IoT Skimmer: Energy Market Manipulation through High-Wattage IoT Botnets

## Overview

Researchers from the Communication Assurance and Performance Group at Georgia Tech (PhD candidates Tohid Shekari and Selena Rin, advised by Dr. Beyah) presented **IoT Skimmer**, an attack framework demonstrating how high-wattage IoT botnets can be weaponized to manipulate restructured electricity markets.

Following the deregulation that started in the late 1990s, modern electricity markets rely heavily on competitive bidding between generators and retailers across two primary clearing mechanisms: **Day-Ahead** markets (where commitments rely on forecasted load) and **Real-Time** markets (which balance volatile, real-time mismatches between generation and consumption). In the United States alone, electricity market transactions exceed $168 billion annually across nine regional markets, such as the New York and California independent system operators. While prior research like "BlackIoT" focused on abrupt load shifts to trigger physical grid blackouts, IoT Skimmer investigates deliberate, subtle economic manipulation for financial gain or economic sabotage.

## Threat Model and Attacker Objectives

By slightly shifting the aggregate power demand in real time, attackers exploit the price sensitivity associated with load forecasting errors to alter real-time clearing prices. The paper models two distinct threat actor profiles:

1. **Market Player (Attacker Type 1):** A profit-maximizing market participant aiming to increase their bidding revenue or exploit price spreads between day-ahead and real-time markets (analogous to pump-and-dump or short-selling schemes in financial markets). 2. **Nation-State Actor (Attacker Type 2):** A malicious entity operating within a trade or cold war context seeking to maximize widespread financial disruption and economic damage to competitors or the market at large.

To execute the attack, the adversary formulates an optimization problem using historical and real-time market data to estimate system parameters—such as real-time demand, day-ahead pricing, and price-load sensitivity—subject to market operational rules and technical constraints.

## Attack Feasibility and Economics

The presentation highlighted several factors that make IoT Skimmer practical and economically viable:

* **Botnet Scale and Cost:** A successful attack requires as few as 50,000 bots. Renting a standard botnet of comparable scale costs roughly $4,000 per month. Even if renting high-wattage botnets costs 10 to 100 times more, the investment remains negligible compared to the attack’s potential payoff, which can yield millions of dollars per day. * **Device Availability:** The attack requires high-wattage devices (e.g., smart thermostats, HVAC units, water heaters, air conditioners). In North America alone, there are over 30 million smart thermostats deployed; compromising under 1% of them provides an adequate botnet footprint. * **End-User Impact:** Assuming a botnet of 100,000 devices consuming 3 kW each, activated or deactivated for an average of 3 hours per attack across 100 days per year (roughly 8 days per month), residential consumers with compromised devices would experience only an estimated 7% increase on their electric bill in the worst case (e.g., increasing a $100 bill to $107), making user detection virtually impossible.

## Stealth Strategies

To ensure attack repeatability, avoid regulatory repercussions, and prevent detection by market operators or law enforcement, the framework incorporates specific stealth constraints:

* **Bounded Demand Shifting:** Attackers do not cause drastic load spikes that would trigger grid operator alerts. Instead, load adjustments are kept within the typical margin of standard load-forecasting error (which typically ranges between 5% and 10%). This conceals the artificial load shift inside normal forecasting noise. * **Throttled Attack Frequency:** Rather than running continuously, attacks are launched selectively (e.g., ~100 days per year or 8 days per month), significantly lowering the operational risk profile while maintaining substantial financial returns.