Comment by leonidasrup | Hacker News Reader

Comment by leonidasrup | Hacker News Reader

Parent Full thread

A small solar inverter doesn't need to be internet connected, but solar inverter app monitoring lets you track energy production, view real-time power flows, and check device status using a smartphone or tablet. So automaticaly you could get all the IoT security issues.

https://solar-assistant.io/

https://apps.apple.com/us/app/solarman-smart/id1469487897

If an attacker could control a significant portion of solar inverters in a solar dominated grid, he could cause an blackout, under right conditions.

More in presentations at CCC:

"How to cause blackout"

https://media.ccc.de/v/32c3-7323-wie_man_einen_blackout_veru...

"BlinkenCity: Radio-Controlling Street Lamps and Power Plants"

https://media.ccc.de/v/38c3-blinkencity-radio-controlling-st...

Large solar invertors at large solar plants muss be under remote controling of grid operators, to allow solar curtailment when the solar production exceeds electric demand or grid transmission could be overloaded. This is not specific to solar power plants, other kinds of power plants are also under control of grid operators.

With increased deployment of residential solar its possible that this controlling will be extented also to residential solar.

With sufficiently badly designed systems (lack of sufficient manual interlocks), it should also be possible to cause co-ordinated widespread fires and property damage or the like, with resulting loss of life.

There was a good grid generator demonstration years ago (aurora generator cyber attack), and most cheap inverters are likely even dumber than what was demonstrated there.

Likely? Probably not with current geopolitics.

Possible? Hard to say, but certainly unlikely to be completely impossible.

Security being the S in IoT and all, and most of these inverter stacks are pretty typical of IoT.

None of this requires internet connection.

How do you expect your typical mobile app to work through NAT, etc. without an internet connection? For your typical ‘dumb’ home user, anyway?

It should not. There is exactly zero reason for all this data to leave the premises.

> For your typical ‘dumb’ home user

Well, yeah. That's the problem. There is no explanation to the dumb user why this stat is only available while connected to home network.

My solar production data is fed to my ISO so I can sell clean energy vouchers. My solar installer just called me the other day asking if I had a tree shading a panel, because production on that panel was low. There are plenty of reasons to have internet connected solar equipment.

Outbound connection to your provider with stats? Good.

Random connection to any IP especially on China territory? Absolutely not.

But that IP is your provider, and the data being sent is stats.

How do you know that, or can predict it?

Using IPv6! But also we should ban IPv6 because of security! Letting devices connect to each other without bouncing through a central server is a security risk! (This is a popular opinion on HN)

Regardless of broadband existing or not, there was never supposed to be an abscence of dial-up.

> A small solar inverter doesn't need to be internet connected, but solar inverter app monitoring lets you track energy production, view real-time power flows, and check device status using a smartphone or tablet

... over USB or Bluetooth. Internet is solely for convenience.

So is 90% of everything we use the internet for.

It’s also possible to pay my bills via check sent via USPS (for now), but I bet at least 80% of your typical utility customers use the online portal.

So is 90% of everything attackers use the internet for.

And re loss from an attack, your bill payment is not comparable to a solar inverter.

Yeah, it’s easier to drain my bank account than explode a random inverter (probably).

And one of them gets them paid.

Reply on news.ycombinator.com