1y ago

512-bit RSA key in home energy system gives control of “virtual power plant”

arstechnica.com

14 comments

Castellucci, whose pronouns are they/them, acquired this remarkable control after gaining access to the administrative account for GivEnergy, the UK-based energy management provider who supplied the systems. In addition to the control over an estimated 60,000 installed systems, the admin account—which amounts to root control of the company's cloud-connected products—also made it possible for them to enumerate names, email addresses, usernames, phone numbers, and addresses of all other GivEnergy customers (something the researcher didn't actually do).
tl;dr: hacker (the good kind) exploits weak encryption key to gain access to the utility's management system. Because you too were probably wondering how key length and power generation could possibly be related.
Wow, props to Castellucci for being a stand up person and not using their discovery to control or mess with tens of thousands of people’s power supply. And props to GivEnergy for not turning around and suing them after they reported finding the issue.
This could have gone badly in either direction, but we lucked out that this Castellucci seems to be an excellent and conscientious citizen.
This was an incredibly interesting article.
- Right? I feel like ars technica has been on a roll this year
  
  I subbed because I’ve really enjoyed their content for the past few years
You have to wonder how many other things are out there with effectively worthless encryption because some old document or default option told them to/allowed them to implement it without any 'hey! some 14 year old with a TI-83 could crack this key!' warnings.
- There was a book with a Bitcoin wallet generator code in it that specifically said that it was vulnerable and was only to be done as a demo test and yet somebody released a wallet with that code and fucked a bunch of people over on accident.
Yet another reason to never connect your devices to the cloud.
You know, at least when I've had to generate RSA keys for SSH, it seems like the highest I can possibly do is 4096. Just makes me wonder why you can't generate a key of any links that's a multiple of 1024. Such as, what if I wanted a 20,480 bit key?
- Current recommendation is to stop using RSA in new deployments altogether. ECC is preferred now, and the major programs (OpenTLS, OpenSSH, etc.) support it.
  
  Thats ECDSA correct? Or is that something different?
- I believe you can with openssl, but it will take lots of time both generating and using the key. Think you sign something with that key, and the other party is using a low end device. He might take few mintues to verify the signature. The drawbacks just outweight the benefits. Security is a balancing act between complexity and usability.

14 comments