38C3 - BlinkenCity: Radio-Controlling Street Lamps and Power Plants

media.ccc.de/v...
A significant portion of Europe's renewable energy production can be remotely controlled via longwave radio. While this system is intended to stabilize the grid, it can potentially also be abused to destabilize it by remotely toggling energy loads and power plants.
In this talk, we will dive into radio ripple control technology, analyze the protocols in use, and discuss whether its weaknesses could potentially be leveraged to cause a blackout, or - more positively - to create a city-wide Blinkenlights-inspired art installation.
With three broadcasting towers and over 1.3 million receivers, the radio ripple control system by EFR (Europäische Funk-Rundsteuerung) GmbH is responsible for controlling various types of loads (street lamps, heating systems, wall boxes, …) as well as multiple gigawatts of renewable power generation (solar, wind, biogas, …) in Germany, Austria, Czechia, Hungary and Slovakia.
The used radio protocols Versacom and Semagyr, which carry time and control signals, are partially proprietary but completely unencrypted and unauthenticated, leaving the door open for abuse.
This talk will cover:
An introduction to radio ripple control
Detailed analysis of transmitted radio messages, protocols, addressing schemes, and their inherent weaknesses
Hardware hacking and reversing
Implementation of sending devices and attack PoCs
(Live) demonstrations of attacks
Evaluation of the abuse potential
The way forward
Fabian Bräunlein, Luca Melette
events.ccc.de/...
#38c3 #Security
Licensed to the public under creativecommons...

[@nickOE5697]

Durch den Titel hätte ich NIE vermutet was hier präsentiert worden ist , wahnsinn... Danke für Eure Arbeit!

[@black-snow]

So there are RCEs not only in street lights but also in power plant controls? Excellent, I wouldn't have expected less.

[@rubyh.4460]

"No, no, no. You can't make this public." EFR lawyers learning the Streisand effect the hard way.

[@backbavariananti-cyberbull984]

What a great presentation. It demonstrates how what once started as a beautiful, simple hack (Blinkenlights) has flourished into providing tremendous value and security insights for whole cities. This is CCC at its best. Ethical, valuable and still fascinating to watch. And as educational and relevant as a presentation could possibly be. Kudos to all involved. Brilliant, exceptional work!

[@Chnorzy]

Danke für den guten Vortrag. Ich habe auch schon mit Freunden, die Ampelsteuerungen programmieren, gesprochen und war schockiert wie wenig das abgesichert wird.

[@tyberzann9713]

Geiler Scheiß. Echt, danke für den Vortrag! Was ich heute gelernt habe: 1. Ich brauche nen Flipper! 2. am besten noch einen zweiten, man weiß ja nie. 3. vielleicht ausrangierte Lampenkontrollen von eBay… 4. ??? 5. Photovoltaik Besitzer hassen diesen Trick.

[@flipschwipp6572]

one of the best talks this year.

[@Waldemar_la_Tendresse]

07:30 I have had to wait decades to hear this divine music again. Now, at last, I can die filled with happiness. Nein, im Ernst, großartiger Talk und eine wiederholte Demonstration, warum Open Source/Open Hardware in manchen Bereichen, auf jeden Fall in Bereichen, die als notwendige Infrastruktur angesehen werden, Pflicht sein sollte. Und selbstverständlich kann die Erfüllung dieser absoluten Notwendigkeit auch nur den ersten Schritt bedeuten.

[@paulbell7654]

For the long antenna idea, you CAN use a drone; all you need to do is run a pair of wires along the antenna that float the battery as it flies. This can be fed up a single co-ax to the drone using the +DC feed in the centre and shield as ground, with the shield also acting as the antenna carrying the transmission signal.

[@antonliakhovitch8306]

Sounds neat! Has anyone ever done this?

[@koaschten]

Have you ever thought about the weight of 550m of Coax cable? You would need a drone to be able to carry that in the first place and then you need another wire, that can handle 10kW of emitting power and be also 550m long. 😂

[@paulbell7654]

​@koaschten I just went and lifted two 250m reels of CT100 coax on drums...... yes I agree the weight may be an issue as they must be circa 50kG lol. Back to the drawing board for this one

[@YouTube-Security]

Fun Fact, this scenario has been theorised in the Book "Blackout" by Marc Elsberg... (Almost exactly the same attack, expect it was done over the wire) Quite scary stuff...

[@adrianadamane2571]

Blackout is a brilliant book, I highly recomend it to everyone

[@koaschten]

This needs to be seen by more persons in power of changing the course of the iMSys rollout. I totally afree the most valueable targets need to be protected first.

