PaperlayerView exact revision on arXiv

Source-linked AI summary

Grid Trouble in Paradise: Uncovering Vulnerable Distributed Energy Resources and Their Grid-Level Risks

Anna Raymaker, Samuel Talkington, Zeezoo Ryu, Richard Asiamah, Emad Abukhousa, Betelihem Ashebo, Animesh Chhotaray, Daniel K. Molzahn, Frank Li, Saman Zonouz, Raheem Beyah

arXiv:2609.07783v2cs.CRcs.SYeess.SY

TL;DR

The scale of Internet-exposed solar DERs and their possible grid impacts remain poorly understood. The paper measures exposed DERs and analyzes their grid effects using an Oahu network model. It finds that coordinated manipulation of exposed inverters can cause voltage and line-flow violations across that network.

  • Problem

    The scale of solar DER exposure on the public Internet and the grid consequences of compromising exposed devices remain poorly understood.

    Source: §1 · pp. 1–2

  • Method

    The paper combines Internet-scale DER discovery with power-system analysis of empirically exposed inverters in an Oahu grid model.

    Source: §1 · p. 2, §6 · p. 13

  • Results

    41.1 MW of coordinated inverter manipulation drives 18 of 37 Oahu buses more than 10% below nominal voltage and overloads 6 of 89 transmission lines.

    Source: §6 · p. 13

  • Takeaways & Limitations

    Supply-side inverter compromise controls active and reactive power, enabling voltage manipulation that demand-side attacks cannot achieve with orders of magnitude fewer devices.

    Source: §6 · p. 14

    The measurement covers only DER devices directly reachable from the public Internet, not the full installed base.

    Source: §6 · p. 14

Abstract

from arXiv · show

Grid-connected solar distributed energy resources (DERs), such as solar inverters and monitoring platforms, have been deployed at unprecedented scale over the past few years, with global solar capacity more than doubling since 2022. To support monitoring and control, many of these systems are Internet-connected and configured by installers or end users, yet the real-world scale of their Internet exposure and the implications for power grid operation remain poorly understood. In this paper, we present an Internet-scale evaluation of exposed and vulnerable solar DER infrastructure, and assess the risk that compromised DERs can pose to energy grids. We develop a method for accurately identifying solar DERs from Internet scanning data, and discover a diverse population of over 66,000 Internet-exposed solar DERs. We detect that at least 10,000 of these DERs may have known CVEs, such as unauthenticated monitoring and control endpoints. To assess the risk that these vulnerable DERs pose to a power grid, we use an electric grid network for Oahu, Hawaii, established and used by the power system research community, and conduct a power system analysis. Our evaluation shows that by compromising exposed DERs, attackers can cause voltage and line flow violations across multiple locations in the Oahu network, resulting in a range of consequences from degraded power quality to damaged power system components to power outages. Ultimately, our work brings to light the emerging threat of grid-connected DERs, and provides directions for improving energy security.

1 Introduction

The paper addresses gaps in scalable discovery of solar DER exposure and in understanding the grid consequences of compromising exposed inverters. It combines Internet-scale measurement with power-system analysis to characterize exposed hosts and quantify potential grid impacts.

1 Introduction

  • The work addresses the lack of a reproducible, validated method to discover heterogeneous DERs at scale and limited understanding of worst-case grid consequences.Prior Internet scans did not systematically characterize solar DER exposure or link it to grid impact, while prior power-system studies assumed control of millions of devices.Source: §1 · p. 2
  • A cross-vendor discovery pipeline identifies exposed solar DER platforms, then characterizes reachable interfaces, maps them to attacker capabilities, and simulates worst-case attacks on a realistic grid model.An LLM labels a training set, and a supervised classifier applies those labels across 1.8M hosts.Source: §1 · p. 2
  • The measurement identifies 66,379 solar DER hosts across more than 150 countries, with at least 11,826 associated with known vulnerabilities.Exposure is dominated by web-based management interfaces that enable device configuration and control.Source: §1 · p. 2
  • 41.1 MW of coordinated inverter manipulation drives 18 of 37 Oahu buses more than 10% below nominal voltage and overloads 6 of 89 transmission lines.The resulting conditions can damage motors and transformers and force protective disconnections that lead to outages.Source: §1 · p. 2
  • The contributions include a public tool for simulating and visualizing the maximum grid impact achievable on Oahu using currently exposed DERs.Users can select inverter subsets, adjust control settings, and observe how impacts change.Source: §1 · p. 2

