Smart power meters are becoming quite prevalent. Question: Can a smart power meter (with patched firmware) read the keys pressed on a wired PS/2 or USB keyboard, connected to a desktop computer? What about a laptop (connected with RJ45 Ethernet, and/or AC adapter)?
This seems like an attractive attack vector for different attackers, especially if the smart power meters can have their firmware remotely updated.
I assume the smart power meter must have the ability to sample the voltage at a high enough frequency to be able to do this. I assume the hardware specifications would depend completely on the make and model of the smart meter, although perhaps it is entirely unreasonable due to cost to assume it has the ability to do this. However, the frequency at which a USB keyboard operates is to my understanding not very high.
How can it be mitigated?
Some papers describe attacks that allow a PS/2 and USB keyboard to be read by listening on the power plug. The basic principle, as I understand it, is that crosstalk between ground and the data wire(s) will propagate. From the data wire, to the ground wire, to the power supply, and finally onto the electrical grid. Despite significant noise from other devices, the signal can in some cases still be recovered, for PS/2.
Would a trivial mitigation for this simply be to use ungrounded power cables? Or could the same crosstalk still be measured between the live and neutral wire? I assume yes, but an explanation would be nice.
Here are a couple papers I found, if there are better ones that perhaps already answer my questions, please link them in.
None of these two address my questions exactly, but are related.
The first paper states:
"It is believed that USB keyboards are not affected by this attack as they use differential signaling for cancelling the noise, though USB microcontrollers within the keyboard are much more noisy than PS/2 ones and there is a chance that some fortuitous emanations might be present."
The second paper is more concerned about USB hubs in particular. If it was trivial to extend this onto the electrical grid, I would have assumed it was included, but again an explanation would be nice.