Ars Technica

Just say no: Wi-Fi-enabled appliance botnet could bring power grid to its knees

Enlarge / Reddy Kilowatt is not ready for IoT botnets.

BALTIMORE—At USENIX Security Symposium here on Wednesday, Saleh Soltan from Princeton University's Department of Electrical Engineering presented research that showed that if Wi-Fi-based high-wattage appliances become common, they could conceivably be used to manipulate electrical demand over a wide area—potentially causing local blackouts and even cascading failures of regional electrical grids. The research by Soltan, Prateek Mittal, and H. Vincent Poor used models of real-world power grids to simulate the effects of a "MaDIoT" (Manipulation of Demand Internet of Things) attack. It found that even swings in power usage that would be within the normal range of appliances such as air conditioners, ovens, and electric heating systems connected to "smart home" systems would be enough to cause fluctuations in demand that could trigger grid failures.

These kinds of attacks—focused on home-automation hubs and stand-alone connected appliances—have not yet been seen widely. But the increasing adoption of connected appliances (with many home appliances now coming with connectivity by default) and the difficulty of applying security patches to such devices make a Mirai-style botnet of refrigerators increasingly plausible, if not likely.

Soltan and his team looked at three possible categories of potential malicious demand manipulation:

In the event of a blackout, a MaDIoT attack could severely impede attempts to bring power back on line. Utilities typically isolate areas of the grid to bring power back during a "black start." They do this because they don't know what demand will be when they throw the switch, and they want to prevent frequency instability while power is restored. An attacker could use the MaDIoT attack to create spikes in demand in each region, throwing off power frequency and causing systems to trip again, extending the blackout. About 100 to 200 "bots" controlling appliances per megawatt of grid capacity could disrupt a grid restart.

All of this is dependent on high-wattage appliances becoming connected and vulnerable. But many of these appliances are now arriving on the market with connectivity built in or are being connected through home-automation hubs like Nest. So, as Soltan said in his presentation, the time to start figuring out how to counter such attacks is now.