Hacker News Reader

Comment by raverbashing | Hacker News Reader

No device is built for abuse like this. You could flip a switch manually multiple times and cause failure

Do you even know how much regulation exists behind meters and electrical equipment?

What's next, complaining that the meter can't handle a sledgehammer?

You call weakness I call vandalism

Same as the brats who go and do a "tiktok challenge" of robbing an easily accessible car than finding out they're not immune to handcuffs and jail cells

Edit: and while a self-protection/rate limiting would be good, this could as well as easily be turned into a denial-of-service attack by causing the switch to be off. Better than failure, sure, but still an issue.

View on HN

A smart meter should be capable of noticing that it is being turned off and on over and over which could harm it.

My freaking standing desk has protection if I go up and down too much within a certain period of time.

Like I said, I have zero trust this meter is accurate when it doesn't even have simple protective circuitry.

How do you know this about your desk?

Not the poster, but they are right. The linear motors in standing desks are not made for permanent use (they would heat up too much if used that long). In the datasheet they will typically put something like "can be used for maximum of x minutes within x+y minutes".

The desk controllers I have seen check for that limit (as one should).

Every controller should reject input that leads to destruction, especially if the input is wireless or comes over network.

Plenty of devices have protective circuits. My cheap paper shredder is very aggressive about heat management - once it detects it's heating up too much, it'll shut itself off for ~30 minutes to cool down. That state somehow[0] persists even if you unplug it, so I had to learn to feed it paper at the right pace, 'lest I'll be taking half-hour breaks every 2-3 minutes of shredding.

[0] - The shredder is of the cheaper kind, and shows zero indication of any computer on board, so I'm assuming overheating shutoff is charging up some capacitor that's grounded via a high-resistance path and discharges at a known rate.

Overheating shutoff of the 'dumb' kind is usually a bimetallic strip, though maybe this works as well

No, you got it right. It's a bi-metal in all electric motors that I'm aware of that have overheating protection.

I actually had a dangerous situation here once in a big compressor motor that had a faulty soft-start circuit, that caused the bi-metal contacts to fuse so the protection no longer worked. By the time I noticed the compressor motor was way too hot to touch.

Does bimetallic strip have some kind of passive hysteresis? Because what I observed with my shredder is that, if the overheat protection kicks in, it won't turn on for the next 20-30 minutes. You can flip the switch, or even unplug it from mains, doesn't make a difference - it won't turn on for almost half an hour.

Now, that could be explained by e.g. the engine itself having enough thermal capacity to keep the shutoff switch active for a while, except... if you are careful and do small pauses between shreddings, you can keep going indefinitely - and those pauses don't feel enough to let the engine cool if that was the only thing that mattered.

Like, you shred something for 3 minutes straight and get 30 minutes cutoff, vs. shredding something for 1 minute, then 30 seconds break, then 1 minute, then 30 seconds break, ... and you can keep going like that for hours.

> Does bimetallic strip have some kind of passive hysteresis?

Yes, and it excels at it. From your description it does look like it

To be fair you really really don't want anything to overheat inside a plastic box full of shredded paper.

I have a shredder that cuts out when it overheats too. It's a PTC thermistor controlling a relay, the thermistor is glued to the motor housing and the relay coil contact is wired through it. When it heats up too much, the resistance increases to the point that the relay is no longer receiving enough current, and it de-energizes and opens its contacts, breaking the motor's power supply.

Probably a thermocouple and an op-amp.

It says it in the manual and it refuses to go when I try to break it.

The expense of your desk motor burning out has a cap though. The expense of a utility controlling device not shutting off after intentionally being stressed/hacked is potentially very high and may require human intervention to detect, maybe they decided it’s better if the device fails under this type of abuse which will bring humans into the loop to detect the problem.

The device not switching on when overheated could attract humans' attention, too, without the need to replace the device, which may be an involved process for high-power circuits.

Not turning off would be a bad protection, but it could also decide not to turn on. Something as simple as only allowing three remote turn-on commands every hour, anything beyond that requires a physical override.

Certainly under normal operation. This may be skirting that protection.

I agree that for a single meter (which for some reason is bolted to the outside of the house), the risk of vandalism is the same, whether it is remote controlled or not. However, a vulnerable wireless (or even internet-connected) meter would allow massively scaling up the attack. Taking an entire city (or even country) off the grid by flipping all the breakers would cause some serious damage.

And here I am believing rate limiting remote commands is a pretty default thing to do, especially if the commands switches power under load.

Sure, this is targeted abuse, but your device should not accept unauthenticated radio input that allows destruction.

One could argue the ability control power under load is a safety feature. What if they hardened the wireless attack surface and added a manual safety switch which could also be used to intentionally brake the device, would that be better? I don’t think it would. I really don’t think the device needs to be stupid proof at the expense of the ability to be directly controlled by not-stupid persons and above.

You misunderstand me here. A rate limit just means you can only switch it off and on e.g. once a second instead of a thousand times per second.

Authentification makes things more complicated, but it would still allow authorized personel to do the switching.

