Are powerline ethernet adapters inherently secure?

Question

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or townhouse.

I've noticed the speed is much faster when i just plug and play, rather than going through the encryption process - it's a little difficult.

So my question is, on a closed loop system - electricity inside my house - do I really need to set up the encryption? Or is it secure by the nature of the system itself?? How much of it 'leaks out' without encryption?

This question was IT Security Question of the Week.
Read the Mar 15, 2012 blog entry for more details or submit your own Question of the Week.

Answer 1

You do get some security from the way your fuse box is connected to the mains.

In principle you should get a good signal across any part of the wiring in your house that is on the same phase, and you shouldn't get any on the other phases.

In reality though, that isn't quite true - depending on your fuse box, you may get some bleed over onto the other phases, and you will almost definitely get leakage outside your 4 walls.

This is why encryption was put in place on these types of things - a neighbour may be able to sniff your traffic.

Things that help with security, because they hinder signal strength - surge protectors, UPS's etc. but those don't prevent an attacker.

tl;dr

Encrypt, because you will be leaking signal. Not so much wirelessly (it can be done but it is tricky) but just across the existing mains wiring.

Answer 2

I think this is a complex subject, one especially the poor, non-techncial consumer does not have a hope of running a secure network at home.
My reasons for saying this are documented in this blog: http://colinrobbins.me/2013/01/11/ethernet-over-power/

Answer 3

It seems that powerline ethernet adapters are often, formally, a breach of your contract with your power supplier, because the power lines have not been designed and normalized for that kind of usage. You won't get into problems if you have the right kind of converter between your house and the main power line. If the converter is old, it is possible that you are actually broadcasting your data to every house in the street...

Chances are that your converter is fine and you do not broadcast data that way. However, your are sending high-frequency signals through wires which are not shielded for that. Consider alarm clocks with FM radios: many use their power cord as antenna. So power cords must be workable hardware for picking up 100 MHz signals. And 100baseT ethernet has a base signal clocked at... 100 MHz ! So the powerline adapter is sending your precious data bytes into a big structure of wires (all the power lines in the house) which is likely to act as a big antenna. This cannot be hard to pick up remotely.

If the adapters are bad at crypto, you should be able to activate it on the machines themselves, at the OS level (IPsec is supported by many OS, including Windows since Windows 2000).

Answer 4

I live in a detached family home in Texas. I have a pair of Trendnet TPL-303E powerline adapters and have experienced the signal bleed from my next door neighbor. I ran the Powerline utility that came with the adapters and could identify two other powerline adapters using the same network name. I got anywhere between 10 to 20Mbps of throughput between their adapters and mine. I even seperated my powerline adapters from my router and connected them direct to my pc to see how bad the bleed was. I was able to access their router, watch streaming video and see the computers on the network. I also noticed they had gotten IPs on my router also. I've since enabled security.

Answer 5

I realize that this isn't what you're asking, but it's important enough that I decided to write it anyway: If security is important to you, then you should, as a rule, assume that ALL networks are insecure. (because in the end, they all are)

Many of the more expensive network security disasters in IT have come from the assumption that "behind the firewall" everything is safe. Then when an external influence leaks in, as always eventually happens, it runs rampant and unchecked. I've witnessed this happen several times working for companies that that should have known better, like IBM.

Instead of relying on a secure perimeter, each node should be its own island of security with proper authentication and permission checks happening at each step along the way. Your system should be as secure in its home environment as it is out on the open Internet. Obviously you don't want to expose your systems to more risk than you have to, but that also means that you don't let your guard down behind the firewall.

Also, to answer your real question: yes, these systems are inherently insecure, especially in an apartment. Generally the signal can't reliably get past your power meter because the equipment installed there isn't friendly to that kind of signal. But that's usually expressed more as a "don't expect it to work when you want it to" sort of warning rather than an assurance of security. Field reports from users frequently suggest that they can see other people's network if they're physically close enough.

Answer 6

I am not familiar with Zyxel's product but overall the PLC signal is basically a radio signal and should be treated as such. This is why adapters work on different phases in your house.

It would take some sophisticated and sensitive equipment to pick the PLC signal up out of the air, but it can be done, and if someone can plug into your homes electrical system that process would be easier.

Transformers block the PLC signal, so you don't have to worry about it traveling down the line to your neighbors.

Answer 7

I'd say you would be looking at being about as secure as a standard Ethernet wire. That's what WEP originally stood for, Wired Equivalency Protocol so what that was saying is the security is as good as you have being on a wire (requiring someone to physically tap in to get your signal). While that was total BS as far as the Wireless went... the concept here should match up rather nicely. IE... unless someone is physically tapped into your closed home electrical system then you are secure with zero need for encryption.