Vulnerabilities in the Smart Core of Green Infrastructure Part-1 by:
No ratings
Presented at RootCon 9 by
The global adoption of renewable energy, particularly solar power, is rapidly increasing. However, this accelerated digitization has also opened up new attack surfaces—especially in developing nations where cost-effective, Chinese-manufactured inverters and communication devices dominate the market. Our research focuses on a real-world investigation into the cybersecurity posture of solar plants that rely on Chinese inverters and RS485-to-Ethernet couplers. These devices, while enabling efficient communication and monitoring, introduce serious national security and privacy concerns. In this paper, we present our findings from a live production solar plant where these devices were installed. We uncovered critical vulnerabilities across communication channels such as Bluetooth, Wi-Fi, and USB, all used by the inverter to interact with gateway couplers and mobile applications. During reverse engineering and traffic inspection of the associated mobile apps and firmware, we discovered that sensitive plant operational data—including voltage readings, device health, and control commands—were being exfiltrated to remote servers located in China. The inverters we examined were capable of being remotely switched on or off via the mobile application. The implications of this are severe: an attacker who exploits these interfaces or hijacks app traffic could effectively disrupt plant operation or induce cascading failures in grid stability. Our discovery also includes poorly secured or hardcoded credentials within the firmware, unsecured Bluetooth pairing modes, and lack of proper authentication mechanisms in the couplers converting RS485 (Modbus) to Ethernet. This paper is the first part of an ongoing investigation. In future releases, we will focus on firmware implants, radio communication tampering, and active exploitation techniques. This initial part lays the groundwork by exposing systemic risks, insecure data flows, and geopolitical implications. Key Findings 1. We reverse-engineered the mobile app associated with the inverter and found hardcoded IP addresses linked to Chinese cloud servers. All monitoring and control data—including ON/OFF commands—were being silently transmitted to these endpoints without user consent. 2. The inverter’s Bluetooth interface was found to be in continuous discoverable mode with no pairing key enforcement. An attacker within range could connect and manipulate the device without authentication. 3. The mobile application stored Wi-Fi credentials in plaintext and transmitted them during device setup. This flaw allows adversaries to sniff Wi-Fi credentials during setup or app interaction phases. 4. A USB port on the inverter was found to expose debug access without proper access controls. We were able to mount the file system and extract configuration data, including private keys and logs. 5. The RS485-Ethernet converters (acting as gateways) had no authentication for Modbus communication and were susceptible to traffic injection. A rogue device on the network could easily spoof inverter commands. 6. The inverter processed received commands without verifying the data integrity or sender authenticity. This makes command spoofing trivially easy for attackers. 7. All mobile app communications to the inverter and Chinese servers were over HTTP and unencrypted Bluetooth. This opens a door for MITM (Man-in-the-Middle) attacks in public or compromised networks. 8. The inverter relied on cloud-based decision-making for major actions like remote shutdown or firmware update checks. In case of a hostile takeover or DNS poisoning, the attacker could push false updates or shut down the plant.