Rebadged, Relabeled, Rooted: Pwnage via Solar Supply Chain
Uncovers widespread firmware backdoors and hardware vulnerabilities in commercial solar inverters and energy management gateways across global supply chains.
Summary
The Rapid Growth of Distributed Solar Infrastructure
Distributed solar generation and energy storage systems rely on smart solar inverters and cloud-connected telemetry gateways to balance power delivery to national electric grids.
Reverse Engineering Rebadged Solar Inverters
Anthony Rose and Jake Krasnov analyze dozens of commercial solar inverter models, discovering that many brands are simply rebadged white-label hardware containing identical firmware vulnerabilities.
Hardcoded Root Access and Unauthenticated APIs
Inspecting device firmware reveals hardcoded master credentials, insecure cloud management protocols, and unauthenticated local APIs that allow remote attackers to alter power output parameters and trip circuit breakers.
Securing Renewable Critical Infrastructure
Protecting renewable energy systems demands supply chain provenance auditing, independent hardware security testing, and strict network segmentation for smart energy gateways.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Creator Stage·21 min
Larry Pesce
Demonstrates hardware disassembly, SPI flash extraction, and JTAG interfacing to build an accurate Software Bill of Materials for an IoT Wi-Fi router.
ICS Village·22 min
Hash Saehi
Hash Saehi dissects the hardware and RF protocols of electrical smart meters, demonstrating why auditing grid edge devices is vital for infrastructure resilience.