Solar cyber threats expand, but inverters still stay in the crosshairs

Although solar inverters are generally thought to be the main target of cyber attacks, the threat landscape for solar PV systems extends far beyond these devices, as the cyber attack perpetrated to several solar plants in Poland in late December demonstrated.

“Attackers often target the broader ecosystem of distributed energy resources, not just individual devices,” the chief technology officer (CTO) of US-based cybersecurity firm DER Security Corp (DERSec), Jay Johnson, told pv magazine . “30 renewable energy sites were hit and, surprisingly, the inverters remained untouched. Instead, attackers deployed wiper malware against substation equipment, affecting operations at the interface between the generating sites and the power grid. While the incident did not cause widespread blackouts, it underscored the multiple ways in which PV systems can be disrupted.”

Historical data on solar infrastructure attacks and vulnerabilities shows that inverters remain a potential target, but vulnerabilities often lie in solar monitors, application programming interfaces (APIs), and mobile applications that communicate with the equipment. These backhaul communication channels, such as Secure Shell (SSH), File Transfer Protocol (FTP), Message Queuing Telemetry Transport (MQTT), Representational State Transfer application programming interfaces (REST APIs), or Hypertext Transfer Protocol Secure (HTTPS) interfaces, allow for firmware updates and real-time monitoring but can also serve as entry points for attackers.

Through these communication platforms, operators can perform firmware updates and monitor system performance. It is also typically how the homeowner or asset owner accesses solar production data over time. They are not using the standardized communication interface for this purpose, as that interface is generally intended for utility interactions. “Instead, the API or other backhaul communication channels provide production data throughout the day and power the mobile applications that show users how their systems are performing,” Johnson explained. “These channels effectively act as a backdoor in many devices, and both interfaces present clear cybersecurity concerns.”

Do you want to strengthen and enhance the cybersecurity of your solar energy assets to safeguard them against emerging threats?

on Apr. 29 for pv magazine Webinar + | Decoding the first massive cyberattack on Europe’s solar energy infrastructure – The Poland case and lessons learned

Industry experts will explore real-world cyberattack scenarios, highlight potential vulnerabilities in solar and storage systems, and practical, actionable strategies to protect your energy assets. Attendees will gain valuable knowledge on how to anticipate, prevent, and respond to cyber threats in the rapidly evolving solar energy sector.