only an old one that had been decommissioned) and that thing scared the crap out of me when I first heard the spring loaded high voltage disconnect actuate.
Having a 3 meter fibreglass pole to actuate the thing, just incase, tells you there is a real risk of the thing blow up in your face, on a good day.
I know it would have made the meter more expensive, but it was absolutely forseeable that a wild RF signal could have induced repeated contactor reclosings. They should have built it properly.
This is a failure of regulators and manufacturer, the media will spin it and next thing you know flipper zeros will be banned and smart meters will be as shitty as this one.
To rate limit switching would be a no brainer here.
These devices are not built to be operated by the general public. Anyone who operates these devices knows to reduce the load first.
I don't see the sense in saying "these devices, built for a specific industry with specific, exacting specs, should instead have been built with different specs that were never meant to occur".
Everywhere in industry we train operators to know how to operate machinery that can be made to break itself, because it's cheaper to train the operator than to make the machine unable to break itself.
The remote sends a signal to the chip in the device, and that chip decides what to do, often ignoring the signal if it's currently busy or otherwise doesn't want to.
There is no force here. Even if it wants to turn off on request in case of dangerous external circumstances, it doesn't need to turn back on so easily and rapidly.
You're looking at a $500K farming tractor and complaining that it doesn't have collision avoidance.
Now, smart meter being able to shut power off is somewhat expected. But I would also expect it to be protected command.
Guess where you don't have that? When you accept inputs via radio. The least you could do then is rate limit the input, better even would be authentication. This doesn't even has to be misuse. It could just be some wonky device sending the "wrong" sequence of zeros and ones on the right frequency and boom.
Guarding against this kind of interference is totally the task of the manufacturer. Designing the device in such a way, that you cannot turn a load switch into a makeshift dimmer for a short moment as well.
Still, maybe they should have better security. Specially as there is radio interface.
Seriously? The device has no authentication. By the design, anyone within range is authorised.
And it wasn't "forced". There's no code execution here. It was sent commands, it accepted them.
And comparing it to industrial applications with trained workers is just absurd. This is not some hugely complicated industrial system. I really don't see how logic for designing heavy machinery for industrial applications can be uncritically applied to consumer devices. It's just a different space, with different requirements and it's much less complicated.
Citation?
How? This is a system for remotely opening a circuit. The user can’t reduce the load first. At best they can (likely with too much latency to be at all reliable) wait for the meter to report a small load.
How does it enforce that? Is it just based on signal strength?
> The intended user can switch off or unplug the load in person then operate the meter.
This is just the wrong way to think about it. The "intended user" is all nice, but what can an attacker do? That is how these problems need to be analysed.
If a technician were on site, they could physically remove the meter or open the main breaker.
But if you use a smart meter (which by definition is in the path of the load) to switch something on/off it should not break as long as the load is within the spec of the meter. If it is out of spec of the meter, see above.
On a electrical component level the switching element they are using is rated for a maximal temperature. If they continue switching when it is outside of that temperature, because they did not observe a cooldown phase or don't guard against overheating in any other way, it is totally on them. They are operating the switching element outside of the scope, and they should never do that, even if some input tells them to do so.
1. Disconnect circuit 1 2. Connect circuit 2
Bypass step 1 by only sending 2 and bad things happen.
That is what this is about. It's not necessarily the fault of the manufacturer if a device can be harmed by deliberate RF-based (mis)use.
I am not too familiar with the FCC as I am from Europe, but even the linear motor of a standing desk will rate limit the amount of movement you can make it do within a given time frame (those linear motors are not designed for permanent operation).
If your meter is rated to switch a certain current, that rating is made under the assumption of a certain ambient temperature and temperature of the switching element. Switching it heats it up, so there has to be a cooldown period if you plan to still operate it within spec. Operating components within spec is the task of the manufacturer, and checks to avoid going out of spec should be one of the first things to design into such a product to prevent house fires or malfunction.
Guard mechanisms like rate limiting are cool because they can protect you against liabilty if your programmer makes an error, but they become more important the more exposed the controls are. There is a reason why e.g. a RCD cannot be permanently be fixed in the on-position (the switch is not tied to the lever internally), because you want it to switch off even in the case of misuse in order to save lives. This is magnitudes more important if your controls are exposed to external inputs (e.g. via radio, or over the network/internet), as accidental or malicious misuse might be more prevalent there.
Note: I am not saying there is a strict legal requirement to do this, I say that this is what I expect from a modern design made by professional electrical engineers.
"you" is the manufacturer of the device that bricks itself if touched wrong by arbitrary (untrained) personnel.
The owner has no way to know the thermal limits of some unknown internal switching component, and even if they have who says the radio signals are emitted by the owner?
This is one step removed from even that - a third party device designed for hackers being intentionally used for destructive purposes.
Do you even know how much regulation exists behind meters and electrical equipment?
What's next, complaining that the meter can't handle a sledgehammer?
You call weakness I call vandalism
Same as the brats who go and do a "tiktok challenge" of robbing an easily accessible car than finding out they're not immune to handcuffs and jail cells
Edit: and while a self-protection/rate limiting would be good, this could as well as easily be turned into a denial-of-service attack by causing the switch to be off. Better than failure, sure, but still an issue.
