Security experts see significant security gaps in the energy infrastructure. A recently reported case shows how real the risk is.
The Smart Energy Expert Group (SEEG) warns that attackers can use inverters to trigger widespread power outages.
Software developer Marlon Starkloff found a security gap in Sungrow's control portal and, according to his own statement, could have switched off 17 gigawatts of power in Europe.
Sungrow has confirmed the security vulnerability, but denies that it could take systems out of operation.
The SEEG calls for significant improvements to European legislation and recommends that the EU Commission limit the use of risky suppliers.
Brussels, Düsseldorf. With the rapidly increasing importance of solar energy, a previously underestimated danger is also growing. Given the tense security situation, experts are now warning of the risk of an attack on green energy systems and criticizing serious security gaps.
“If attackers exploit these systems, this could lead to imbalances, overloads in the power grid or voltage disturbances, which in the worst case could result in widespread power outages,” write the authors of the Smart Energy Expert Group (SEEG) in a new report for the European Commission. The more solar systems there are on the power grid, the greater the danger. A case from the solar industry that only recently became known shows that the danger is by no means just theoretical.
Every solar system can be controlled remotely with the push of a button, via the heart of every module: the inverter. It is the central control element of the solar system. It ensures that electricity can be fed into the network, controls the energy flow and can send updates to the devices via access to its own cloud.
For this purpose, inverters are automatically connected to the Internet. Technically, this allows them to even take the systems off the grid if necessary, for example if they are producing too much electricity. But this also makes the systems vulnerable.
There are now more than six million solar systems installed in Germany alone. Last year they produced almost 17 percent of the electricity consumed in this country. According to the Federal Association of the German Solar Industry (BSW), Germany currently has an output of 125 gigawatts.
The problem: “Even if each inverter only controls a small amount of power, together they are enough to disrupt the power grid,” write the SEEG authors. Using vulnerabilities in the control portals of inverter manufacturers, attackers could switch off gigawatts of power in one fell swoop and cause a widespread blackout.
“Cyber attacks on critical infrastructure in Europe are unfortunately no longer an abstract scenario, but a real threat to our energy security,” says SPD MEP Tiemo Wölken to the Handelsblatt.
However, the report does not only point to technical vulnerabilities. From the authors' point of view, the problem also has a geopolitical dimension: the market for inverters is divided among a handful of companies. In addition to European companies such as SMA Solar, Fronius and Kostal, these include Huawei, Growatt, Sungrow and Solis, the global market leaders from China.
According to industry insiders, manufacturers from the Far East already had 180 gigawatts (GW) of solar capacity in the European grid a year ago. Huawei alone could control 100 GW.
A few weeks ago, software developer Marlon Starkloff showed how easy it could theoretically be to take solar energy on the scale of several coal-fired power plants off the grid. The 23-year-old hacked into the control portal of the Chinese provider Sungrow via a security hole. “On that day in August, I could have switched off 17 gigawatts in Europe alone,” Starkloff told Handelsblatt. Sungrow bundles several gigawatts worldwide on its iSolar cloud.
When asked about the incident, Sungrow said: “According to current knowledge, the reported and now closed vulnerability was not suitable for putting systems out of operation or triggering a large-scale blackout.”
Critical operations, including remote configuration and shutdown of devices, required re-authentication with a password. Resetting a password also requires confirmation via email and cannot be completed without this.
Starkloff counters that he could have changed the email address without any queries or verification. “You can then reset the password as the code will be sent to the new email address.” He made the whole thing public last week on a blog from the IT security service provider Jakkaru.
Starkloff is managing director of the Kassel-based company. Sungrow responded very well and fixed the error within a day, he assures. But the fundamental problem remains: "All solar systems are connected in a cloud. Nobody would come up with the idea of bundling the controls for all coal and nuclear power plants on one platform."
The case is also explosive because it goes beyond a single programming error. It shows a structural problem in the solar industry: millions of systems are distributed decentrally, but their control is concentrated on a few digital platforms. What is technically considered a gain in efficiency can become a problem for the entire electricity system in the event of a crisis.
Especially in view of so-called “back doors” – i.e. hidden access to hardware or cloud platforms. In extreme cases, states could require manufacturers under their jurisdiction to provide or exploit such access in order to destabilize critical infrastructure in a hybrid conflict, warn the SEEG experts.
They are calling for significant improvements to European legislation. Among other things, they recommend that the EU Commission restrict the use of risky suppliers through the revised Cybersecurity Act (CSA) and the Industry Promotion Act (IAA).
A draft of the revised CSA is currently being negotiated between member states and in the EU Parliament. The aim is to exclude “untrustworthy” providers from the EU market. “There can no longer be a kill switch and no data on servers that are not subject to European jurisdiction,” says MEP Jens Geier (SPD).
The EU Commission wants to provide a mechanism that can be used to identify countries and companies at high risk. Individual member states would then have to put these on a banned list and exclude corresponding providers.
The IAA is also currently being negotiated in the EU Parliament and between the member states. The aim of the law is to protect the domestic industry, especially from competition from China, by linking the allocation of public money to “Made in EU” criteria.
