{"id":11348,"date":"2016-02-18T10:20:28","date_gmt":"2016-02-18T15:20:28","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=11348"},"modified":"2017-09-24T08:09:09","modified_gmt":"2017-09-24T12:09:09","slug":"air-conditioner-hack","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/air-conditioner-hack\/11348\/","title":{"rendered":"Hacking air conditioners leads to the whole block&#8217;s blackout"},"content":{"rendered":"<p>At the <a href=\"https:\/\/www.kaspersky.com\/blog\/tag\/thesas2016\/\" target=\"_blank\" rel=\"noopener nofollow\">Security Analyst Summit 2016<\/a> Vasilios Hioureas from Kaspersky Lab and Thomas Kinsey from Exigent Systems <a href=\"http:\/\/www.wired.com\/2016\/02\/how-to-hack-the-power-grid-through-home-air-conditioners\/\" target=\"_blank\" rel=\"noopener nofollow\">revealed<\/a> how anybody with $50 in their pocket can hack one of their neighbor\u2019s air conditioner. If a hooligan chooses the right time and place, he can even cause a blackout in the neighborhood.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022933\/ac-vs-powergrid-FB.jpg\" rel=\"attachment wp-att-11350\"><img decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022933\/ac-vs-powergrid-FB.jpg\" alt=\"Hacking air conditioners leads to the whole block's blackout\" width=\"1280\" height=\"1280\" class=\"aligncenter size-full wp-image-11350\"><\/a><\/p>\n<h3>How is this possible?<\/h3>\n<p>Many people take their energy consumption seriously and try to be responsible in their usage. This type of approach is also encouraged by the states. Some utility companies in the United States <a href=\"https:\/\/www.sce.com\/wps\/portal\/home\/residential\/rebates-savings\/summer-discount-plan\/\" target=\"_blank\" rel=\"noopener nofollow\">offer<\/a> their customers the opportunity to save up to $200 per year if they allow the provider to turn their air conditioners off during peak energy periods. This is all done remotely, of course.<\/p>\n<p>For that the companies connect the air conditioning system to a special device, which receives commands to switch on and off over the air. Summer is hot, but during peak periods it\u2019s much better to spend a few hours without air conditioning than have no electricity at all \u2014 so that policy seems quite reasonable.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">IoT: How I hacked my home <a href=\"http:\/\/t.co\/CCx9eQEbL2\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/CCx9eQEbL2<\/a> via <a href=\"https:\/\/twitter.com\/Securelist?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@Securelist<\/a> by researcher <a href=\"https:\/\/twitter.com\/JacobyDavid?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@JacobyDavid<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/InternetofThings?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#InternetofThings<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/502462821574393857?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">August 21, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Whenever necessary operators at regional centers send the command to turn air conditioners off via a specific radio frequency. Repeater stations that are installed all over the city amplify the signal until it reaches its destination. The thing is that all receivers, which had been examined by our researchers, had no encryption or authentication solution. So in fact, anybody who could emit a stronger signal was able to blackout the utility company\u2019s commands and gain control over all of these devices.<\/p>\n<p>The necessary equipment can be easily purchased by pretty much everyone \u2014 it\u2019s cheap and not hard to find. If you have $50, you can buy a device that is capable of powering on and off several air conditioners nearby. But if you can come up with $150, you could control couple of a blocks of your neighborhood. If you are a deep-pocketed criminal, this can be scaled to have control over the whole city.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">More connected, less secure: how we probed <a href=\"https:\/\/twitter.com\/hashtag\/IoT?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#IoT<\/a> for vulnerabilities <a href=\"https:\/\/t.co\/f4Y6iXLG8U\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/f4Y6iXLG8U<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/internetofthings?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#internetofthings<\/a> <a href=\"https:\/\/t.co\/ZwFbvGGW6G\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/ZwFbvGGW6G<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/662276796310769664?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">November 5, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>While this is a bad scenario at first glance, it is not overly critical. The reason is that air conditioners turned off during the summer or turned on remotely in the winter would only seriously impact certain parts of the population (elderly, terminally ill, etc.) in a dire manner. This group is typically not one who would be a prime particicipant for the program. Also actions like this can also break air conditioning units.