Shining A Light On Solar System Cyber Security

Shining A Light On Solar System Cyber Security

Speakers: Sick Codes (Independent)

Conference: HITB Phuket

YouTube: https://www.youtube.com/watch?v=aPfWRi8BJKw

Overview

In an era defined by a rapid global transition to renewable energy, the cybersecurity of critical infrastructure faces unprecedented challenges. This talk, "Shining A Light On Solar System Cyber Security 2.0," delivered by independent researcher Sick Codes at HITB Phuket, delves into the often-overlooked vulnerabilities inherent in the burgeoning solar energy sector. The presentation highlights a critical paradox: while solar energy systems are inherently distributed energy resources (DERs), their widespread adoption often relies on centralized, internet-connected management platforms, creating a significant single point of failure.

Sick Codes, an "independent researcher" and "good intentions hacker," brings to light how the responsibility for grid security is inadvertently being offloaded to individual homeowners and businesses, who are ill-equipped to manage complex cyber threats. With solar power accounting for a staggering 40% of all new electrical generating capacity in the US during the first half of 2022, the implications of these vulnerabilities are profound. The talk argues that a successful attack on these systems could lead to widespread grid destabilization, mass blackouts, and cascading societal chaos, affecting everything from emergency services and autonomous vehicles to food supply chains. This research serves as a stark warning, urging a re-evaluation of security postures in the global push towards a renewable future.

Background

▶ Watch: Introduction to solar system cybersecurity (0:00)

The global energy landscape is undergoing a fundamental shift, moving away from traditional, centrally controlled power grids reliant on large-scale power plants (coal, gas, nuclear) towards a more decentralized model. This future grid envisions numerous smaller, distributed energy sources, with solar power at the forefront. As Sick Codes illustrates, this means that millions of individual households and businesses, each with their own solar installation, effectively become "guardians of the grid." However, this distribution of power generation does not automatically translate to distributed security management.

Historically, grid control has involved mechanisms like ripple control receivers, which detect specific "jagged edges" (ripples) on the AC power waveform to remotely change electricity tariffs or even switch off loads. Large-scale ripple control transmitters (e.g., RTS 640/660, capable of 11,000 to 30,000 volts) could be used to induce a localized denial-of-service on the grid by sending out a signal that temporarily disables power until the ripple subsides. Modern smart meters, such as the EDMI Atlas MK7A, equipped with SIM cards, already enable remote disconnection and reconnection of electrical services, raising early concerns about remote control and potential abuse.

The rapid proliferation of solar is evident globally. In Australia, for instance, a significant portion of the grid relies on solar, and countries like Hawaii see solar contributing 20% of their total energy supply. Sick Codes notes the particular situation in South Africa, where widespread cable theft and corruption have led to frequent load shedding (rolling blackouts) and a surge in independent power operators, creating a highly distributed energy environment. While this decentralization offers resilience against single-point physical attacks on large plants, it introduces new, complex cybersecurity challenges. The speaker highlights that current national energy security frameworks, like those from energy.gov and CISA in the US, are now focusing on securing these massively distributed grids.

The consequences of grid failure in such a distributed, interconnected world are severe. Blackouts lead to chaos: refrigerators stop, water pumps fail, cashless payment systems become inoperable, and perishable food must be discarded (as advised by ready.gov for items exposed to over 40°C for more than two hours). A poignant example demonstrated in the talk was a news report from San Francisco showing autonomous vehicles immediately stopping and blocking emergency services when cellular reception was lost, underscoring the cascading failures that can occur when critical infrastructure relies on a stable power and communication grid. Sick Codes also referenced the tragic Maui fires, noting the high density of solar installations in affected areas. While not directly linking solar to the cause, he pondered the monumental challenge of rebuilding power from a distributed grid if every "node" (individual solar system) is destroyed, akin to losing half the nodes in a Bitcoin network. The talk underscores that while solar penetration might seem small nationally (e.g., 2.8% of US renewables), it is significantly higher in specific regions, making those areas highly vulnerable to targeted attacks.

