CCC warns of security vulnerabilities in Hoymiles inverters – manufacturer remains silent so far

According to a statement from the CCC, attackers can wirelessly shut down vulnerable balcony and rooftop solar systems, install manipulated firmware, and even permanently physically damage the installations. An attacker can switch the inverters on or off at will and manipulate power limits. Malware can even be injected via the unprotected wireless command for updating the firmware.

According to the CCC, the root cause lies in the Hoymiles inverters communicating over insecure proprietary wireless protocols. The exchange takes place unencrypted over the 868 MHz and 2.4 GHz frequency bands. Since the integrity of data packets is protected only by simple checksums that can be easily recalculated mathematically when modified, there is no real authentication.

Technical vulnerabilities in the wireless protocol

Hunz discovered an undocumented feature in the firmware that can be used to identify all Hoymiles inverters within wireless range using a kind of broadcast command. When this broadcast command is sent, all reachable Hoymiles inverters in the vicinity respond and transmit their serial number in plaintext over the air. These serial numbers do not even appear to be particularly well protected.

In experimental tests, a modified, handheld scanner was sufficient to locate two dozen foreign inverters along with their unique identification numbers and model IDs within 20 minutes. Since the range of the wireless signals can be several hundred meters, such attack hardware could easily be mounted on a drone. The hardware required for this can reportedly be easily attached to a drone, so that an attacker does not even need to be physically present on site.

Attack scenarios and potential consequences

The researcher demonstrated this using his own test program, which switched the inverter's relays and LEDs in a continuous loop. Interventions in the feed-in and grid frequency as well as the execution of entire firmware updates are also said to be possible. If sensitive grid parameters are specifically altered or the internal memory areas of the bootloader are erased, fires, electrical accidents, or destruction of the device are likely. Afterwards, this can only be repaired by opening the housing.

According to the statement, the inverters can, for example, be switched on and off by wireless signal. Although, according to the CCC, remote control requires an „ultrageheimen Schlüssel" that must be transmitted along with the requests, this is supposedly nothing more than a serial number. However, full remote control of the inverters is also said to be possible. This can be used, for instance, to read out statistical data for a dashboard.

In effect, chaining these security issues together means that attackers with simple radio equipment can detect nearby Hoymiles inverters and remotely control, shut down, or even damage them at will. State regulatory authorities have also waved it through: potential sudden power drops in the gigawatt range caused by coordinated shutdowns of solar systems could be absorbed by grid operators.

Response from manufacturer and authorities

Manufacturer Hoymiles reacted during the disclosure process somewhere between irritated and not at all, and has not provided a patch so far. A patch is in the works but is likely to take several more months. Hunz documented his findings in detail in two reports. Until then, operators' only makeshift solution is to set an anti-theft password using the original software, drastically increase the polling intervals in open-source tools such as OpenDTU or AhoyDTU, or physically disconnect the solar modules from the inverter.

The publication is causing a stir beyond the IT security scene because it exemplarily demonstrates how inadequately secured networked energy infrastructure is. The CCC is therefore demanding political consequences: binding minimum standards for wireless communication of feed-in devices and an EU-wide ban on devices that accept firmware updates over the air without cryptographic authentication.

Recommended protective measures

Until a patch is available, experts recommend physically disconnecting affected inverters from the solar module if possible, or at least drastically reducing the polling frequency of open monitoring suites. Operators should also not set an anti-theft password in the original software, in order to make later takeover by attackers at least more difficult. (cku)