[@jdrissel]

You should look at a tophat antenna. These can resonate at much lower frequencies than a vertical mast of the same height. The ARRL Antenna Book covers this design, but for a slightly higher frequency. It might be a good idea for the authorities to have some idea what a jamming or spoofing antenna might look like...

[@Yanni_X]

They had a security flaw, fixed it by developing a new, encrypted protocol but never used it because no client wanted to pay for it? wtf? I'm imagining websites making HTTPS and 2FA premium features to be only accessed behind a paywall...

[@l3xforever]

57:00 this plan makes sense, it’s a new tech, it needs trial and deployment experience on smaller scale, then extending it to more critical systems. Imagine one bug wrecking a havoc on even 1% of the plants

[@prismapix]

Das gleiche dachte ich mir schon bei den (Gateway) Funksteckdosen welche über T...a oder S..e in der Cloud laufen. Ein Promt vom gehackten Cloud-Dienst @ 8h00 Uhr morgens "alle an" ; oder 13h00 im Sommer "alle aus" könnte sicher auch für Aufmerksamkeit sorgen. Viele dieser Geräte sitzen zwischen PV und Ladegeräte.

[@jdrissel]

Cycling load or sources at an appropriate frequency could probably destabilize the algorithms that attempt to stabilize the grid. This might make it possible for a smaller transmitter to have the same impact. This really is one of those things where untill it breaks or is abused to cause some massive disruption, no one one in government will spend a plugged nickel on it. But I for one am sure that it is only a matter of time until this is used to kill thousands, assuming it hasn't already happened, perhaps in Ukraine.

[@pottedrosepetal6906]

its no algorithm that stabilizes the grid, the switches simply open up and need to manually be closed again.

[@DantalionNl]

Sure as heck sounds like pager POCSAG modulation, I am 8 minutes in don't spoil the suprise~

[@WacKEDmaN]

why all this complexity when a simple LDR will turn the lights on when its dark?....

[@coolm98]

an LDR is _never_ simple... just scraped bird poo from one of mine recently. will switch to mqtt soon.

[@WacKEDmaN]

all our street lights here in aus have their own built in control from a LDR or light sensor of some sort.. they will come on in the middle of the day if there is a storm and the sky is dark...exactly when you need it... the only usefulness i can see with the radio controlled stuff is to control the base load... but do you really want them switching off the lights when they needed? ..or even switching off power to your house at any time...for any reason they deem worthy? ...HELL NO..

[@TecSanento]

Yeah but it’s also not a good idea to have so much uncontrollable/uncontrolled power plant sitting around….especially if the fix could be that simple

[@beefchicken]

Here’s the actual answer: because then the street light manufacturers wouldn’t have anything to sell to municipalities

[@rybaluc]

They might not match power grid consumption patterns / power load schemes. Also lot of lights are dimmed during pate hours for 50% or more for lower power consumption. Altough i agree that LDR might be additional detecting system on top of it.

[@neutrino-220]

Wo gibts das Flipper Plugin für die Straßenlaterne? 🪄😁

[@Grandmaster-G]

Haahahahaha, Berlin.... yeah... _but can it play Doom_ ??

[@pottedrosepetal6906]

The 60GW are misleading. Solar numbers can never be taken at face value, since the orientation can wildly differ and lead to the peak never being reached. Probably saying only 80% can be reached is reasonable. Another factor I can not estimate at all is how good the solar parks are connected, it could very well happen that as soon as they start to input close to peak power, they automatically shut down due to overload of something during peak production. This means on the other hand that during peak times for sure not the full 20GW are available in terms of solar, more likely 10 at best id say. And that is assuming perfect sunshine over all of europe, which is rare. Then there is the issue of wind needing to blow - usually this happens more during the winter when the solar power is way weaker. But sure, for arguments sake this is also the case, a very windy but sunny day. Again, with wind the direction needs to be taken in account, so its unlikely we will ever reach the 20GW. Heat pumps are usually used when its cold, so not very sunny. So at peak disruptible power we can say its winter since else its possible a lot of systems are disconnected from the system somehow, alternatively we can argue that either little wind or little solar is found. So we shed maybe 40GW in differential if EVERYTHING goes well, which to be honest I doubt - I would be surprised if we reached 30. Thats still a dangerous number, dont get me wrong, but its distributed. Distributed means the automatic shutdowns will absolutely work and once certain frequencies are reached, the solar parks in general shut themselves down too. The load shedding will also help a lot more than its calculated to since it will also shut down the hacked loads. In other words, I find the 60GW to be a bit too much to reasonably assume. Its a danger, no doubt, and its wild to me that EFR is not encrypted. But we can probably halve that number even on the days with the best conditions. By then its only 10% of the low number of 300GW assumed here (not saying its wrong - but during winter at its peak its 400GW and 300GW is the minimum. That is ofc different in the summer.) and can thus easily be solved by load shedding, if it doesnt solve itself with batteries that follow the frequency or other fun gadgets. Its just very distributed, so I dont think it will harm the grid THAT much in terms of too much load either? not entirely sure. What happened a few times is the grid getting ripped apart due to frequency differences, that could happen too. It could also be the last tipping point if the grid is already unstable to make it fully collapse. I dont want to downplay the risk. But the numbers dont feel reliable.

