The research authors note the figures presented are “lower bound”: only discovered devices that could be definitely associated with commercial solar plants were included, and that further discovery and attribution would increase the number of systems potentially similarly exposed.

The researchers’ evidence included being able to access web interfaces that allow access to data such as physical location, a device’s current statistics, and web server logfiles. In some cases, they found visitors could control a single or several devices, “or an entire solar park.”

“Physically, wind and sun are the most robust parts of our energy supply. Digitally, they are fragmented, often exposed to the internet and not always monitored. What we can map in hours, an attacker can map in hours too. You can’t defend what you can’t see, and no one can see this whole landscape alone,” said Modat founder and CEO El Yadmani.

The research found that many of the internet-connected assets were misconfigured or un-configured —that is to say left with default settings —by operators. Such configurations expose the software running critical infrastructure to malicious attacks that can be technically trivial to enact.

The report’s authors note that the growing preponderance of cyber defence scanning by dedicated software using large language models means that any exposed assets are increasingly easy for malicious actors to identify and potentially exploit. The report can be read in the context of the European Commission’s Smart Energy Expert Group report published 1 October that contains detailed information on the specific technological and geopolitical risks to solar projects.

Source link