Hackers Can Manipulate Internet-Based Solar Panel Systems to Execute Attacks in Minutes
Recent findings indicate that internet-based attacks are increasingly targeting solar power infrastructure, posing significant risks to energy production. Attackers can exploit these systems within minutes using open ports and readily available tools.
Recent findings indicate that internet-based attacks are increasingly targeting solar power infrastructure, posing significant risks to energy production. Attackers can exploit these systems within minutes using open ports and readily available tools.
Modern solar farms utilize networked operational technology, including SCADA controllers and string monitoring boxes, many of which employ the legacy Modbus protocol that lacks inherent security features.
When these devices are exposed online, attackers can remotely send control commands, potentially disrupting power generation on clear, sunny days with minimal effort.
Cato Networks analysts have observed extensive reconnaissance and exploitation attempts on Modbus-enabled string-monitoring boxes, which directly control solar panel outputs.
By exploiting Modbus over TCP, typically accessible on port 502, attackers can read device status and manipulate control bits to turn strings on or off.
Recent findings indicate that internet-based attacks are increasingly targeting solar power infrastructure, posing significant risks to energy production.
This approach does not require zero-day exploits or complex payloads. The primary risk arises from default-open services and insecure protocols. Once attackers identify a vulnerable device, the time from initial probe to significant power disruption can be reduced from days to mere minutes.
Command-Level Manipulation over Modbus
The core of this threat involves direct register manipulation over Modbus/TCP. Attackers typically start with discovery using tools like Nmap's Modbus NSE scripts to verify a host's Modbus service on port 502 and enumerate device IDs.
For instance, a malicious operator could switch off a PV string by writing a specific value to a control register:
mbpoll -m tcp -t 0 -r 0xAC00 -0 1 <target-ip>
0xAC00 mapped as SWITCH OFF
Registers such as 0xAC00 and 0xAC01 are often mapped to "SWITCH OFF" and "SWITCH ON," respectively. By looping these commands, attackers could rapidly toggle strings, stress inverters, or silently reduce production while keeping the plant online.
AI-driven tools can automate the scanning, fingerprinting, and command injection processes against OT assets, enhancing attack scalability.
These findings underscore the vulnerabilities present in internet-exposed Modbus services on solar assets, highlighting the potential for rapid grid disruption.
Based on reporting by Cyber Security News.