The Solar Panel cyber threat: Dutch hacker gets into 4 million panels in 150 countries

Black Start, dystopian, blackout, future city.

By Jo Nova

What if a few gigawatts of solar power disappeared without a warning or a cloud in the sky?

Imagine a hostile force had control of half your national power generation at lunchtime and could just flip a switch to bring you to your knees? Or how about a crime syndicate wanting a ransom paid by 5pm?

Steve Milloy:   Communist China is setting us up for solar panel-based disaster:

“Solar panels that make the electricity suitable for the power grid and which are usually connected to the web, can be “easily hacked, remotely disabled or used for DDoS [Distributed Denial of Service] attacks.” DDoS is one of the most common types of attacks, which basically try to overwhelm a system… Solar panels were outlined as a vulnerability in several scenarios, also due to the dominance of a single country, China, in the supply chain.”

It’s only a week without electricity…

Daniel Croft, CyberDaily (October 2023)

Cyber Security CRC chief executive Rachael Falk said… that an attack on the solar grid could spark a “black start” event, which could result in the entire power grid going down. … “This could bring down an entire power grid, and it could take a week to recover,” she said.

 [Falk said] the threat presented by foreign-manufactured solar inverters is a recent one, as only recent models are internet-connected due to increased interest in smart home technology.

“Traditionally, cyber risk with solar inverters was low because they were not connected to the internet,” said Falk. “However, as the popularity of smart home energy systems has boomed, this has changed, with most solar inverters now web connected.”

The EU and the US have both had a wake up call in the last few weeks

A Dutch white hat hacker got into one system a couple of weeks ago with 4 million panels in 150 countries, exposing a major flaw. That software glitch in American Enphase inverters was fixed quickly once they were aware of it, but how many other doors remain open?

Only two weeks ago another group called Bitdefender claimed that 20% of the worlds solar panels and 195 gigawatts of capacity, had been at risk of cybercrime for months. Rooftop solar management software by Solarman and Deye (both Chinese solar manufacturers) is used by 2 million “solar plants” and 10 million devices. Hackers could have been able to take control of the inverters (which could “change the way the inverters interact with the grid”. They could also steal quite a lot of data, including real time GPS locations and production. What if they could target individuals?

Apparently those issues were reported in May but are now patched too. (I guess no one would be mentioning any issues which are not patched, would they?) SecurityBrief has the gory details.

Whatever threats exist in the Netherlands, Australia is a sitting duck

Even at lunchtime in winter, sometimes half of the Australian national grid power comes from solar panels. That’s 12 gigawatts of solar power out of 25 gigawatts in toto. (And it’s similar in WA). Here in the renewable crash test dummy, fully 58% of the solar inverters that are connected in to the internet come from companies headquartered in China.  (And the rest are headquartered elsewhere, but who knows, maybe they’re made in China too, where 70% of the worlds solar inverters come from?)

AEMO, Solar Power on the NEM, winter. SA, QLD, Tas, SA, NSW.

Solar power is a large part of the Australian NEM, even in winter. The black line is total generation. The NEM includes NSW, QLD, Vic, Tas, SA. (Source: Anero.id)

So Cyber-expert Falk gave us that warning of a black start disaster in October last year, and how far have we got? By January we were redoing our cybersecurity plans, but somehow still forgetting about smart home devices like solar inverters and control of our national critical infrastructure.  But, not to worry, by February we had the news that we were hiring Standards Australia, to develop “a roadmap”. (That’ll stop them!) Meanwhile we’re still going gangbusters on solar installations.

We can always rely on the government to get nothing done, help the enemy…

White hat hacker shines spotlight on vulnerability of solar panels installed in Europe

By Nikolaus J. Kurmayer | Euractiv

An ethical hack of solar panels in the Netherlands has revealed their vulnerability to cyber attacks, prompting industry calls for more rigorous safety assessments.

A Dutch white hat hacker could have gained control of millions of smart solar panel systems, reports investigative outlet FollowTheMoney, using a backdoor.