My freaking standing desk has protection if I go up and down too much within a certain period of time.
Like I said, I have zero trust this meter is accurate when it doesn't even have simple protective circuitry.
The desk controllers I have seen check for that limit (as one should).
Every controller should reject input that leads to destruction, especially if the input is wireless or comes over network.
--
[0] - The shredder is of the cheaper kind, and shows zero indication of any computer on board, so I'm assuming overheating shutoff is charging up some capacitor that's grounded via a high-resistance path and discharges at a known rate.
I actually had a dangerous situation here once in a big compressor motor that had a faulty soft-start circuit, that caused the bi-metal contacts to fuse so the protection no longer worked. By the time I noticed the compressor motor was way too hot to touch.
Now, that could be explained by e.g. the engine itself having enough thermal capacity to keep the shutoff switch active for a while, except... if you are careful and do small pauses between shreddings, you can keep going indefinitely - and those pauses don't feel enough to let the engine cool if that was the only thing that mattered.
Like, you shred something for 3 minutes straight and get 30 minutes cutoff, vs. shredding something for 1 minute, then 30 seconds break, then 1 minute, then 30 seconds break, ... and you can keep going like that for hours.
Yes, and it excels at it. From your description it does look like it
What if the electric operator’s software malfunctions and causes rapid power cycles to customers’ meters?
The end result would be the same, and it certainly wouldn’t be considered “abuse” then.
Yes because it's not built to be activated in that manner. Especially for high power/high voltage. This is not a mechanical keyboard switch.
> What if the electric operator’s software malfunctions and causes rapid power cycles to customers’ meters?
Then this is on the power company to fix it and fix the downstream failures this might cause. (Same as power outages that cause damages)
> it certainly wouldn’t be considered “abuse” then.
Abuse: Misuse; improper use; perversion.
And sure, they’ll have to fix it, but it’s still a glaring issue that should have never happened in the first place. A smart meter should very much be tolerant to this form of “abuse”.
As other commenters have said, controls for such a thing should most certainly have been put in place by the smart meter manufacturer. This isn’t something they couldn’t possibly protect against like your sledgehammer example. This is fully within their control, they just chose not to protect against it.
I explicitly used the fact that a bug could cause this to trigger at the scale of an entire electric company to show how bad this could be.
> What if the electric operator’s software malfunctions and causes rapid power cycles to customers’ meters?
> The end result would be the same, and it certainly wouldn’t be considered “abuse” then.
Those very well could be catastrophic failures, but that doesn’t in any way shape or form change this also being one.
My argument is that ’software error at the power company’ can easily cause catastrophic failures at the meter, which it stands no chance of being able to prevent. So why should it specifically be built to defend itself against the remote possibility that the master control program sends it too many on/off switch commands too quickly?
Why should it specifically be built that way? Because it's bad for devices to self-destruct with no attempt at mitigation whatsoever.
As the other commenter stated, that does not in any way imply "robust against all possible issues coming upstream" and it would be ridiculous to expect that.
Which scenarios you engineer the system to tolerate with what level of survivability and serviceability is going to be a matter of engineering to budget, right?
If a standing desk and shredder can handle that, then a smart meter should very much also be able to.
None of this was your original point, anyway. You instead chose to focus on a completely different and irrelevant failure case.
There is a world of difference between "voltage regulation issues might cause major problems" (your point) and "turning the thing on and off too quickly causes the whole thing to self-destruct" (the actual point).
Sure, this is targeted abuse, but your device should not accept unauthenticated radio input that allows destruction.
Authentification makes things more complicated, but it would still allow authorized personel to do the switching.
This is ridiculous. Manufacturers are responsible for the safety and security of their products. It's a perfectly legitimate expectation.
The meter should not accept unauthenticated commands and should have temperature protection.
In general you have a point, but making these devices accessible to remote tampering is an avoidable escalation of risk with no counterbalancing upside.
Requiring proper security in public infra creates market requirement for companies to release better, more secure, products to the public infra market. Not just whatever open radio based MVP thing they can whip up.
And that creates jobs for not just EE engineers, but as security requirements increase then it creates jobs for SW engineers also (and if the existing players are too slow, opens the market for agile startups that can do it better).
What's more, it makes our infrastructure more resilient to random RF and electronic warfare.
This shit has been broken since the beginning and enacting laws to fix this shit will be slow and expensive and many companies will be lobbying against it. Much easier to outlaw the Flipper Zero - as if that was the problem.
The SDR-related blog is also unlikely to have an agenda that includes getting certain types of SDRs banned.
edit: I also just noticed the meter is stuck in test mode and the backup battery is missing. You can actually buy these meters on ebay, which is what I'm suspecting this guy did.
Keep in mind that your typical electrical service is 10's of KW and that switching that kind of power repeatedly under load requires a device that is essentially sacrificial in nature. Now let's see what they charge you for that meter replacement, it's not going to be cheap.
