BY MIKE STONE:
If you’re wondering how long it might take to hack your residential storage system, TÜV Rheinland has the answer: a few minutes, or maybe seconds.
That is how long it took the global leader in inspection services’ experts to break into commercially available PV inverters, which usually communicate with storage systems as well as the solar panel array.
Earlier this year, the German company demonstrated just how straightforward it could be to do anything from simply manipulating power outputs to damaging batteries or even bringing down a whole local grid system.
Dr Daniel Hamburg, head of the testing and certification global centre of excellence at TÜV Rheinland, warned that as the installation of storage systems accelerates, the possibilities for an attack will also build.
Andreas Schlumberger and Constantin Zankl at TÜV Rheinland said that although the threat has not yet erupted onto the domestic storage space there are already precedents of hackers attacking electricity grids.
A gathering danger
Schlumberger cited the Industroyer malware (also known as Crashoverride), which attacked Ukraine’s power grid on December 17, 2016. “Grid operators here in Germany report that they are attacked on a daily basis,” he said.
He added that his team suspected that renewable generation arrays were also being attacked regularly.
There are two ways in which such attackers could fine-tune their activities and hit storage systems via inverters, according to Schlumberger.
“If you manipulate the grid-connected power of PV and storage you are able to cause unwanted fluctuations in voltage frequency in the distribution grid,” he said. “(The) maximum hazard (of this) would be a grid failure.”
Alternatively, he said: “By manipulating the battery management system, you could eventually make a battery burn and or explode.”
Ease of attack
Not only could a hacker potentially blow up your battery, but they could also find a way to do so worryingly rapidly. According to Zankl, your system could be compromised in seconds.
He commented: “If an attacker knows where the vulnerability is, it is possible to do automated scans or attacks for this vulnerability. Even manually it is very easy to detect.”
Zankl made the point that although the inverters the Rheinland team tested were not in fact for the domestic market, “it is most likely also possible to hack inverters for the consumer market.”
He highlighted lack of encryption in communication protocols, and weak passwords, as a major security vulnerability for all inverters, whether domestic or commercial.
His recommendation to inverter manufacturers was firstly to tighten up on encryption. The next sensible move would be regular penetration testing, which probes a system’s vulnerability to attack.
Strengthening for security
A SolarEdge representative told Energy Storage Report that the company took cyber security seriously.
“Our cyber security practices include authentication of each endpoint and encryption of the communication, stress testing of our customers’ equipment, our cloud platform, contingency planning and much more,” they said.
Schlumberger of TÜV Rheinland would not name names when asked which manufacturer’s devices failed his company’s security testing.
However, he and his colleagues maintain that lack of inverter cyber security remains a widespread weakness, despite the fact that it has been recognized for a number of years.
Concerns for the future
His explanation for ongoing lax standards is that in-depth security was not a major consideration in the design of most current inverters.
Once the threat became more apparent, it emerged that existing products lacked the hardware setup facilities and processing power to adequately upgrade their security, he said.
Schlumberger concluded: “Nowadays these products are in the field and it is most likely not possible to patch (their) systems without changing the hardware.”
- Also in this week’s intelligence brief roundup: CellCube Energy Storage Systems, CATL, DNV GLand more. Get your free copy now.