The findings confirm a 2023 report by a Dutch agency which found that converters, essential parts of solar panels that make the electricity suitable for the power grid and which are usually connected to the web, can be “easily hacked”…

report by the EU’s own cybersecurity agency from 24 July found that the union is ill-prepared for a concerted attack on its energy infrastructure, whether by a foreign state or by malicious insiders.

How much will that cost?

We need to test and possibly replace inverters and fix the software:

A report by the Perth’s Cyber Security Cooperative Research Centre “recommends assessments be conducted on all solar inverters sold in Australia, with identified vulnerabilities requiring remediation. The report also says cyber security ratings should be introduced for solar inverters and IoT devices more generally, as well as recommending solar inverters with identified serious cyber vulnerabilities be banned from retail sale in Australia.

Thanks to Marc Morano of Climate Depot.

10 out of 10 based on 98 ratings

70 comments to The Solar Panel cyber threat: Dutch hacker gets into 4 million panels in 150 countries

  • #

    “as well as recommending solar inverters with identified serious cyber vulnerabilities be banned from retail sale in Australia.”
    Another trade war with China?

    But if they won’t supply the slaver panels, how will Australia – let alone Miliband’s W&S Britain – keep the light [singular] on?

    Auto – sleeping soundly tonight in the certain knowledge that Miliband has this all in hand – and, indeed, may abolish ‘Night’, by law, within the next year.

    360

  • #
    David Bain

    The Chinese constructed and part owned wind farm near me can be operated from China according to an electrician I spoke to during construction.

    400

    • #
      OldOzzie

      Taking the Wind – Out of Climate Change

      The proponents of Climate Change insist that we are facing an imminent existentialthreat to our very existence.

      To prevent this catastrophe they assert that we must make immediate, impactful changes — particularly regarding our energy policies.

      The primary solution advocated by the major Climate Change advocates (e.g., the IPCC and the scientists comprising the so-called 97% consensus) is industrial wind energy. The fundamental question is: if we accept the Climate Change contention and thenspend Trillions of dollars to assiduously implement their wind energy solution, will the existential threat be extinguished in the short time-table they say we have?

      The answer is an unequivocal NO, for at least the following six (6) reasons:

      1 – There is no scientific proof that wind energy saves any consequential CO2.

      2 – There is good evidence that wind energy can produce more CO2 than gas.

      3 – There are quality studies that conclude that wind turbines add to global warming.

      4 – Several studies conclude that turbines affect local meteorological conditions

      5 – Multiple studies show that turbine performance drops steadily with age.

      6 – Several studies demonstrate the diminishing returns of adding more Turbines.

      The bottom line is that there is no scientific proof that wind energy saves anyconsequential amount of CO2 — and plenty of evidence that wind energy is not a goodsolution to a claimed catastrophic threat (that requires a large, short-term change). What does it say about the “experts” who propose an illegitimate solution? It either means that: a) they are not real experts, or b) they are pushing an undeclared agenda.

      All this should be no surprise as (regarding the global warming issue) we have left the security of genuine Science, and are now sinking into the quagmire of political science.

      190

      • #
        Gazzaton

        OldOzzie- agreed but I would’ve included the Climate Alarmists advocacy and insistence for hundreds of hectares of solar panels, plus use of costly, highly combustible, energy intensive (to make & charge), low energy output lithium batteries all of which requires ten / hundred fold increase in mining for rare earth and more common minerals to enable the excavation, processing, transportation, manufacture, installation etc ,etc of these marvellous subsidy harvesting items that will do nothing to improve the atmosphere and will likely do much harm to the planet in their creation, use and all to soon disposal.

        70

  • #
    Penguinite

    Besides China we now have Russia threatening to create havoc on the Alliance supporting Ukraine. Our power grid is particularly vulnerable but the Banking system is even more so!

    180

  • #
    Kalm Keith

    In recent times the reports of “hacking” and demanding a ransom payment have been with us.

    Our work and effort are saved in our bank accounts but even there, the threat is real that we could lose it.

    Recent state government changes to property title deeds are worrying. Paper is gone, your ownership is now digitised and in the ether.