2 Threat Model, Related Work, and Overview

This section frames the study around an Internet-based adversary, contrasts DER discovery and grid-impact research with the paper’s approach, and outlines its measurement and power-system analysis.

2.1 Threat Model

  • The threat model assumes an adversary acts remotely through publicly reachable interfaces and infers capabilities only from scanner-visible interfaces and documented control functionality.When authentication is weak or absent, the attacker may modify inverter settings or trigger actions such as disconnection, reboot, or firmware upload.Source: §2.1 · pp. 2–3

2.2 Related Work

  • Existing discovery methods do not readily generalize to DERs because their vendor ecosystems lack the structural regularities found in PLCs and EV chargers.Prior work also largely characterized exposure without connecting a measured, validated DER population to quantified grid-level consequences.Source: §2.2 · p. 3
  • Unlike demand-side attacks that manipulate load, the paper studies supply-side inverter compromise, which controls active and reactive power and can achieve comparable grid impact with orders of magnitude fewer devices.Prior demand-side studies assumed an adversary already controlled a hypothetical population of millions of devices.Source: §2.2 · p. 3

2.3 Approach Overview

  • The approach combines Internet-scale measurement with power-system analysis to map DER exposure and quantify grid-level consequences.It applies a discovery pipeline to two Censys snapshots, yielding 66,379 validated hosts, then augments an Oahu grid model with exposed inverters and formulates worst-case attacks as adversarial AC optimal power flow problems.Source: §2.3 · p. 3

3 Methodology

The methodology combines vendor-driven Internet scanning with staged classification to identify exposed solar DERs, then characterizes their interfaces and security properties. A two-snapshot design supports classification at scale and tests generalization to additional vendors.

3.1 Stage 1: Vendor-Driven Discovery

  • Vendor-specific fingerprints from documentation drive deterministic Censys queries, supplemented by a generic query to find white-label or unattributed devices.The two snapshots cover 34 and then 96 vendors; vendor-specific queries identified nearly 50% of validated DER hosts that generic queries alone would miss.Source: §3.1 · p. 4

3.2 Stage 2: Training-Set Labeling and Validation

  • An LLM labels Snapshot 1 hosts using scanner metadata and scraped web content, followed by suppression rules that yield a labeled training set of DER and non-DER hosts.Llama 3.3:70b was selected for its larger candidate set and comparable true-positive and true-negative rates; the hybrid screening and suppression achieved 98% precision on a manually validated sample.Source: §3.2 · p. 5

3.3 Stage 3: Scaled DER Classification

  • A Random Forest trained on Snapshot 1 labels scales classification to Snapshot 2, with five-model consensus and a probability threshold used to select hosts.It classifies 1.8M hosts in under five minutes on one CPU; a Snapshot 2 audit found 99 of 100 predicted-solar hosts and 98 of 100 predicted-not-solar hosts correctly classified, producing 66,379 validated hosts.Source: §3.3 · pp. 5–6
  • 98.0% precision and 86.3% recall (solar class) in Snapshot 1 five-fold cross-validation; the held-out test split confirms 98.2% precision and 86.1% recall.Table 2 reports Random Forest performance on Snapshot 1 and an audit of random samples from Snapshot 2.Source: §3.3 · p. 6, Table 2 · p. 6

3.4 Stage 4: Device and Security Analysis

  • Each validated host is attributed to a vendor and device role, then assessed for reachable interfaces, misconfigurations, software versions, and geographic metadata.CVE matches require explicitly disclosed version identifiers and indicate potentially affected deployments, not confirmed exploitability.Source: §3.4 · pp. 6–7

4 RQ1: Exposure Results

The exposure results characterize reachable interfaces, deployment heterogeneity, persistence, and potential software vulnerabilities across Internet-exposed solar DERs. They show a broad attack surface spanning management and control interfaces, a fragmented vendor landscape, and sustained exposure across snapshots.