Crucially, the speaker points out that while traditional large-scale power plants are subject to rigorous security standards (like NERC CIP in the US), individual solar installations are not. The implication is that the "household owner effectively becomes the guardian of the grid," tasked with responsibilities that would typically require a full team of OT specialists, compliance officers, and emergency planners – an entirely unrealistic expectation for the average consumer. This fundamental mismatch between distributed responsibility and centralized security needs forms the core problem addressed by the research.

Key Findings

▶ Watch: Distributed grids make homeowners grid guardians (7:40)

Sick Codes' research unveils a critical and systemic vulnerability within the solar energy industry: the deceptive nature of "distributed" energy resources being managed through highly centralized control systems. Despite the physical decentralization of solar panels across millions of rooftops, many popular inverter brands, such as Huawei, funnel all monitoring and control through a single, often overseas, cloud-based platform. This architecture creates a massive single point of failure, ripe for exploitation.

The primary vectors for these vulnerabilities are the smart dongles that connect individual inverters to the internet and, subsequently, to these centralized management systems. Sick Codes demonstrated several critical flaws:

1. Insecure by Design Physical Access: Inverters and their dongles are frequently installed outdoors, often in easily accessible locations like car parks, rooftops (reachable via fire escapes), or even at street level. These dongles often feature physical Ethernet ports, allowing anyone to simply "walk up and plug into it," gaining direct access to the homeowner's network. The speaker humorously noted the irony of an IP65-rated (dust-tight, protected from water jets) device designed for outdoor installation, yet providing an open network port.
2. Default and Weak Passwords: Many dongles ship with default passwords (e.g., "highvoltage2022A" or "changeme") that are either hardcoded or printed directly on a sticker on the device. Installers, often focused on electrical rather than cybersecurity concerns, rarely change these, leaving a wide-open door for attackers. The speaker highlighted that scanning the QR code on the dongle often reveals this insecure password.
3. Plaintext Credentials in Firmware: Analysis of the dongle's firmware revealed Wi-Fi SSIDs and passwords stored in plain text, making it trivial for an attacker to extract network credentials once physical access or firmware dumping is achieved.
4. Excessive and Unnecessary Firmware Functionality: The dumped firmware from a Huawei dongle, running on a proprietary HighSilicon chip (described as sanction-immune and fabricated in Shenzhen), contained a plethora of low-level network commands and functions far beyond what's necessary for basic solar monitoring. These included commands like get peers, get sock, AR table, AR spoofing, debug mode, stop access point, and even suspicious "RAT" commands (rat up, rat bind, rat close) which, in a cybersecurity context, typically refer to Remote Access Trojans. This excessive functionality significantly expands the attack surface.
5. Unprompted and Forced Updates: The firmware analysis revealed that the dongles can receive and apply updates without any prompt, confirmation, or physical input from the owner. There are no buttons on the dongle to accept or deny an update. This capability, combined with centralized control, means that a compromised management system could push malicious firmware updates globally, effectively "bricking" every connected inverter of that brand.
6. Centralized Control Paradox: The FusionSolar app (Huawei's monitoring app, requiring download from their own app gallery due to Google Play restrictions) serves as the primary interface to the centralized cloud platform. This platform grants administrators extensive permissions, including "real time status query," "create user," "defect user," "device inspection stop," and "defect upgrade." A successful compromise of this single centralized platform could allow a rogue employee or state-sponsored actor to simultaneously disable millions of inverters worldwide, causing catastrophic grid collapse.

The culmination of these findings points to a severe systemic risk. A single breach of a major solar inverter manufacturer's centralized management system could instantaneously disable a significant portion of the global solar fleet, leading to widespread, prolonged blackouts and societal breakdown. This scenario, Sick Codes warns, is not theoretical but a direct consequence of the insecure-by-design architecture currently prevalent in the industry.

Technical Deep Dive

▶ Watch: Inverter dongle's default passwords and outdoor access (36:15)

The core of Sick Codes' technical investigation centers on the architecture and vulnerabilities of modern solar power systems, particularly focusing on the inverter and its associated smart dongle. A typical solar system comprises photovoltaic panels (either older, less efficient polysilicon or newer, more efficient monocrystalline panels, which are often darker and indicative of more advanced, internet-connected systems) and an inverter. The inverter is the brain, converting the direct current (DC) generated by the panels into alternating current (AC) suitable for household use or feeding back into the electrical grid.