    But I’m sure that no hacker could get in and establish ownership of your home while you’re sleeping.

    260

    • #

      In the UK, the Land Registry has a service – free, so far as I am aware – that informs the holder of title if there is any attempt to amend it.

      https://propertyalert.landregistry.gov.uk

      I don’t know if Ivan T.Hacker can get round that. Or Wefbert $ Hacker …
      Nor if an essentially similar service operates in other countries.

      Auto

      20

  • #
    Just+Thinkin'

    It is just getting worser and worser for Black-Out Bowen AND the Australian people.

    Anything connected to the internet must be hackable.

    Digital Currency anyone?

    300

  • #
    Neville

    This toxic W & S lunacy will cost us our national security and only help the axis of evil during any hostile attempts this year or next year or for decades to come.
    Labor, the Greens and Teals coluldn’t care less about destroying our environments for nothing at a cost of trillions of $ and cyber security should not be left to them either.
    Albo and BO Bowen etc couldn’t run a chook raffle and have recently allowed thousands of terrorist supporters into Australia.
    Now why haven’t the US or the EU or other Arab countries also allowed these Gaza terrorist supporters into their countries as well?

    310

  • #
    TdeF

    Rooftop solar (Yellow). Other solar (Red)?

    70

  • #
    Forrest Gardener

    The warranty on our SunGrow system requires it to be continuously connected to the manufacturer’s internet server apparently for data reporting purposes. And software updates are regularly remotely applied.

    At a guess I can disable remote control simply by changing my WIFI password but I doubt that I could undo a malicious attack..
     
    Just a data point.

    160

  • #
    Tonyb

    Miliband would have thought of this months ago. We are so lucky to have his thoughtful inspiring presence in our govt

    80

  • #
    david

    My wife has insisted for years to keep up to date paper copies of EVERYTHING including all banking, shares, titles, etc plus regular computer backups. “Better in my filing cabinets than the so called cloud” she says!
    Perhaps having all this “proof” would be useless anyway?

    210

    • #
      Eng_Ian

      Correct, a paper backup is worthless when arguing with a bank.

      What’s your come back to…. “The computer says NO”?

      120

  • #
    David Maddison

    All Chinese-made infrastructure is subject to being shut down on demand by the Chicomms.

    That’s why President Trump banned the import of giant utility transformers and similar grid-scale equipment from China, only to have the ban undone by the Biden regime.

    https://www.akingump.com/en/insights/alerts/president-trump-establishes-framework-to-ban-the-use-of-foreign-sourced-equipment-in-the-us-electric-grid

    https://www.powertransformernews.com/2021/04/23/us-department-of-energy-reverses-trump-ban-on-chinese-electrical-equipment/

    https://www.heritage.org/cybersecurity/commentary/could-china-hack-our-electric-grid-joe-biden-just-made-it-easier

    220

  • #
    David Maddison

    Also, consider so-called “smart meters” that measure your electricity consumption.

    These are potentially hackable and if so, can be used to shut down electricity consumers.

    In Australia, I believe a majority of smart electricity meters are in Victoriastan where they are compulsory, where most politicians are loyal to the Chicomms and some no doubt receive handsome payments from them.

    230

    • #
      Penguinite

      David, in 2030, Smart Meters will be mandatory in all States and territories. We intend to hang out to the bitter end. Another six years may well see us using candles again!

      180

      • #

        In Western Australia at the moment you can get a smart meter installed but conscientiously object to the network chip (though probably not if you have solar power installed).

        Presumably the meter man can still come around and download all that data, but at least people in Shanghai won’t get it until they hack (or buy) the local company.

        50

    • #
      OldOzzie

      David,

      I have had NSW Smart Meter since early 90s as heavy user Electricty, was upgraded to newer model about 6 years ago – I am happy with Smart Meter as TOD user and billing, realise can be used against me, but have had no problems in 30+ years of use.

      71

      • #
        RicDre

        I’m glad that the smart meter has worked out for you, but don’t forget that “Past Performance is Not Indicative of Future Results”.

