Can smart power meters read key presses on a wired keyboard?

Question

Smart power meters are becoming quite prevalent. Question: Can a smart power meter (with patched firmware) read the keys pressed on a wired PS/2 or USB keyboard, connected to a desktop computer? What about a laptop (connected with RJ45 Ethernet, and/or AC adapter)?

This seems like an attractive attack vector for different attackers, especially if the smart power meters can have their firmware remotely updated.

I assume the smart power meter must have the ability to sample the voltage at a high enough frequency to be able to do this. I assume the hardware specifications would depend completely on the make and model of the smart meter, although perhaps it is entirely unreasonable due to cost to assume it has the ability to do this. However, the frequency at which a USB keyboard operates is to my understanding not very high.

How can it be mitigated?

Some papers describe attacks that allow a PS/2 and USB keyboard to be read by listening on the power plug. The basic principle, as I understand it, is that crosstalk between ground and the data wire(s) will propagate. From the data wire, to the ground wire, to the power supply, and finally onto the electrical grid. Despite significant noise from other devices, the signal can in some cases still be recovered, for PS/2.

Would a trivial mitigation for this simply be to use ungrounded power cables? Or could the same crosstalk still be measured between the live and neutral wire? I assume yes, but an explanation would be nice.

Here are a couple papers I found, if there are better ones that perhaps already answer my questions, please link them in.

http://www.blackhat.com/presentations/bh-usa-09/BARISANI/BHUSA09-Barisani-Keystrokes-PAPER.pdf

https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/su

None of these two address my questions exactly, but are related.

The first paper states:

"It is believed that USB keyboards are not affected by this attack as they use differential signaling for cancelling the noise, though USB microcontrollers within the keyboard are much more noisy than PS/2 ones and there is a chance that some fortuitous emanations might be present."

The second paper is more concerned about USB hubs in particular. If it was trivial to extend this onto the electrical grid, I would have assumed it was included, but again an explanation would be nice.

Answer 1

It is extremely unlikely that a smart meter would be able to read the keystrokes off a keyboard, even with custom firmware. Doing that requires three things which a smart meter lacks:

• An extremely accurate power monitor with a high sample rate.

  Samples are typically taken every 30 minutes, but can be taken as fast as 6 times per second. This is not enough to monitor the rapid power use variations of a keyboard microcontroller.

• A large and high-speed storage system to record raw samples for later processing.

  According to at least one standard for smart meters, they must be able to store 13 months-worth of data consumption information at 30 minute sample intervals. This is not very much.

• A powerful processor (or FPGA) capable of filtering out the noise.

  A quick search for random technical specifications for a smart meter show one example running an ARM Cortex M4, with 256 KiB of system memory. This is not nearly sufficient.

Smart meters have several options for monitoring power: shunt resistors, Rogowski coils, Hall-effect sensors, and current transformers. As far as I am aware, none of these techniques have accuracy greater than +/- a few milliamps. Accuracy of Rogowski coils, for example, can be up to 0.5%, although manufacturing tolerances often result in it being as low as 5%. Monitoring an 8051 processor with a high-precision sensor connected directly to the microcontroller power source requires at least 12 bit sample size, with the sample rate being an integer multiplication of the clock source (millions of times per second at a minimum). Traditional power monitoring solutions cannot accomplish this.

There is been a paper from 2009 on this subject which focuses on both USB and PS/2 keyboards, and details a number of techniques to analyze the keystrokes. While the paper focuses on EMSEC (compromising electromagnetic emanations), the concepts involved should be fairly similar. A single recording had to be processed for two seconds by a powerful processor. A dedicated FPGA would be required to analyze the samples in real time, not a low-power ARM processor.

Now, there are privacy concerns with smart meters. At a high enough sampling rate, they can determine what channel is being viewed on a television, as the net power usage from the screen varies based on what is being displayed. I don't have a paper to link to, so this is just from memory. It may or may not apply to modern LCD displays where the power usage is roughly similar regardless of what is displayed. But are they able to perform efficient power analysis attacks against low-power microcontrollers in an entire home full of devices, using nothing more than a firmware update?

Virtually impossible.