Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The gigantic and unregulated power plants in the cloud

berthub.eu

Post reply on HN
Print view View original

181–190 of 258 posts

Re: The gigantic and unregulated power plants in the cloud

#181

Post by misiek08 »

wiredfool wrote: post #93
cesarb wrote: post #77

Earlier quoted context omitted.

> the author is looking at nameplate capacity, which is a completely useless metric for variable electricity production sources For solar panels, the nameplate capacity is usually also the power generated at the peak production time, which is the moment when an attacker turning off all inverters at the same time would have the most impact. That is: for an attack (or any other failure), the most important metric is no…

No, the nameplate capacity is what a solar panel will produce under perfect lighting, independent of the site where it's installed. The peak theoretical power output of a solar panel depends on where it's installed, inclination, temperature, elevation, and so on. The actual peak power is going to take weather and dirty panels into account. 1kw nameplate in Ireland (or the Netherlands) is never going to give you an in…

But 60% of 25GW is less than 3GW? You need to take down more capacity than the buffer and power plants will disconnect from grid for fail-safe. Bringing grid up alone maybe will take days or few, but all the appliances out there will be down for weeks.. ClownStrike brought us pen-written boarding passes, glad we don’t install crapware on hospitals hardware

Re: The gigantic and unregulated power plants in the cloud

#182

Post by BlueTemplar »

MathMonkeyMan wrote: post #41
yetihehe wrote: post #5

>The owner of the panels and inverters can meanwhile establish a connection with that manufacturer using an app or website, and via the manufacturer see how their own panels are doing > It wasn’t necessary from a technical standpoint to let everything run through the manufacturer’s servers, but it was chosen to do it this way. (emphasis from article) I'm working on IoT cloud system. It was chosen to be done this way…

To be fair, I can do it only if I have time and physical access to the network. Home routers have different gateway IPs, different web interfaces, different password policies (e.g. there might be an admin password and an additional password for changing anything), etc. It reminds me of https://xkcd.com/627/ >, but when you're launching a product that isn't good enough. It's hard enough to open up a port even with uPN…

You mention IPv4. We're in 2024, this is getting ridiculous.

Governments should have done the same thing as with digital TV transition(s) : first ban selling devices that can't do IPv6, then ban selling (most) devices advertising they can do IPv4.

Re: The gigantic and unregulated power plants in the cloud

#183

Post by WA »

bilbo0s wrote: post #160
crazygringo wrote: post #133

Earlier quoted context omitted.

No, your point was clearly stated: > But the security argument? Yeah, that ship has sailed. Total war, means total war. Those are your words. I'm saying, focusing on total war is irresponsible and leads you to draw false conclusions. In the real world, limited conflicts are what we're dealing with 99.9+% of the time, thank goodness. And now in your new comment, for some reason you're focusing on "plausible deniabilit…

The security argument against cloud based monitoring has sailed. With or without cloud based monitoring, our power grids can be disrupted. That's the commonly accepted meaning of "that ship has sailed" as a colloquialism with respect to cloud based monitoring. Also, you, yourself, brought up the idea of cold war style confrontation. The basis of most actions against proxy supporters in cold war style conflicts is pla…

How could a super power disrupt the energy grid in a non-total war scenario?

Re: The gigantic and unregulated power plants in the cloud

#184

Post by DoctorOetker »

outsomnia wrote: post #177
DoctorOetker wrote: post #142

Earlier quoted context omitted.

GPS can provide the coherent reference, if you mean transmitting signal (say sound) while the panel is illuminated by the sun theres youtube videos of people doing that, with a laser pointer, but in sunlight and without information theoretic justified modulation scheme. Nothing prevents the satellite to transmit the commands at night, if that feels more convincing to you. Ask yourself what is the active area of a pho…

This is just FUD.

I'm not at all claiming this is happening, I'm claiming this is very feasible to do. Consider the aperture (area) of a camera or telescope, how many times can you fit this area into a domestic solar panel installation?

If we are discussing the solar panel that powers your outdoor garden light, I don't suggest to apply the precautionary principle, but we are talking about products that sum up to a significant fraction of grid power generation.

Re: The gigantic and unregulated power plants in the cloud

#185

Post by DoctorOetker »

Dylan16807 wrote: post #170
DoctorOetker wrote: post #120

Earlier quoted context omitted.

it's incredibly hard to implement a data diode for PV systems, enemy satellites can modulate light (like a TV remote, but lower baudrate to stay below the noise floor) and an inverter could decode it and respond accordingly. They measure the PV panels anyway for MPPT.

You're describing two very different concepts at the start. A data diode applies to a specific connection. It's easy to have a serial port that goes one way. Preventing any possible input to an already compromised device is much harder. But if your device isn't already compromised then it won't be looking at the input light levels for commands.

> But if your device isn't already compromised then it won't be looking at the input light levels for commands.

But this is precisely part of the threat model, the manufacturers are best positioned to execute supply chain attacks on foreign buyers.

Re: The gigantic and unregulated power plants in the cloud

#186

Post by BlueTemplar »

g_p wrote: post #104
numpad0 wrote: post #80

Earlier quoted context omitted.

How would one practically verify and certify cybersecurity of a product? Even payment smartcards sometimes come with non-malicious maintenance backdoors. There seem to be little to no academic theoretical basis to this whole software security thing.

