35K Solar Devices Vulnerable to Potential Hijacking

A new analysis shows that roughly 35,000 solar power systems from 42 vendors have exposed management interfaces, including devices such as inverters, data loggers, monitors, gateways, and more.

Of the top vendors, three were included in Forescout’s Sun:Down research, which found nearly 50 vulnerabilities affecting solar power systems that could be exploited to hijack inverters. 

The researchers noted at the time that while the sheer number of bugs was one thing to be concerned about, what was more telling were the types of vulnerabilities they found and how “obvious” they were; many of them already figure on the top 10 lists of the most common critical vulnerabilities.

Geolocated Risk of Solar Devices

Solar power technology and security is increasingly gaining public attention due to cybercrime, faulty devices, and major power outages. Though solar energy is a “rapidly growing renewable energy source,” researchers are finding that there are a host of security issues that come with it.

Using the Shodan search engine, the researchers were able to identify 35,000 solar power devices and to “spotlight specific assets and geolocated risk.”

The researchers note that Internet-exposed solar power devices are more prominent in Europe and Asia compared with other regions; three-quarters of them (76%) are located in Europe, followed by 17% in Asia; however, Internet-exposed solar devices can be found all over the world.

Related:How Neuroscience Can Help Us Battle ‘Alert Fatigue’

Some of the top vendors include SMA Solar Technology, Fronius International, Solare Datensysteme, Contec, Sungorw, Kostal Solar, and Growatt, according to researchers at Forescout Research – Vedere Labs.

The researchers found roughly 10,000 compromised SMA Sunny Webbox devices, 4,000 Fronius inverters, 3,000 Solare Datensysteme SolarLogs, 2,000 Contec’s SolarView Compacts, and 2,000 Sungrow WiNet and Logger1000 devices. The researchers also said some 800 of the SolarView Compact devices “were hijacked in Japan last year and used for bank account theft.”

Saving the Planet, One Solar Device at a Time

To mitigate against potential exploitation of the solar devices, the researchers recommend that organizations and owners of solar installations should patch devices as soon as possible or retire those that cannot be patched.

They also recommend not exposing management interfaces to the Internet.

“If a device needs to be managed remotely, consider placing it behind a VPN and follow CISA’s guidelines for remote access,” the researchers wrote. 

Because so many devices remain unpatched or exposed online, they have the potential to become hijacked by threat actors and serve as initial access points to sensitive networks.

Related:Beware of Device Code Phishing

Beyond the researchers’ recommendations, they also encourage users to follow guidelines from the National Institute of Standards and Technology for cybersecurity best practices when installing smart inverters in residential and commercial installations and the Department of Energy recommendations for industrial installations.