4.1 Externally Reachable Interfaces

  • 95% of hosts expose web-based management portals, while 3% expose fleet or installer portals that enable interaction with many inverters.Management portals support configuration actions; fleet portals aggregate and manage multiple devices or sites.Source: §4.1 · p. 7
  • Modbus/TCP is reachable on 4.8% of hosts, and 0.7% expose grid-oriented protocols such as IEC 60870-5-104 and DNP3.Modbus/TCP typically exposes SunSpec registers supporting low-level inverter control.Source: §4.1 · p. 7

4.2 Vendor and Deployment Heterogeneity

  • 53.7% of exposed hosts lack a match to the 96-vendor fingerprint set, and manual inspection found generic interfaces with configuration or control access.The paper associates generic and multi-vendor interfaces with installer-specific deployments, white-label platforms, or customized firmware.Source: §4.2 · p. 8
  • SMA appears on 8.8% of exposed hosts and Fronius on 5.7%, while each of the bottom 60 vendors appears on fewer than 0.1%.Hosts may match multiple vendors, and exposure fragments across a long tail of platforms and deployments.Source: §4.2 · p. 8

4.3 Persistence and Generalization

  • 63.7% of Snapshot 1 hosts reappeared four months later, while the top five shared vendors retained their rank order across snapshots.The authors attribute the 36.3% absent from Snapshot 2 to possible IP churn, remediation, or network-configuration changes.Source: §4.3 · p. 8
  • The classifier identified hosts for 6 of 62 vendors absent from its training data, and rejected results for the remaining 56 as non-device infrastructure.The new detections included 46 hosts; the authors say these results show generalization beyond brand-specific memorization.Source: §4.3 · pp. 8–9

4.4 Observed Software Vulnerabilities

  • SMA inverter firmware accounts for almost 5,000 potentially affected hosts across 16 CVEs, but version matching does not confirm exploitability.The paper identifies CVEs by matching observed firmware or software versions against public vulnerability databases.Source: §4.4 · p. 9
  • Only Oahu hosts manually confirmed to have severe attacker-relevant exposures, such as unauthenticated management or externally reachable control protocols, enter the grid analysis.This conservative validation restricts that analysis to real Internet-exposed inverters with demonstrable control or disruption potential.Source: §4.4 · p. 9

5 RQ2: Power Grid Analysis

The Oahu analysis models worst-case attacks on an augmented grid using exposed solar DERs and finds that their manipulation can cause substantial voltage and line-flow violations. Its component-wise results bound potential impacts, while the compromised-fraction analysis shows how reducing reachable devices changes those impacts.

5.1 Testbed Description

  • The 37-bus Oahu model is augmented with 41.1 MW of geographically verified, exposed solar DERs attached to their closest transmission buses.The test region has high DER penetration and serves a peak load of 1,100 MW.Source: §5.1 · pp. 9–10, §5 · p. 9, Table 7 · p. 10

5.2 Problem Formulation

  • Separate adversarial AC optimal power-flow problems maximize each target bus’s voltage or line’s current, assuming full simultaneous control of the compromisable DERs.Compromised inverters remain within their apparent-power ratings, while non-compromised generators follow modeled control responses.Source: §5.2 · pp. 10–11

5.3 Results

  • Overvoltages exceed 1.10 p.u. at four buses, reaching 1.11 p.u.; nearly half the buses have worst-case voltages below 0.80 p.u.The test case’s acceptable voltage range is 0.90–1.10 p.u.Source: §5.3 · p. 11
  • 18 of 37 buses fall below 0.80 p.u. in worst-case attacks, while 6 of 89 lines overload by as much as 12% beyond nominal ratings.Severe undervoltage can stress motors and other equipment; overloaded lines may require disconnection to avoid damage.Source: §5.3 · pp. 11–12, Figure 5 · p. 12, Figure 6 · p. 12
  • Undervoltage first appears at 40% compromise; four, five, and six lines become overloadable at 30%, 40%, and 90%, respectively.The analysis varies compromise in 10-percentage-point increments; restricting public exposure or strengthening authentication reduces the reachable population.Source: Figure 7 · p. 12, §5.3 · pp. 12–13

