Slashdot Mirror
Flaws In Popular Solar Power Management Platform Could Crash the Grid
mask.of.sanity (1228908) writes "Criminals could potentially cause black-outs and mess with power grid configurations by exploiting flaws in a popular solar panel management system used by thousands of homes and businesses. The threat is substantial because, as the company boasts, its eponymous management system runs globally on roughly 229,300 solar plants that typically pump out 566TWh of electrical energy."
You misspelled terrorists... Only terrorisme is important.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
and all will be fine.
Luckily that is far more power than the required 1.21 gigawatts that will be used to travel back in time and address the flaw.
556TWh is a cumulative unit. It's not an average output. If it's over an hour, that's 556TW; if it's over 1000 hours, that's 556GW.
Support my political activism on Patreon.
"... that typically pump out 566TWh of electrical energy." - per day, hour or is it is just 566TW?
Original article has two flaws with the number you quote. It's not 566TWh, it's 5.66TWh (that's the value advertised for yesterday as total energy), that's 2 orders of magnitude. And it's not "typically" since it's the accumulated value over the service lifetime. If you want to quote a typical value, you quote current power (in W, not Wh) and the website advertise it as 6.74 GWp (p for peak, the bullshit suffix used by the solar panel industry (should be 6.74 GWbs IMHO), so the actual value is even less), that's another 3 order of magnitude. I guess the actual numbers are less impressive...
Can we just not move the system to the Cloud, or something, to make it better and enable a new, richer experience?
There's some things in this world that need to be kept hot, and some that need to be kept cold, especially in food. So, whenever there's a long enough blackout, we lose a lot of food. That was the big damage from Enron, and we seem to be on the path to making the same mistake.
Uhm, Taco... we need to ban the URL Shorteners again!
They're in the wrong business. If they potentially caused a crash of the stock market and wiping out the retirement funds of millions of people, then they're financial wizards and job creators.
Squirrels could potentially cause black-outs and mess with power grid configurations. In fact, they have.
Solar power is still just a tiny tiny fraction of total energy output, yet hackers can cause massive blackouts? If only they knew how to hack the SCADA systems that run traditional power plants :rollseyes:
"I don't know that atheists should be considered citizens, nor should they be considered patriots." George HW Bush
Oxymoron.
Why not just keep the management system OFF the network? Make it local-only?
Just because something CAN be hooked to the Internet, it doesn't necessarily follow that it SHOULD be hooked to the Internet.
Just my 2p worth. Save up the change for a cup of coffee or something.
All the world's an analog stage, and digital circuits play only bit parts.
How about putting the devices behind an encrypted firewalled connection?
Lots of things could crash the grid, and have. Lightning, squirrels, high demand, or an idiot with a pair of pliers. The real problem is the oft-described obsolescence and inherent instability of the systems running the grid. One of the chief problems with the US grid is the underpinning accounting algorithms that configure power buys and connections to maximize profits over stability and efficiency. System reaction time and response modes to anomalies are hampered by "What's the cheapest?" arguments over-riding "What's the best?" logic in the software. The decisions of switching station load dispatchers are driven by...wait for it...money.
Scruting the inscrutable for over 50 years.
Stop trying to distract us from this very serious discussion.
I don't read your sig. Why are you reading mine?
I'm not sure if it was the person who submitted the article or if samzenpus decided to condense things, but the quote is straight from the article, except for removing one sentence from the middle:
"Details of how the attacks could be executed were kept under wraps while solar panel monitoring kit vendor Solar-Log distributed a patch for the flaws."
Which wouldn't be that big a deal, except that the part included in the Slashdot blurb refers to the "eponymous management system", which makes absolutely no sense if you don't include the name of the software/company.
This Space Intentionally Left Blank
We a Koch Bros. Industries are now hiring enterprising talent
Sorry, not moving back to Wichita, KS... Thanks anyway.
Never interviewed at Koch, not that I tried very hard to get one, but I knew a number of folks who worked there. Not the best place to work for job security and if you loose your job there isn't much else in Wichita to do. Sort of a dead end kind of town for technology careers. Every company I know that *used* to be there, moved to FL or TX, just went broke or wasn't anyplace you ever wanted to work anyway. The exception was the aircraft makers, but they only wanted "tin binders" and machine operators.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I work for a power company and remember a certain outage involving a cat. Apparently it got into the mesh at a local substation. A coworker asked what color the cat was. Another answered, "I don't know, but it's black now!"
Part of the problem is that these are residential units, not commercial. If we make the presumption that the software is open-sourced and it magically becomes secure over night, there is still a major problem: people. A residential user is far less likely to go back and update their software unless they have to; look at the number of wifi access points running with the default credentials. There isn't a large corporate entity with open-source reaching out to their end-users telling them new stuff is available and that security is really important and should be installed asap. The only two entities I know of that do that are RedHat & Canonical, but that's a paid service. If the primary market for these units were commercial, then they have a financial and legal incentive to keep up with what's current.
Those aren't home solar panels. So the criminal would have to gain access to a power plant........ Hmm... I wonder who posted this article..