Rafts of Security Bugs Could Rain Out Solar Grids
As climate change continues to show irreversible effects on the planet, the push for more sustainable energy options continues to gain popularity. Solar power systems, in particular, are increasingly becoming more widely used, accounting for a $70 billion market value in 2024. But these eco-friendly options come with downsides, too, specifically when it comes to cybersecurity.
Researchers at Forescout — Daniel dos Santos, Francesco La Spina, and Stanislav Dashevskyi — this week at Black Hat Asia in Singapore detailed close to 50 vulnerabilities impacting the security of at least three leading solar power vendors, Sungrow, Growatt, and SMA.
The researchers found that each vendor has vulnerabilities affecting the whole solar power ecosystem, from power inverters and network connectivity dongles to mobile applications and cloud backends.
A Solar Ecosystem of Problems
In the course of their research, the Forescout analysts found 46 new vulnerabilities across the vendors’ gear, which could enable scenarios that affect grid stability and user privacy, or, in residential settings, pivot to hijack other smart devices in users’ homes.
For instance, Growatt inverters were susceptible to cloud-based takeover, allowing unauthorized access and control of a user’s resources, solar plants, and devices, Forescout found. Sungrow inverters could be hijacked by harvesting communication dongle serial numbers through various insecure direct object references (IDORs), using hardcoded credentials found on the device and publishing messages that lead to remote code execution and full takeover of the inverter.
Related:China-Linked Threat Group Exploits Ivanti Bug
Once in control of the inverters, attackers can tamper with their power output settings or switch them off and on in a coordinated manner as a botnet. “The combined effect of the hijacked inverters produces a large effect on power generation in a grid,” according to Forescout’s report. “The impact of this effect depends on that grid’s emergency generation capacity and how fast that can be activated.”
“By exploiting these weaknesses, cybercriminals could manipulate power generation at scale and trigger coordinated load-changing attacks to destabilize the grid — potentially leading to emergency power measures, grid disconnections, or even blackouts,” according to the findings.
Following responsible disclosure, all vendors have patched the reported issues.
“The sheer number of bugs is one thing, but typically, when we do these types of research where we look at cross-vendor types of issues, we do tend to find many of them,” dos Santos tells Dark Reading. “What was more surprising is that, really, the types of vulnerabilities are kind of obvious things.”
Related:Disclosure Drama Clouds CrushFTP Vulnerability Exploitation
Specifically, many of the vulnerabilities can be found in top 10 lists of most-common critical vulnerabilities. For instance, more than 30 of the vulnerabilities, dos Santos explains, are insecure direct object references (IDORs). These are a type of access control vulnerability that occurs when an application uses user-supplied input or credentials to access something it shouldn’t be allowed to.
“What we were surprised by, really, is that lack of basic security measures,” La Spina says.
Shining Light on a Continuing Security Trend
As part of their research, the analysts also cataloged 93 previous vulnerabilities in solar power systems, finding that an average of 10+ new vulnerabilities have been disclosed per year in the past three years. Of those, 80% have a high or critical severity, and 32% have a CVSS score of 9.8 or 10, which generally means an attacker can take full control of an affected system, according to Forescout.
Clearly, more security by design is needed. “Whenever you are designing something, implementing something, thinking of something that will be put on your network or that you will use for your business, and so on — think of the security implications of that,” dos Santos says.
Related:Social Engineering Just Got Smarter
And though the solar power systems that carry these vulnerabilities are often thought of largely being deployed in people’s homes, commercial installations are on the rise. That means hospitals, government facilities, manufacturing plants, and more could be subject to emergencies and blackouts.
So, while vendors might take some time to tighten up their security practices, users meanwhile will need to find a way to mitigate the bugs to prevent their exploitation.
“It’s for businesses to worry about securing them as well,” dos Santos adds, “and making sure they are isolated in the network and that they are updated.”
Recommendations & Mitigations for Solar Installation Security Bugs
During their Black Hat Asia talk, the researchers provided several key recommendations:
Treat inverters in residential, commercial, and industrial installations as critical infrastructure:
Owners of commercial and industrial installations should:
Include security requirements in procurement.
Conduct a risk assessment when setting up devices.
Ensure network visibility into solar power systems.
Segment and monitor devices into their own subnetworks.
Device manufacturers should:
Implement secure software life-cycle practices.
Conduct regular penetration testing.
Adopt security-in-depth strategies using Web application firewalls.
Use third-party audits of communication links based on standards, such as: ETSI EN 303 645, Radio Equipment Directive (RED) and Cyber Resilience Act (CRA).
Tara Seals contributed to this report.