6 Concluding Discussion

The measured exposed inverter population can produce substantial grid violations under coordinated manipulation, while deployment practices and persistent exposure shape the attack surface. The analysis also has scope and modeling limitations, and the authors identify mitigations and future work.

Grid Impact at Today’s Exposure Levels

  • 41.1 MW of exposed Oahu inverters can drive 18 of 37 buses more than 10% below nominal voltage and overload 6 of 89 lines; related analysis reports 6.7% of lines overloaded up to 12% beyond nominal ratings.These conditions can stress conductors, transformers, and motors and could force protective disconnections that propagate into widescale outages.Source: §6 · p. 13

Deployment-Driven Exposure

  • Most exposed deployments use generic or layered interfaces, often making installers and integrators—not manufacturers—the effective security boundary.Installer choices such as enabling remote access, forwarding management ports, or aggregating vendors can introduce exposure despite secure manufacturer defaults.Source: §6 · p. 13

Persistent Exposure as a Sustained Attack Surface

  • 63.7% of Snapshot 1 hosts reappeared four months later, indicating exposure can persist for months while remediation can reduce it.Enphase and Contec exposure declined between snapshots; Contec SolarView monitors had been targeted by Mirai botnets in 2024.Source: §6 · p. 13

Implications and Mitigations

  • The authors recommend secure defaults and stronger authentication for vendors, restricted access and exposure testing for installers, sustained anomaly monitoring for operators, and standards reaching integrators.They note that reducing reachable management surfaces can lower CVE risk before patches propagate, while acknowledging that protection mechanisms designed for natural disturbances may not address adversarial manipulation.Source: §6 · p. 13

Implications

  • Supply-side compromise can manipulate active and reactive power, allowing impact with orders of magnitude fewer devices than demand-side attacks such as MaDIoT.The analysis uses inverters exposed today rather than hypothetical botnet populations; the authors expect the gap between Internet exposure and grid risk to widen as DER penetration grows unless deployment practices evolve.Source: §6 · p. 14

Limitations

  • The measurement covers only DERs directly reachable from the public Internet, and IP geolocation may not reflect devices’ physical locations.Scanner-visible artifacts can omit devices that obfuscate identifying information, and disclosed software versions associated with CVEs do not establish confirmed exploitability.Source: §6 · p. 14
  • The classifier’s LLM-generated training labels may contain errors; manual validation and deterministic refinement achieved 98% label accuracy.The Random Forest must generalize across a four-month gap and nearly threefold vendor-coverage expansion; word-boundary constraints reduce, but may not eliminate, coincidental brand-name matches.Source: §6 · p. 14

Future Work

  • Future work includes longitudinal exposure tracking, installer and service-provider studies, modeling additional adversarial constraints and protective mechanisms, and shorter-timescale dynamic analysis.The latter includes studying frequency instability, which remains open beyond the paper’s steady-state analysis.Source: §6 · p. 14

A Open Science

The paper withholds potentially actionable discovery artifacts while describing its methods to support evaluation and making selected analysis resources available.

A Open Science

  • The authors do not publicly release the discovery pipeline, Internet-wide queries, or host-level datasets because they could help locate and target vulnerable solar DER deployments.Selected artifacts may be shared with vetted researchers upon request.Source: A Open Science · p. 16
  • The paper provides a detailed measurement and analysis methodology to support independent evaluation despite withholding the discovery artifacts.Source: A Open Science · p. 16
  • The adversarial OPF and augmented Oahu test-case code are publicly available, while a variation of the analysis code is displayed on the companion site.Source: A Open Science · p. 16

B Ethical Considerations

The study relies on passive observation of public scan data and takes steps to limit disclosure risks while pursuing vendor remediation and broader grid-security engagement.