Note that the meter isn't yours to mess with, it is in your house and on your property but from an administrative perspective your stuff starts after the mains cutoff which is downstream from the smart meter. Anything before that including the mains cutoff is the property of whoever manages the local network, either a specialized grid operator or the utility company that sells you the power. You can see which way it works by looking at your electricity bill and by whether or not you call your utility when there is a problem with the local grid or the network operator. Where I live these are separate legal entities, but in some places it is just the one.
Finally: don't mess with the grid, it's a shared resource. It is trivial to cause damage by for instance injecting power at higher voltage levels than the appliances in the houses around you can deal with, blowing up a meter before your ability to cut off can have very unpredictable effects. In theory it is all safe and it should be able to withstand some abuse but in practice older networks still exist and not all of them are equally robust. So just don't.
Utilities are - if anything - usually quite responsible and if they mess up they are liable for any damage they cause.
Flipper Zero isn't what's causing this, the bad "smart" devices are, and the culprits themselves, of course. Just because you can hack a system, doesn't make it legal. Know your local laws. Mine says "accessing any IT system without authorisation is punishable with imprisonment from 3m to 3y; accessing the aforementioned system with the purpose of obtaining data is punishable with imprisonment from 6m to 5y.", vague enough for all of these things.
As soon as I would discover I could do that, I would inform the company not some scritkiddies on the internet.
This is just irresponsible
I don't buy this and will not act shitty just because
And reporting to the vendor is suicidal. At least assuming the stories I hear about vulnerability disclosures are representative, which I think they are.
In their place, if I were to inform the company, I'd do it anonymously. If it was an actually important issue - as this very much looks like - I'd consider informing the building manager, HOA, the gas installation company they use, and every local journalist, all together so they know about each other - and then CC that to the vendor.
You can't self destruct something else. You can only self destruct yourself.
You wouldn't say a remote controlled robot that destroys itself on (wireless) command isn't a self-destructing device.
This device is not designed to "self destruct" with a specific command. It is following normal service commands.
The correct analogy would be if you command a robot to move so it falls off a cliff, this is not a "self destruct" command.
If you order a robot to turn on and off too fast, the proximate cause of the damage is the internal power circuitry. Which makes "self-destruct" pretty appropriate language.
Good luck picking it back up or having another embedded person sort out the random zup file of sources and built images that these sorts of things encompass. Using some god awful half baked custom ide.
“Flipper what did you do?”
Should have been
“What did I make flipper do?”
In addition the articles title “flipper causes meter to self destruct” should be titled “person using radio device to cause smart meter to rapidly turn on an off causes failure in meter components”.
I’d probably phrase it more like “Idiot with ‘hacking tool’ rapidly switches electricity meter without understanding current inrush and failure states of high voltage high current system, luckily escapes death by explosion or causing a fire”
The article centers around this video: https://www.youtube.com/watch?v=kF6o9Ec4k_o
Otherwise, it could lead to tech not being trustworthy, or Flipper Zeros and anything like it getting banned.
It really seems like there are so many threats to technological society right now and not many people trying to defend it and make sure that in 50 years we still have access to the internet for most people and sensors monitoring our water supply.
>Eventually switching the meter on and off while under a heavy load
The issue is, I now have hundreds of boards with nice 64mhz Cortex M3 chips that run arduino code, and an attached CC1200 radio chip. They are pretty cute boards. But people already paid for them and I failed to deliver those to them, so I can't in good conscience sell them. Instead I have many boxes of these boards filling up space under my raised bed.
I would love to donate them to some educational purpose, but I worry they are a bit of an odd board no one would have a big use for. I guess though if the flipper zero with a similar chip is useful, maybe these can be useful too. When they communicate over the normal protocol they can have up to 1km wireless range (high above ground, no obstructions).
I do go to a hackerspace every week so I will have to bring some by and see what people say. But if anyone here has specific suggestions for places to donate them where they will actually get used, please share!
I may be missing something, but shouldn’t you be giving them to the people who paid for them?
I’m seeing a lot of comments about “you should do X” but I don’t think a lot of people understand what extreme burnout is like. My mental health was horrible after all of that, and at some point I literally couldn’t will myself to continue. After five years of work I announced the project was over in 2018. Some people understood and some people were upset. But I did everything I could for 5 years, and by that point there were a lot of better products on the market that people could actually buy, unlike mine. You give as much as you can but at some point you have to walk away.
If you have the devices, that you acknowledge that people paid for, then at least attempt to provide your backers with something.
You didn't go into receivership as you still have the assets - at the moment you just sound like a fraudster.
I very much gave what I could, but when you fuck up in business sometimes you just have to walk away. I really needed to for my own mental health. The product launched in 2013 and I walked away from it in 2018. It took me years to recover. To this day I can’t really even stand to mail simple packages. I’m not going back - that period of my life is over.
I just never figured out what the product was really good for, so I’ve been unsure who to donate the remaining stock to.
If you don't deliver anymore than you have an obligation to sell it to try to give them money back...
Eieiei
Why couldn't you sell them and give the proceeds to the people who paid for them?
If that fails, just destroy them. Remove them from your life should be the priority you are literally dreaming above them every night.