The critical component enabling remote management and introducing significant vulnerabilities is the smart dongle. Sick Codes demonstrated a Huawei WLAN-FE dongle, which connects to the inverter and then to the internet, typically via Wi-Fi or an Ethernet port (for the WLAN-FE version) or a SIM card (for the 4G version). These dongles are designed for outdoor installation, rated IP65 for dust and water protection, but this outdoor placement often makes them physically accessible to attackers. The speaker emphasized the absurdity of an Ethernet port being exposed on the exterior of a building, offering an attacker direct physical access to the internal network.

The research involved acquiring and analyzing one of these dongles. Sick Codes described using a Tigard board and Flash ROM to dump the firmware from the dongle's internal chip, which was identified as a HighSilicon chip. HighSilicon is Huawei's proprietary semiconductor division, and these chips are noted for being "sanction-immune." The firmware, a 16-megabyte binary file, was then subjected to analysis.

Key technical discoveries from the firmware analysis included:

• Plaintext Credentials: Within the dumped firmware, the Wi-Fi SSID and password for the network the dongle connected to were found in plain text. This means an attacker with physical access to the dongle could easily extract network credentials.
• Certificates and Keys: The firmware contained various certificates, including a SunCA certificate (likely for Huawei's "Sun2000" inverter series) and a Tomcat client certificate along with its private key. The presence of these private keys allows an attacker to decrypt encrypted communications between the dongle and the centralized management server, effectively nullifying the security of encrypted channels.
• Modbus Interface: The firmware indicated the use of Modbus, a serial communications protocol commonly used in industrial control systems (ICS) and SCADA environments, for interfacing with the solar inverter. While Modbus itself isn't inherently insecure, its implementation and exposure through a vulnerable dongle create attack opportunities.
• Extensive Network Commands: A vast array of low-level network commands were identified, many of which appear unnecessary for the dongle's stated function. Examples include:
• get peers, get sock: For discovering and interacting with other devices on the network.
• AR table, AR spoofing: Commands related to Address Resolution Protocol (ARP), which could enable network sniffing or man-in-the-middle attacks.
• debug mode, stop access point: Potentially allowing an attacker to manipulate the dongle's operational state or disable its Wi-Fi access point.
• "RAT" commands: The presence of commands like rat up, rat bind, rat close is particularly alarming. While their exact function in this context wasn't definitively stated, in cybersecurity, "RAT" typically refers to Remote Access Trojans, implying a capability for extensive remote control and reconnaissance beyond simple monitoring.
• Uncontrolled Update Mechanism: The firmware included functions like delay update and delay active. Critically, the dongle has no physical buttons, meaning any firmware update pushed from the centralized management system is accepted and applied without the owner's knowledge or consent. This provides a mechanism for mass-bricking devices or silently installing malicious payloads.

This deep dive reveals that the smart dongle, intended as a benign monitoring device, is a sophisticated, internet-connected embedded system with powerful, often excessive, and poorly secured capabilities. Its design choices, from physical placement to firmware functionality, create a critical attack surface that could be leveraged for widespread grid disruption.

Demo / Proof of Concept

▶ Watch: Firmware dump reveals private keys and commands (48:00)

While Sick Codes' talk did not feature a live, real-time hacking demonstration, it presented a compelling conceptual proof of concept through a combination of physical observations, software analysis, and real-world parallels. The "demo" effectively illustrated how the identified vulnerabilities could be exploited to achieve catastrophic outcomes.