[@koaschten]

Even if you only control HALF of that, considering the german daily peak load is somewhere around 70GW and the talk mentions you can already notice effects of a 3.3 GW variance would be sufficient and ... 18GW would be sufficient for a 1Hz drop in the european grid... I doubt you need to control 60GW to trigger a cascading effect.

[@pottedrosepetal6906]

@@koaschten youre not wrong. But usually efr controlled PV is quite slow, so if you send out the signal, it will be slow enough to initiate load shedding so the grid would stand.

[@yutubl]

Mal wieder schlimmer als erwartet! Ließe so eine "Fernbedienung" eine persönliche "grüne Freifahrt-Welle" schalten ? (Oder demnächst als integrierte PKW Ausstattungsoption erwerben im Sinne eines PKW mit integrierter Vorfahrt?) Worse than expected! could such a remote control switch a personal traffic green phase free drive through wave ? (Or car integrated accessory option like a car with integrated right of way)

[@nickOE5697]

@@yutubl Das Konzept gibt es bereits für Rettungsdienst/Feuerwehr/Polizei als Pilotprojekte! Name des Projektes ist mir leider entfallen

[@ofgjf]

Manche Bus/Stadtbahnschaltungen arbeiten über so einen unverschlüsselten Funk. Z.B. in Hannover.

[@Waldemar_la_Tendresse]

Grüne Welle für jedermann dürfte bei der PKW-Dichte in diesem Land kaum möglich oder sinnvoll sein. Aber ich sehe da immense Möglichkeiten für Grüne Fußgängerwellen? 😁

[@rotors_taker_0h]

Awesome, so 60GW worth of power plants are controlled by open unauthenticated radio broadcast for who knows how long and nobody even tried to exploit that. And there is a mitigation plan somewhere in 10 years from now. Right. That's both scary and reassuring. In opposite ways. Scary because how dumb the system is. Reassuring because no "state level actor" had even thought to look at that (either has no capabilities, or desire, or just luck). Otoh, it shows much of the modern world is just hanging on a string and the fact that nobody is rocking the boat seriously. Everyone one scared of connecting infrastructure to the "scary internet with hackers", nobody scared of connecting infrastructure via RADIO WITH 1900 ERA PROTOCOL with zero audit or security

[@krissp8712]

Well I guess at least anyone hostile trying to broadcast a hack will literally show their location like a Christmas tree for triangulation. But even if it's a regional attack it's definitely scary.

[@rotors_taker_0h]

@krissp8712 well, yeah, but it will take half a day to find and shutdown a transmitters on a random hills around the country. And attackers don't need to babysit their devices, timer would suffice. And there may be dozens hidden transmitters, waiting for activation. Could easily deny radio control for a week and cost nothing compared to a potential damage

[@StreuPfeffer]

And the antennas being a problem to jamming. How likely is it the mast will be able to doge a few drones flying into it? (ukraine drone pilots have quite the skill set ive heard, on moving targets)

[@andix25]

Warum hält man solche Vorträge auf Englisch, wenn man dann ständig deutsche Worte einstreut ohne sie zu übersetzen 😂

[@code1997]

Weil es deutsche Protokolle und das Fachbegriffe bzw. Feldnamen sind. Nichts ist schlimmer als wenn die lokalisiert werden.... *hust* MS$

[@thextrmntr]

My guess : Because the wider audience understands more English words and can look up some German ones.

[@andix25]

@@code1997 Natürlich darf man die Begriffe erwähnen. Allerdings bedürfen sie einer Erklärung. Einiges kann man direkt übersetzen, anderes umschreiben. Stellt euch einfach vor, das wären Bulgarische begriffe und da würde ein Haufen Kyrillischer Buchstaben auf den Slides stehen. Das würde wesentliche Teile des Vortrages unverständlich machen, für alle die keine Kyrillischen Buchstaben und kein Bulgarisch verstehen.

[@bytesabre]

Thats’s how English gets new words

[@ilonachan]

​@@andix25 da ist es ja praktisch dass alle deutschen Begriffe in diesem Vortrag entweder reiner Fun Fact waren, oder sogar übersetzt wurden. Das meiste wurde sowieso zu Abkürzungen. Es gibt hier nichts über das man sich nach dem Standard beschweren kann.