        150

      • #
        RicDre

        I read that Smart Gas Meters worked out well for the Chinese; when the old meters were replaced with the new mandated smart meters, everyone with the new meters were suddenly using more gas than they had in the past, providing a windfall for the gas companies. Just a coincidence I’m sure.

        140

  • #
    another ian

    FWIW – Trump shooting

    “Local Cop, Not Secret Service, Shot Trump Rally Shooter First”

    https://www.zerohedge.com/political/local-cop-not-secret-service-shot-trump-rally-shooter-first

    [This is off topic. Sorry. Please take it to the unthreaded. – Jo]

    110

    • #
      TdeF

      This is extremely significant, as the FBI sniper only shot the gunman after he was not able to shoot again with a destroyed rifle, thanks to the local Butler county SWAT team. After all people in the crowd could see the sniper plainly and recorded him on their phones. Why couldn’t the FBI?

      Did the FBI sniper watch the whole thing? Given the vision they had why did they shoot the shooter as their first and only action after he was disabled? And the FBI cleaned up the whole scene ignoring the local police completely and gave permission for cremation before anyone else had a chance to inspect anything.

      This looks exactly like a FBI orchestrated hit job using an enthusiastic third party with plausible deniability. And I would expect his phone has disappeared, his laptop and all his online records. And it could be labelled a Russian action if necessary, like the other missing evidence against Hunter Biden and Hillary Clinton.

      170

  • #
    David Maddison

    Utilities and others should only buy critical infrastructure if the manufacturer is willing to allow source code to be inspected by genuine experts (real ones, not people who “identify” as such).

    120

  • #
    Ronin

    What about Chinese windmills, one of them is worth a lot of panels.

    70

  • #
    David Maddison

    Presumably wind subsidy harvesting plantations could be made to self-destruct by removing overspeed restrictions in software, assuming there are no hardware limits (which there may or may not be).

    The loss of such plantations would not be missed in terms of the grid, but the subsidy harvesting owners would demand taxpayer compensation for their loss.

    150

  • #
    Ken

    Having a home solar system vulnerable to hacking/controlling/shutting down?

    Another good reason why I will never install solar in my home.

    I already had many reasons: cost/lack of payback, fire risk, damage to roof integrity, risk of supplier going bankrupt – therefore no warranty, etc, etc.

    vulnerability to hacking has just added another reason.

    120

  • #
    John Connor II

    Recall that the first cyberattack on power infrastructure was almost a decade ago in 2015 when 30 power substations were hacked in Ukraine, cutting power to 10’s of thousands.

    Hackers will target large installations, commercial and infrastructure, rather than homes for notoriety purposes, so homes are very low risk.
    Nonetheless home systems are riddled with weaknesses and systems have been compromised in as little as 15 seconds, via WiFi exploits.

    Bitdefender ran an article recently.
    60 Hurts per Second – How We Got Access to Enough Solar Power to Run the United States

    “a solar grid responsible for 195 gigawatts, or 20 percent of the world’s solar power output, is vulnerable. That’s enough to power the entire United States – and it’s just waiting to be hijacked.”

    https://www.bitdefender.com/blog/labs/60-hurts-per-second-how-we-got-access-to-enough-solar-power-to-run-the-united-states/

    With the advent of the IoT, things get worse though, as a breach of the solar system may grant access to everything else on the network, or indeed the other way around.
    We just hacked your fridge. Now we have access to your solar system too.

    With access to charge controllers they could also overcharge and damage batteries, or stop them from being charged at all.

    https://hackernoon.com/why-cybersecurity-for-solar-is-crucial-and-difficult

    There’s nothing like a good old-fashioned fire for heat and cooking…

    50

  • #
    TdeF

    What is clear from the graph is that no matter how much solar we have, there is only lunchtime solar for 1/4 of a day. Which is at most a 25% saving in CO2. At what cost?

    And how much of that enormous cost is actually long term investment and how much will turn out to be total waste in only a decade from today? It is not ecologically beneficial to destroy so much and waste so much with such short term solutions.