<\/p>\n<p>The larger issue with this lies within peak energy periods and if a criminal would turn all of the air conditioners on at one time. This can cause a sudden blackout in the whole district.<\/p>\n<h3>What\u2019s the purpose of doing that?<\/h3>\n<p>One scenario could be that the criminals need it to penetrate into the de-energized office of their business competitors.. It\u2019s noteworthy, that such manipulations do not require any special skills. The only thing a criminal needs to do is to find the radio frequency used by the utility company and write down commands, which are send by operators.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">How to hack the power grid through home air conditioners <a href=\"https:\/\/t.co\/XSEY4Hgw8G\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/XSEY4Hgw8G<\/a><\/p>\n<p>\u2014 WIRED (@WIRED) <a href=\"https:\/\/twitter.com\/WIRED\/status\/697286381094178816?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 10, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/p>\n<p>Another way to exploit this vulnerability is to jam the RF traffic with noise and enjoy both, utility companies discount and working air conditioners during peak hours.<\/p>\n<p>The researchers did not disclose the names of the vulnerable devices as they are still discussing this problem with the vendors. However, the whole situation shows how insecure our connected world is. It doesn\u2019t really matter how exactly it is connected \u2014 via radio frequencies or Internet, it\u2019s possible to hack both, as people do not care about security as much as they should.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Recapping <a href=\"https:\/\/twitter.com\/hashtag\/TheSAS2016?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#TheSAS2016<\/a>: IoT hacks, <a href=\"https:\/\/twitter.com\/hashtag\/Metel?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Metel<\/a>, <a href=\"https:\/\/twitter.com\/hashtag\/Poseidon?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Poseidon<\/a>, and more <a href=\"https:\/\/t.co\/IqPXRtMs8r\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/IqPXRtMs8r<\/a> <a href=\"https:\/\/t.co\/2Pu461dOkl\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/2Pu461dOkl<\/a><\/p>\n<p>\u2014 Eugene Kaspersky (@e_kaspersky) <a href=\"https:\/\/twitter.com\/e_kaspersky\/status\/699967550419939328?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 17, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Technologies are constantly developing, and five year old devices now can be hopelessly outdated. Meanwhile, Hioureas and Kinsey found out that the chip used in some of the devices they examined in this case were developed in 1995. As a result, even if the vendor wanted to add authentication to such a device, it would be impossible \u2014 equipment simply would not cope with this task.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Researchers expose how a criminal can hack air conditioners to crash the power grid.<\/p>\n","protected":false},"author":522,"featured_media":11349,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[1438,658,794,352,1439,944,1410],"class_list":{"0":"post-11348","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"tag-air-conditioners","9":"tag-internet-of-things","10":"tag-iot","11":"tag-kaspersky-lab","12":"tag-network","13":"tag-researchers","14":"tag-sas-2016"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/air-conditioner-hack\/11348\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/air-conditioner-hack\/6729\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/air-conditioner-hack\/6789\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/air-conditioner-hack\/6718\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/air-conditioner-hack\/7782\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/air-conditioner-hack\/7532\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/air-conditioner-hack\/10911\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/air-conditioner-hack\/6003\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/air-conditioner-hack\/6416\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/air-conditioner-hack\/7057\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/air-conditioner-hack\/10458\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/air-conditioner-hack\/10911\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/air-conditioner-hack\/11348\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/air-conditioner-hack\/11348\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/air-conditioners\/","name":"air conditioners"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/11348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/522"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=11348"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/11348\/revisions"}],"predecessor-version":[{"id":19274,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/11348\/revisions\/19274"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/11349"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=11348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=11348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=11348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}