nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqc29fd5wcfk76um3c2a62k943zkr3r3ap723c5agute074x3v5t8qu9qzwa (nprofile…qzwa) Really? Inverters? What cybersecurity risks exist for inverters?
>The rationale: China-made inverters are deemed a cybersecurity liability, since manufacturers might be able to remotely manipulate them or even switch them off, destabilising energy grids and potentially causing blackouts.
>
>But the Commission's push to phase out so-called high-risk inverters has alarmed EU officials involved in development projects, as it remains uncertain whether European producers can meet demand.
Uh... how?
/me digs into the references
>The report [by cybersecurity firm Secura] follows a recent probe by investigative journalism platform Follow the Money that shows that a hacker could have gained control of millions of Dutch smart solar panel systems using a backdoor into their online system.
>
>https://www.euronews.com/next/2024/08/21/europes-leading-solar-power-grid-is-vulnerable-to-hackers-this-is-what-a-cyberattack-could
/me looks for the report
>This scenario is a combination of situations which have previously occurred. Vulnerabilities in interfaces of solar panel installations that were connected to the internet were exploited by the Mirai botnet and were then used for financial gain (Brumfield, 2024). In another example, a manufacturer remotely provided 800,000 micro-inverters with a new update on the same day in order to resolve certain problems (Fairley, 2015). A previous investigation by the Dutch Authority for Digital Infrastructure (RDI) (RDI, 2023) also demonstrated that if a malicious actor is able to access an inverter, they are often able to hijack it. The recent attack by anti-Israel hacktivists on PLC systems (Counter threat unit research team, 2023) is another recent example of opportunistic hacktivism, which could also impact the Netherlands even if the Netherlands were not the direct target.
>
>https://www.energy-innovation.nl/documents/1299/2024-Secura_Report-Cybersecurity_threats_and_measures_for_the_solar_power_sector.pdf
Well damn. So those things *do* have network connections. Why? Apart from the obvious "don't connect these devices to a network" approach, the report actually makes a case for requiring the firmware to be open source, which is nice I guess:
>Countermeasures would therefore need to be taken to counteract this – for example, a technically enforced four-eyes principle when issuing new firmware, not simultaneously updating all equipment but using a phased approach, or even making firmware open source so that independent parties can also investigate and contribute to it.
Preston Maness ☭
npub1hp…ttega
2026-06-25 21:53:28 UTC
in reply to nevent1q…5xc0
Author Public Key
npub1hpxxyhukn0aayhgapszgajypcvyl3ttlykl65nn476h0re25ykjsdttegaSeen on
wss://relay.ditto.pubPublished at
2026-06-25 21:53:28 UTCEvent JSON
{
"id": "3c3f2f3c53ac1a6eecddd71d2f49e1a9238895a88bc385a60c9f5892187a5813",
"pubkey": "b84c625f969bfbd25d1d0c048ec881c309f8ad7f25bfaa4e75f6aef1e55425a5",
"created_at": 1782424408,
"kind": 1,
"tags": [
[
"p",
"c28a96d1d84dbdae6e385774ab16b1158711c7a1f2a38a751c5e5fea9a2ca2ce",
"wss://relay.ditto.pub"
],
[
"p",
"b1dcb61f2cdc8f5c8d92226a074c2a23bd2d5728fb4d4f277142fe9119f0392d",
"wss://relay.ditto.pub"
],
[
"e",
"c24e82708f337aec4f735010424f256a844082b572e799788645cd7d22d32cf9",
"wss://relay.ditto.pub",
"reply"
],
[
"proxy",
"https://tenforward.social/users/aspensmonster/statuses/116812966039996516",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqc29fd5wcfk76um3c2a62k943zkr3r3ap723c5agute074x3v5t8qu9qzwa Really? Inverters? What cybersecurity risks exist for inverters?\n\n\u003eThe rationale: China-made inverters are deemed a cybersecurity liability, since manufacturers might be able to remotely manipulate them or even switch them off, destabilising energy grids and potentially causing blackouts.\n\u003e\n\u003eBut the Commission's push to phase out so-called high-risk inverters has alarmed EU officials involved in development projects, as it remains uncertain whether European producers can meet demand.\n\nUh... how?\n\n/me digs into the references\n\n\u003eThe report [by cybersecurity firm Secura] follows a recent probe by investigative journalism platform Follow the Money that shows that a hacker could have gained control of millions of Dutch smart solar panel systems using a backdoor into their online system. \n\u003e\n\u003ehttps://www.euronews.com/next/2024/08/21/europes-leading-solar-power-grid-is-vulnerable-to-hackers-this-is-what-a-cyberattack-could\n\n/me looks for the report\n\n\u003eThis scenario is a combination of situations which have previously occurred. Vulnerabilities in interfaces of solar panel installations that were connected to the internet were exploited by the Mirai botnet and were then used for financial gain (Brumfield, 2024). In another example, a manufacturer remotely provided 800,000 micro-inverters with a new update on the same day in order to resolve certain problems (Fairley, 2015). A previous investigation by the Dutch Authority for Digital Infrastructure (RDI) (RDI, 2023) also demonstrated that if a malicious actor is able to access an inverter, they are often able to hijack it. The recent attack by anti-Israel hacktivists on PLC systems (Counter threat unit research team, 2023) is another recent example of opportunistic hacktivism, which could also impact the Netherlands even if the Netherlands were not the direct target.\n\u003e\n\u003ehttps://www.energy-innovation.nl/documents/1299/2024-Secura_Report-Cybersecurity_threats_and_measures_for_the_solar_power_sector.pdf\n\nWell damn. So those things *do* have network connections. Why? Apart from the obvious \"don't connect these devices to a network\" approach, the report actually makes a case for requiring the firmware to be open source, which is nice I guess:\n\n\u003eCountermeasures would therefore need to be taken to counteract this – for example, a technically enforced four-eyes principle when issuing new firmware, not simultaneously updating all equipment but using a phased approach, or even making firmware open source so that independent parties can also investigate and contribute to it.",
"sig": "f37b2300e58518ef357df0f31ffd1e52d7b2f11ceef8248a4d1d66cfd7e90530a8479c087e86e9cf5dd3bf9fd165b8498977c37f0f8531a6a46da8a9bd07e47f"
}