    Wind and solar on a National scale and the associated 30,000km of connections are a total waste of public money. Straw houses.

    180

    • #
      TdeF

      Correction 30.0%. So if we doubled solar, there is no point doing any more. Home solar is 2xcommercial solar. We do not even need wind 9:5. Provided there are no clouds.

      But is there any saving in all this? No. Everything wears out quickly, panels or windmills, used or unused.

      And we would have saved more CO2 outright if we had invested in HELE plants instead of short term windmills and solar panels. And we will never stop replacing solar panels and windmills, so it’s not investment but profligate endless spending.

      100

  • #
    Gary

    More scaremongering/paranoia directed at our largest trading partner? Someone like Kissinger once said it’s bad enough to be an enemy of America, but far worse to be an ally.

    19

    • #

      What paranoia? Our largest trading partner researched bioweapons, then lied about the virus, then when we asked for an investigation, it launched savage trade attacks on barley, beef, wine, lobsters, coal and anything else it could conveniently hurt.

      Who needs to scaremonger? Are the CCP still developing bioweapons — Why wouldn’t they be?

      180

      • #
        Graham

        Got it in one.
        Hacking the information / energy grid is and has been used as an intimidation weapon of choice.
        A friendly warning of things to come.
        Easier than blowing up pipelines and less chance of being caught.
        Your country shut down and sent into the dark ages at a flick of a switch.

        Note how easy Australia has been hacked in the recent past and look how pathetic and difficult to use the Govt website was to manage air travel vaccination permits was in 2022.
        People were blocked getting on planes to Australia because they could not get it to work and in the end, it had to be dropped.
        Embarrassing and all too common.
        The best and brightest work in the private sector.

        10

  • #
    Gee Aye

    Gee, it would be hard to prevent this in the future

    04

  • #
    Old Goat

    Almost all computer software has backdoors built in . This enables their techs to fix glitches . With microsoft releasing updates and new versions without proper debugging this is necessary . Over time all software will get altered by use .If they couldn’t access the software code the issues would become permanent and even turning the device on and then on wouldn’t help either….

    50

    • #
      TdeF

      You can never fully debug software or in fact any mechanical device. There is no telling what people decide to do and the sequences in which they choose to do it. You can only certify the software is fit for purpose, not that people cannot break it. And that happens almost immediately. But direct access to people’s computers over the internet should have to be enabled only with permission. That is where the US has banned such computers as LENOVO as having built in back doors. And of course those computers were used by Hillary Clinton and Huma Abadeen . Hillary was Secretary of State at the time. But the US government sees nothing when it comes to Hillary.

      100

  • #
    Neville

    Again here’s energy used per person around the world and USA and Canada are much higher and Aussies are still below both countries.
    Germany is still higher than the EU average of 27 countries.
    But China has caught up to the EU and is now about 4.7 kwh per person higher than the UK.
    Africa and India are still way below the World kwh per person.

    20

  • #
    UK-Weather Lass

    When we have nuclear and natural gas options, the cleanest power there is and much, much, much cleaner and environmentally friendly than solar or wind, you wonder why we continue along the path clearly marked ‘Dangerous and Insecure’ because our enemies (both without and within) have been bribing figureheads and politicians to do so.

    Our Victorian ancestors had solar and wind power as options but went straight for the big player – coal fired generators. These engineers had brains and no computers but knew what they could do and were doing. Those societies were streets ahead of the contemporary garbage we have had in the past several decades, including those who gave the Chinese all our technological secrets, protected patents etc. in exchange for preferential deals. It is what happens when society becomes too corrupted to be bothered to cover the likely downsides anymore.

    120

    • #
      Gerry, England

      A TV programme on engineering featured the 3 beautiful steam powered pumping stations that drained the Amsterdam basin and also went to look at one of the old windmills that used to pump out the water. It was stated that each pumping station replaced 240 windmills. The pumping stations have been replaced by electric pumps but thankfully at least one is preserved in working order. Assuming this period of rule by retards passes, people in the future will wonder why mankind had this period of going backwards.