1. Physical Vulnerability Showcase: The speaker used Google Maps imagery (and humorous "Minecraft" simulations) to demonstrate the widespread physical accessibility of solar inverters and their dongles. Images of airports (San Diego, Brisbane), commercial buildings, and even public libraries showed inverters mounted on rooftops or in car parks, often within easy reach via fire escapes or walking paths. Sick Codes pointed out that one could simply "walk up and turn it off" or physically remove a dongle, highlighting the lack of physical security.
2. Default Credential Exposure: The core of the conceptual exploit was the revelation of easily obtainable default credentials. By displaying a Huawei smart dongle with its QR code, Sick Codes demonstrated how scanning it would reveal a default password like "highvoltage2022A" and the instruction "changeme." This illustrated the ease with which an attacker could gain initial access to the device's local management interface.
3. Centralized Control Interface: The talk then moved to the FusionSolar app, Huawei's centralized monitoring application. Screenshots of the app's administrative interface showed a wide array of powerful permissions, including "real time status query," "create user," "defect user," "device inspection stop," and "defect upgrade." This visually demonstrated the extensive control capabilities available through the centralized cloud platform, emphasizing that a compromise of this single point could grant an attacker immense power over connected inverters.
4. Firmware Analysis as Evidence: The most technical "proof of concept" was the presentation of findings from the dumped firmware of the Huawei dongle. This included:

• Confirmation of plaintext Wi-Fi SSIDs and passwords.
• The presence of Tomcat client certificates and their private keys, which could be used to decrypt communications.
• A long list of suspicious and unnecessary network commands like get peers, AR spoofing, and "RAT" commands (rat up, rat bind, rat close). These findings served as concrete evidence of the dongle's inherent capabilities that could be weaponized.
• The discovery of an uncontrolled update mechanism, where updates could be pushed without owner confirmation, underscored the potential for mass bricking.

1. Cascading Failure Scenario (Autonomous Cars): As a powerful analogy for the real-world impact of grid failure, Sick Codes presented a news video of autonomous Cruise vehicles in San Francisco coming to a complete halt and blocking traffic after losing cellular service during a power outage. This "demo" visually reinforced the speaker's argument that disruptions to critical infrastructure (like power and communications) can have severe, cascading effects on modern society, including emergency response and transportation.

By combining these elements, Sick Codes effectively constructed a compelling narrative and conceptual proof of concept, demonstrating that the theoretical vulnerabilities identified in solar inverter systems translate directly into plausible, high-impact attack scenarios.

Defensive Implications

▶ Watch: Countries susceptible to remote solar grid attacks (57:00)

The vulnerabilities identified in solar energy systems present significant challenges for cybersecurity, necessitating a multi-faceted defensive strategy across physical, network, and policy domains. Defenders must move beyond traditional IT security models to address the unique complexities of distributed energy resources.

1. Enhance Physical Security: The most immediate defensive measure is to secure the physical access points. Solar inverters and their smart dongles, especially those with exposed Ethernet ports, should be installed in physically secure locations, ideally indoors, or within locked, tamper-evident enclosures. Rooftop installations accessible via fire escapes or public areas require additional physical barriers or monitoring. This prevents attackers from simply walking up and plugging into the network or removing the dongle.
2. Implement Robust Network Segmentation: It is critical to isolate solar inverters and their dongles from the main home or corporate network. This can be achieved through Virtual Local Area Networks (VLANs) or Demilitarized Zones (DMZs), creating a segregated network segment specifically for the inverter. This way, even if an attacker gains control of the dongle, they are contained within a separate network and cannot easily pivot to other sensitive devices. Techniques like MAC address filtering and assigning static IP addresses to the inverter's port can further restrict unauthorized devices.
3. Mandate Strong Authentication and Credential Management: All default passwords for inverters, dongles, and associated monitoring applications must be changed immediately upon installation. These passwords should be complex, unique, and securely stored. Installers must be educated and incentivized to prioritize cybersecurity best practices, including password changes, as a standard part of their installation process.
4. Scrutinize Firmware Update Mechanisms: Users and organizations should investigate their inverter systems' firmware update policies. Ideally, updates should require explicit consent from the owner rather than being pushed automatically without prompt. Manufacturers should develop secure, verifiable update processes that prevent the silent installation of malicious firmware. Regular security audits of firmware for unnecessary functionality and backdoors are also crucial.
5. Address Supply Chain Security: Governments and critical infrastructure operators must critically evaluate the cybersecurity posture and geopolitical implications of solar equipment manufacturers, particularly those with centralized management systems located in foreign jurisdictions. A comprehensive supply chain risk assessment should be a prerequisite for large-scale deployments, considering the potential for state-sponsored attacks or rogue employees.
6. Increase Awareness and Education: There is an urgent need to educate both installers and end-users (homeowners, businesses) about the cybersecurity risks associated with DERs. Installers require training on secure installation practices, network segmentation, and password management. Homeowners need to understand that their solar system is a networked device that requires active security management.
7. Develop Industry Standards and Regulatory Oversight: Current cybersecurity regulations for critical infrastructure (e.g., NERC CIP) often do not adequately cover distributed energy resources. New standards or adaptations are needed to enforce minimum-security requirements for solar inverters and their associated management platforms, reflecting their growing importance to grid stability.
8. Prioritize Grid Resilience and Backup Planning: In the event of a mass inverter failure, robust grid resilience strategies are essential. This includes maintaining diverse energy sources (including traditional and potentially nuclear power), investing in grid-scale energy storage, and developing contingency plans for widespread blackouts, including emergency power generation (e.g., diesel generators) and manual override capabilities for critical infrastructure.