Oh no, it definitely can and should. There’s absolutely no excuse for not adding a sensor or even a dumb counter to implement a simple action limiter and constrain operation with a safe envelope. It’s basic engineering

Even if the designers valued tamper-resistance and/or direct control of the device over broad durability and/or protection against intentional vandalism? It seems burn out after being switched on and off repeatedly under load may be an acceptable failure mode in this type of device.

The meter shouldn’t react to the flipper’s orders at all in the first place.

> You call weakness I call vandalism

This is ridiculous. Manufacturers are responsible for the safety and security of their products. It's a perfectly legitimate expectation.

The meter should not accept unauthenticated commands and should have temperature protection.

Turning on and off quickly is “abuse” now?

What if the electric operator’s software malfunctions and causes rapid power cycles to customers’ meters?

The end result would be the same, and it certainly wouldn’t be considered “abuse” then.

> Turning on and off quickly is “abuse” now?

Yes because it's not built to be activated in that manner. Especially for high power/high voltage. This is not a mechanical keyboard switch.

> What if the electric operator’s software malfunctions and causes rapid power cycles to customers’ meters?

Then this is on the power company to fix it and fix the downstream failures this might cause. (Same as power outages that cause damages)

> it certainly wouldn’t be considered “abuse” then.

Abuse: Misuse; improper use; perversion.

https://en.wiktionary.org/wiki/abuse#English

“Abuse” implies intent. A bug occurring without said intent most certainly is not “abuse” in the common definition of that word.

And sure, they’ll have to fix it, but it’s still a glaring issue that should have never happened in the first place. A smart meter should very much be tolerant to this form of “abuse”.

As other commenters have said, controls for such a thing should most certainly have been put in place by the smart meter manufacturer. This isn’t something they couldn’t possibly protect against like your sledgehammer example. This is fully within their control, they just chose not to protect against it.

Abuse or not the meter should certainly protect itself against something like you just described. Now a software fault can blow up all the customer's meters and you think that's fine and good?

Did you reply to the wrong person? I certainly never said and don’t think this is fine and good.

I explicitly used the fact that a bug could cause this to trigger at the scale of an entire electric company to show how bad this could be.

Abuse is not about the action, but about intent and privileges.

That was literally my point. Did you just stop reading after the first sentence?

> What if the electric operator’s software malfunctions and causes rapid power cycles to customers’ meters?

> The end result would be the same, and it certainly wouldn’t be considered “abuse” then.

What if the electricity operator failed to control the frequency or voltage of their supply correctly and caused too much power to go to their customers? It seems reasonable for your electricity meter (which is usually supplied by your electricity supplier so their equipment not yours) to trust the electricity supplier in general. There are far worse things the supplier can do to the meter than send erroneous power cycle signals.

I mean sure but that’s not remotely what’s being discussed here.

Those very well could be catastrophic failures, but that doesn’t in any way shape or form change this also being one.

Your argument was ‘the meter should be designed to be robust to software error at the power company’

My argument is that ’software error at the power company’ can easily cause catastrophic failures at the meter, which it stands no chance of being able to prevent. So why should it specifically be built to defend itself against the remote possibility that the master control program sends it too many on/off switch commands too quickly?

"robust" doesn't mean "immune to every possible variant". An inability to protect against the wrong voltage doesn't imply you shouldn't bother to protect it against wrong commands.

Why should it specifically be built that way? Because it's bad for devices to self-destruct with no attempt at mitigation whatsoever.

Actually, my argument was "the meter should be designed to be robust enough to prevent this particular issue".

As the other commenter stated, that does not in any way imply "robust against all possible issues coming upstream" and it would be ridiculous to expect that.

With physical hardware being operated outside its design limits, ‘robust’ can mean ‘has safety mechanisms to prevent it happening’, but it can also just mean ‘fails in a way that is serviceable without causing collateral damage’. Or ‘fails catastrophically but at least without causing loss of life’.

Which scenarios you engineer the system to tolerate with what level of survivability and serviceability is going to be a matter of engineering to budget, right?

Turning something, anything on and off a few times seems well within the design limit for such a device.

If a standing desk and shredder can handle that, then a smart meter should very much also be able to.

None of this was your original point, anyway. You instead chose to focus on a completely different and irrelevant failure case.

There is a world of difference between "voltage regulation issues might cause major problems" (your point) and "turning the thing on and off too quickly causes the whole thing to self-destruct" (the actual point).

I think the law is a good second line of defense. Humans are wired to think "if I gave into that Intrusive Thought, I would suffer consequences." So that mostly keeps us in line. But, a good password and some input validation also get you pretty far; nothing is better than a computer at telling you "No!" No judge, jury, or building with bars over the windows required. Just some text in your text editor, and then if someone wants to be evil, they can't be. Pretty good.

Indeed. I don't lock my doors because I think that is a serious deterrent to someone who truly wants to get in. I lock them, as they say, to keep the honest people honest.

The denial-of-service scenario does not render the issue moot; on the contrary, it is another example of what can go wrong when these devices are not secured properly.

In general you have a point, but making these devices accessible to remote tampering is an avoidable escalation of risk with no counterbalancing upside.

no one is saying that it should be legal to go destroy other people's stuff. if that's the message you're hearing, go back and re-read.

Abuse of an unauthenticated device that anyone can walk by and do. Regulations are really working!

Found the firmware author.

Reply on news.ycombinator.com