Internet-connected solar devices can risk power grid safety in Hawaii
Grid Trouble in Paradise: Uncovering Vulnerable Distributed Energy Resources and Their Grid-Level Risks
Cryptography and Security
Summary
Many solar power devices used by homes and businesses connect to the Internet for monitoring and control, but some are not well protected. This study by the authors found over 66,000 solar devices exposed online, with at least 10,000 having known security problems. They tested how hackers could use these weak points to cause trouble on the power grid of Oahu, Hawaii. The results showed attackers could disrupt the power supply, causing issues like bad power quality or even outages. The authors highlight the need for better security practices to protect the electric grid from these vulnerabilities.
Distributed energy resources (DERs)Solar invertersInternet exposureCommon Vulnerabilities and Exposures (CVEs)Power grid securityVoltage violationsLine flow violationsPower system analysisEnergy monitoringElectric grid network
Authors
Anna Raymaker, Samuel Talkington, Zeezoo Ryu, Richard Asiamah, Emad Abukhousa, Betelihem Ashebo, Animesh Chhotaray, Daniel K. Molzahn, Frank Li, Saman Zonouz, Raheem Beyah
Abstract
Grid-connected solar distributed energy resources (DERs), such as solar inverters and monitoring platforms, have been deployed at unprecedented scale over the past few years, with global solar capacity more than doubling since 2022. To support monitoring and control, many of these systems are Internet-connected and configured by installers or end users, yet the real-world scale of their Internet exposure and the implications for power grid operation remain poorly understood. In this paper, we present an Internet-scale evaluation of exposed and vulnerable solar DER infrastructure, and assess the risk that compromised DERs can pose to energy grids. We develop a method for accurately identifying solar DERs from Internet scanning data, and discover a diverse population of over 66,000 Internet-exposed solar DERs. We detect that at least 10,000 of these DERs may have known CVEs, such as unauthenticated monitoring and control endpoints. To assess the risk that these vulnerable DERs pose to a power grid, we use an electric grid network for Oahu, Hawaii, established and used by the power system research community, and conduct a power system analysis. Our evaluation shows that by compromising exposed DERs, attackers can cause voltage and line flow violations across multiple locations in the Oahu network, resulting in a range of consequences from degraded power quality to damaged power system components to power outages. Ultimately, our work brings to light the emerging threat of grid-connected DERs, and provides directions for improving energy security.