By implementing these defensive measures, stakeholders can begin to mitigate the profound risks posed by insecure solar energy systems and ensure that the transition to a renewable future is both sustainable and secure.

Key Takeaways

• Centralized Control in Distributed Systems is a Critical Flaw: Despite the physical distribution of solar panels, many systems rely on a single, often overseas, centralized cloud management platform. This creates a massive single point of failure, enabling a potential attacker to control or disable millions of devices globally with a single command.
• Insecure-by-Design Hardware and Software: Solar inverter smart dongles often ship with default, easily guessable, or hardcoded passwords (e.g., "changeme," "highvoltage2022A") that are rarely changed. Their outdoor installation with exposed network ports provides easy physical access, and firmware analysis reveals plaintext credentials and excessive, unnecessary network control commands (including "RAT" functionalities).
• Uncontrolled Firmware Updates Pose Mass Compromise Risk: The lack of physical buttons or owner consent for firmware updates means that malicious or buggy updates pushed from a compromised centralized server could simultaneously "brick" all connected inverters of that brand, leading to widespread, unrecoverable system failures.
• Catastrophic Grid Instability and Societal Impact: A successful large-scale attack on these centralized solar management systems could drop a significant portion of a region's grid supply (e.g., 17-20% in Hawaii), inducing immediate load shedding, mass blackouts, and widespread chaos, impacting emergency services, autonomous vehicles, food supply, and cashless transactions.
• Urgent Need for Enhanced Security and Regulatory Oversight: The rapid growth of solar energy necessitates immediate action from manufacturers (security-by-design, minimal attack surface), installers (secure configuration, strong passwords), and regulators (new standards for DERs) to implement robust physical and network security, strong authentication, and critical supply chain vetting.
• Individual Homeowners Are Unprepared Guardians: The current model effectively shifts grid security responsibility to individual homeowners who lack the expertise and resources to defend against sophisticated cyber threats. This highlights a fundamental gap in current energy security frameworks that must be addressed through education, better product design, and broader governmental oversight.

About the Speaker(s)

Sick Codes is an independent researcher known for his "good intentions hacker" approach, adhering to legal and ethical guidelines in his work. He explicitly states that his research is for educational purposes and that he has no affiliation with any entities mentioned in his presentations. Sick Codes emphasizes his role as "just the messenger," urging audiences not to "shoot the messenger" for bringing uncomfortable truths to light.

His background includes experience with hardware attack training, drawing inspiration from prominent figures like Joe Grand. Notably, Sick Codes also has prior experience selling solar panels, which has provided him with an in-depth understanding of the industry's products, installation practices, and operational aspects. This unique perspective allows him to identify vulnerabilities that might be overlooked by those without hands-on experience in the sector. He has also conducted research in agricultural cybersecurity, demonstrating a broad interest in critical infrastructure security.