37 pointsby xbmcuser5 hours ago5 comments
  • dlcarrier3 hours ago
    If they could prohibit internet communications and allow LAN communications, that would be great.

    Also, it should apply regardless of where they are manufactured. It's far more likely for an attack to happen through a compromised centralized server, or a worm compromising embedded servers en masse, than it is for an authority to directly petition an attack.

    Also, my inverter wasn't manufactured in China, but the Wi-Fi module was made by Shanghai MXCHIP Information Technology Co., so it's no less vulnerable.

  • tdeck3 hours ago
    Can someone more familiar with the technology explain how necessary it is for the inverter to be internet connected? This seems like the kind of cloud dependency that people on HN would usually be opposed to.
    • leonidasrup3 hours ago
      A small solar inverter doesn't need to be internet connected, but solar inverter app monitoring lets you track energy production, view real-time power flows, and check device status using a smartphone or tablet. So automaticaly you could get all the IoT security issues.

      https://solar-assistant.io/

      https://apps.apple.com/us/app/solarman-smart/id1469487897

      If an attacker could control a significant portion of solar inverters in a solar dominated grid, he could cause an blackout, under right conditions.

      More in presentations at CCC:

      "How to cause blackout"

      https://media.ccc.de/v/32c3-7323-wie_man_einen_blackout_veru...

      "BlinkenCity: Radio-Controlling Street Lamps and Power Plants"

      https://media.ccc.de/v/38c3-blinkencity-radio-controlling-st...

      Large solar invertors at large solar plants muss be under remote controling of grid operators, to allow solar curtailment when the solar production exceeds electric demand or grid transmission could be overloaded. This is not specific to solar power plants, other kinds of power plants are also under control of grid operators.

      With increased deployment of residential solar its possible that this controlling will be extented also to residential solar.

      • lazide2 hours ago
        With sufficiently badly designed systems (lack of sufficient manual interlocks), it should also be possible to cause co-ordinated widespread fires and property damage or the like, with resulting loss of life.

        There was a good grid generator demonstration years ago (aurora generator cyber attack), and most cheap inverters are likely even dumber than what was demonstrated there.

        Likely? Probably not with current geopolitics.

        Possible? Hard to say, but certainly unlikely to be completely impossible.

        Security being the S in IoT and all, and most of these inverter stacks are pretty typical of IoT.

      • chrisjjan hour ago
        > A small solar inverter doesn't need to be internet connected, but solar inverter app monitoring lets you track energy production, view real-time power flows, and check device status using a smartphone or tablet

        ... over USB or Bluetooth. Internet is solely for convenience.

    • arlattimore3 hours ago
      Smart inverters allow energy companies to reduce the solar power sent to the grid to improve grid stability, avoid overload conditions etc.
    • rasz14 minutes ago
      Its sold to consumers as stats & diagnostics. Companies do this to sell your data and in hopes of roping you into recurring revenue schemes.
    • aaron6952 hours ago
      [dead]
  • chrisjjan hour ago
    > prove their code cannot be manipulated remotely

    That's not technically possible, surely.

  • jauntywundrkind4 hours ago
    Absolute cowardice & wanton destruction of the world, this. This is just a political ploy, on no merit, and it's the same anything-and-everything as the administration pulled to prevent cheap, effective, capable wind power from happening. https://apnews.com/article/trump-offshore-wind-national-secu... https://www.canarymedia.com/articles/wind/states-lawsuit-tru...

    It's nonsense and there's no pretense, no data otherwise. The party of drill baby drill isn't about better power, about using mineral rights: it's about crony-istic state control of industry, about vested interests, about bribery corruption and grift for insiders. (That and/or they are actively trying to destroy the country wholesale, are barbarians within seeking only to destroy.)

    I do think there is one step I'd like to see the world take in reply, that would make this be much funnier: "we don't ship the software, you have to run that yourself". Start an open source Zephyr IoT project for inverters, and just don't distribute the software. Make people just buy the hardware. I for one welcome the world where the two come separate. I think it would be a remarkable upgrade for humanity to decouple the two, and it would be bitterly hilarious if these batshit loons somehow end up accidentally creating the better world. I can't think of what other reply would have anywhere near the force of effect of making absolute mock, and it would radically improve things. This should happen.

  • klooney3 hours ago
    We've finally imported European style technology regulation
    • Kim_Bruning3 hours ago
      Eh, European tech regulation at very least has some sane steelman published and documented, even if we personally disagree with that reasoning.