Powerless Security – A Security Analysis of in-Home Power Line Communications based on HomePlug AV2
Stefan Hoffmann, Jens Müller, Jörg Schwenk, Gerd Bumiller
18th International Conference on Applied Cryptography and Network Security (ACNS 2020)
Abstract
Power line communication (PLC) allows home users and industries to transfer data over power cables. Protection of transmitted data is crucial because signals are not limited to "one’s own four walls". We provide a detailed and structured security analysis of the currently most widely used in-Home PLC standard, namely the Broadband-PLC specification HomePlug AV2 (part of IEEE 1901), and present a design weakness in the pairing process as well as a new offline dictionary attack that can be used to compute the main network key efficiently. We evaluated our attacks on 13 widely used PLC devices and found all of them be vulnerable. We provide different countermeasures and discuss their advantages and disadvantages. We responsibly disclosed the vulnerabilities and are currently supporting the vendors in fixing these issues.