      60

  • #
    Gerry, England

    “This could bring down an entire power grid, and it could take a week to recover,” she said.

    It could take several weeks as nobody – yet – has found out how long it actually takes when nothing works. Back up for mobile phones will have been exhausted, no tv, no radio, no internet – how do you communicate?

    Wasn’t life easier when there were just a few generating plants to worry about and not thousands and thousands of houses when protecting your infrastructure. And the point about ‘smart’ meters is important as just shutting down load on the grid will risk a blackout just as much as a load surge as the grids are very finely balanced.

    40

    • #

      When SA did a black start some suburbs were back up in hours which was excellent. But it was two whole weeks before Olympic Dam, the second largest uranium producing mine in the world, was able to reopen.

      40

  • #
    Geoff Sherrington

    I have resisted a smart meter by telling installers to keep hands off the old one. It works. I am in Melbourne.
    I am fairly certain that there is a whole new story of corruption in the rush job to fit Victoria up with smart metre. Like –
    . who was the chosen provider?
    . how was the provider chosen, by open tender processes?
    . how many $ did the provider pay for each meter?
    . how many $ was the householder charged for each meter?
    . were the contract details made public, if not why not?
    . what is the replacement cost for a failed smart meter?
    . does the meter accept or provide information other than that collected by the old masters they replaced?
    . can the smart meter be used to curtail supply to a user?
    . if so, under what conditions can supply be stopped?
    . who can order that a supply be stopped?
    . how can stoppage be challenged as wrong?
    . what is the measurement error of smart meters (think of measurement errors of weather related temperatures)?
    . can any person in authority be sued for falsely stating that smart meters in Victoria were compulsory?
    Geoff S

    60

  • #
    Graham

    Hi,

    To all you soon to be out of work IT-Geeks about to be made redundant by the all-new omnipotent A.I. you may have noticed a new exciting and very profitable career in computing as appeared. 💪💰💰💰💰

    Yes, HACKING the all-green renewable Australian energy grid.
    😱⚡⚡⚡
    Yes, green is the colour of easy money. 🎄🎄🎄💰💰💰

    And you all know the IT experts employed by Governments are the losers who could not get a real job in the private sector, so it is an easy profitable walk in the park all the way to the bank. 💪🤣🤣💰💰💰

    Cheers,

    20

  • #
    iwick

    Very few people realise that all the various infrastructures – ‘grids’ and ‘networks’ have been directly and indirectly interconnected/meshed together – this includes water/sewage, oil and gas, electrical power, communications, transportation, banking and finance, food supply, emergency services, government services, etc. The separation into discreate infrastructure domains tends to obscure the real and critical interdependencies that sustain the operation of each one. For example, telecommunications infrastructure requires power that is delivered by the power infrastructure. If power delivery is disrupted by disturbances in the power grid, telecommunication substations will only run for a while on reserve battery power.

    00

  • #

    You can guess I am distainful of jingo like ‘roadmap’.

    A standard should help educate designers and utilities but ‘Standards Aren’t’ is my maxim from experience developing and using industry standards.
    Especially when new, people are trying to learn them, may fail if they don’t have background in the subject.
    Smart people caring to do great work is what’s needed.

    10

  • #

    ‘another Ian’s claim about snipers at Donald Trump’s fatal rally is an example of misleading statements common in the climate bunfight.

    The Secret Service engaged local and state police to help, mostly outside of the property the rally was on.

    Collectively they failed to cover the roof of a building across the street even after having been pointed to it, perhaps assuming no one would climb onto the low roof (snipers were inside the building looking out at the event).

    And various snipers failed to look in all directions continuously.

    As with climate catastrophists and even some skeptics, life requires facts, thinking through them including to filter for accuracy and credibility, and integrate.

    00

  • #

    Correctly stated would be:

    ‘another Ian’s claim about snipers at Donald Trump’s fatal rally is an example of misleading statements made from lack of knowledge and/or assumptions, akin to those common in the climate bunfight.

    00