Given the challenges of techniques like TLS interception (i.e. through pinning and other good security features), about the only measure I can see left is network isolation. You can set up a local network that has no WAN connectivity on it. About anything else is difficult to verify even the most basic of security properties. Certifying is another step up (although you could argue certifying is just a third party say…

We're not just talking about random consumer hardware : with security issues like these, I don't see why closed source software would not be just banned.

Re: The gigantic and unregulated power plants in the cloud

#187

Post by blkhawk »

1053r wrote: post #110
mschuster91 wrote: post #100

Earlier quoted context omitted.

> We must consider the worst case, which is that the attacker is trying to not only physically break the inverters, but the batteries, solar panels, blow fuses, and burn out substations. Power transformers have a loooooooot of thermal wiggle room before they fail in such a way and usually have non-computerized triggers for associated breakers, and (at least if done to code, which is not a given I'll admit) so do inve…

This is true, especially for low frequency (high mass) inverters. The inverters that are covered here are overwhelmingly high frequency (low mass) inverters. We hope that they practiced great electrical engineering and layered multiple layers of physical safeguards on top of the software based controls built into the firmware. Of course a company that skimped to the point of total neglect on software security would n…

> high skill firmware restore at a minimum and turn them into e-waste and require an re-install from a licensed electrician at a maximum.

Well not even high skill - for "security" reasons and to prevent support issues as well as to skimp on testing needed informations are often only accessible to a chosen few.

Paradoxically the effect of thes "security" concerns often mean that there are plenty of easily exploited methods in devices like that. And the only people that have them are the ones that you need to worry about instead of some 16 year old teenager finding it and playing blinkenlights with his friends parents house causing trouble for him but getting the hard coded backdoor taken out after the media got wind of it.

If I was dictator of infrastructure I would ban any non-local two way communication and would mandate all small grid storage solutions run off a curve flattening model thats uniform and predictable. Basically they would store first and only be allowed to emit a fraction of their storage capacity to the grid afterwards. Maybe regulated by time of day.

Re: The gigantic and unregulated power plants in the cloud

#188

Post by yetihehe »

MostlyStable wrote: post #68
wmf wrote: post #58

Earlier quoted context omitted.

In some areas like cameras there are a decent number of cloud-free alternatives. Hopefully as the IOT market grows we'll get cloud-free versions of everything. I think you're too optimistic about costs though. Providing any support at all, even one-time during the install, is expensive and cloud-free IOT is going to require support due to home networks being broken.

Yes, support is expensive, but what I am proposing will, if anything, reduce support. I'm imagining something where, if I opt into local control, I am giving up all rights to any support that is not related to the core functionality of the device. For example the solar panels/inverters in the article. If I opt in to local control, then the only support I am entitled to is the solar panels stop generating power or if…

> So if my home network breaks, that is not their problem.

Differentiating between people like you, who can take blame for misconfiguring device and 99% of other consumers is not viable for most companies. Also, if you bought our device and wanted to do that, I would probably make a firmware version for you that connects to your endpoint and give you some docs. But:

- Just talking and coordinating that possibility for one user would cost my company more than the final price of device, when considering time spent on this.

- You would have to spend a lot of time to implement a lot of functionality to glue our protocol to your desired endpoint.

Re: The gigantic and unregulated power plants in the cloud

#189

Post by BlueTemplar »

leymed wrote: post #118

Reading through comments I saw a lot of comments confusing cloud security with electrical safety of a system. Electrical protections are completely separate from communication line/ internet, has to be hard wired. As the size of plant/substation increases the automation and control system (again completely different thing from electrical protection) has its own internet system. Burning down substation, exploding tran…

You're the one that seem to be missing something, we're not talking about local electrical safety, but about the global grid stability, with a hacker potentially hijacking software controlling tens of GW, spread out over many personal home installations of solar panels.

Re: The gigantic and unregulated power plants in the cloud

#190

Post by yetihehe »

titzer wrote: post #69
pheatherlite wrote: post #25

Earlier quoted context omitted.

If we've learned anything from the security cam and baby cam scandals, then it's that convenience is king and we as a society would rather risk everything than be arsed to take few additional steps to setup/learn something to prevent such basic breaches. We (the society) don't even want to change the default password on most things.

People gonna be people. It's up to engineers and product designers to make things user friendly but also safe-by-default. If something needs to be configured, then provide instructions on how to configure it. Instead of pretending that it's society's fault (can't be arsed ), maybe ask why the IT industry can't make instructions that are written out--explicit, fairly standard, and easy to follow--like the manual for p…

> fairly standard, and easy to follow--like the manual for putting together a piece of furniture.

And people still have problems following that instructions. We gave a lot of instructions, but some people just don't read them. Or can't understand and follow them. Example from this week:

Yeah, main support guy for our client is on holidays this week and only a girl from sales is available and she doesn't know why our device doesn't work, she tried resetting her phone wifi but still can't pair our zigbee smart hub connected with usb modem stick (problem: no one told her she needs to message us to actually activate sim card before installing device for end client).

Yes, you can solve this one problem, but there are many more we didn't see yet. Consumer support does not scale and you can't write tests for something you don't know will be a problem.

Post reply on HN