Researchers
have found that so called smart electricity meters can be used to determine
what TV programmes people are watching.
German researchers have been looking over meters from the company Discovergy.
They found that the fluctuating brightness levels of a film or TV show when
displayed on a plasma-screen or LCD TV created fluctuating power-consumption
levels. This creates a power/consumption signature for a film that might be
determined from the readings obtained by Discovergy's technology.
The researchers also found that Discovergy apparently allowed
information gathered by its smart meters to travel over an insecure link
to its servers. The information -- which could be intercepted --
apparently could be interpreted to reveal not only whether or not users
happened to be at home and consuming electricity at the time.
This was revealed during a presentation by researchers Dario
Carluccio and Stephan Brinkhaus at the 28th Chaos Computing Congress
(28c3) hacker conference in Berlin late last month.
During the talk, entitled, Smart Hacking for Privacy, the
researchers explained that they came across numerous security and
privacy-related issues after signing up with the smart electricity meter
service supplied by Discovergy.
Because Discovergy's website's SSL certificate was misconfigured, the
meters failed to send data over a secure, encrypted link - contrary to
claims Discovergy made at the time before the presentation. This meant
that confidential electricity consumption data was sent in clear text.
In addition, the researchers discovered that a complete historical
record of users' meter usage was easily obtained from Discovergy's
servers via an interface designed to provide access to usage for only
the last three months. The meters supplied by the firm log power usage
in two-second intervals. This fine-grained data was enough not only to
determine what appliances a user was using over a period of time --
thanks to the power signature of particular devices -- but even which
film they were watching.
The researchers concluded that the two-second frequency of power
readings was unnecessary for Discovergy's stated goals. One has to ask
why the sample rate was fast enough to determine customers viewing
habits and what devices they are using and why a complete history of
such information is being kept.
|