B Ethical Considerations

  • The study used publicly available scan data and scanner-visible artifacts without authenticating to systems or modifying device state.Potential harms include misuse of interface and software-version findings and concern among vendors and operators; a vulnerable version does not necessarily mean a deployment is exploitable.Source: B Ethical Considerations · p. 16
  • The authors aggregate findings and withhold IP addresses, credentials, and exploit details, and frame CVE findings as potential exposure rather than active exploitation.Source: B Ethical Considerations · p. 16
  • Before publication, the authors notified affected vendors about exposure trends and common misconfigurations, and report ongoing technical discussions aimed at improving deployment practices.Source: B Ethical Considerations · p. 16
  • The companion tool’s public version is planned to use a sanitized grid model preserving qualitative attack patterns, with access to the unmodified model restricted to vetted researchers.During review, the tool is password-protected and reviewer credentials are shared only with reviewers.Source: B Ethical Considerations · p. 16
  • The authors judged publication ethically justified because the research passively measures publicly reachable systems and could improve visibility into an emerging critical-infrastructure attack surface.Source: B Ethical Considerations · p. 16

C Query Construction Details

The discovery queries combine scanner-visible fields with vendor fingerprints and generic DER-related terms, using documentation and validation constraints to balance coverage and precision.

C Query Construction Details

  • Queries search HTTP titles and page bodies as well as TLS certificate subjects and service-response metadata, where device identifiers may appear.Using multiple fields addresses inconsistent branding across web interfaces and auxiliary scanner-visible artifacts.Source: C Query Construction Details · p. 16
  • Vendor-specific fingerprints use exact or near-exact matches for distinctive names, while common names require solar- or photovoltaic-context terms to reduce false positives.Generic queries instead combine recurring DER interface phrases without vendor identifiers to cover unbranded deployments, though they are less precise.Source: C Query Construction Details · p. 16
  • The fingerprint corpus is built from publicly accessible vendor manuals, datasheets, and support documents covering inverters, monitoring platforms, and hybrid systems.The text describes extracting product, model, interface, and portal identifiers from these materials.Source: C Query Construction Details · pp. 16–17
  • Extracted identifiers are grouped by vendor and consolidated through exact matching and edit-distance clustering before downstream query construction.The extraction rules cover product and model names in configuration or status interfaces, dashboard and login-page strings, and portal domains or service names.Source: C Query Construction Details · p. 17

D LLM Classification and Refinement Details

The classification process combines structured LLM screening with rules that suppress recurring false positives. Manual validation supports the accuracy of the refined dataset used for later classifier training.

D LLM Classification and Refinement Details

  • The prompt separates fixed classification logic from per-host evidence, and model screening performance was assessed by manually checking 50 positive and 50 negative predictions per model.The per-host summary uses Censys scanner-visible evidence; only that summary varies across hosts.Source: D LLM Classification and Refinement… · p. 17
  • Llama 3.3:70b retained a larger candidate set than Qwen-based models with comparable true-positive and true-negative rates, reducing 166K candidates to 67K.The larger candidate set was retained because later stages were designed to remove residual false positives.Source: D LLM Classification and Refinement… · p. 17
  • Recurring false-positive patterns, including solar-powered cameras and non-DER web infrastructure, were encoded as suppression rules before Stage 3 classifier training.The Reolink rule removes matching scanner-visible identifiers unless DER control or monitoring features co-occur.Source: D LLM Classification and Refinement… · p. 17, Table 8 · p. 17
  • Final manual validation reported a 98% true-positive rate and a 100% true-negative rate for the refined dataset.The remaining misclassification was an academic website discussing power systems that exposed an industrial protocol, which was excluded from subsequent analysis.Source: D LLM Classification and Refinement… · p. 17

E Probability Threshold Selection

The Random Forest threshold was selected at the elbow of the predicted-host-count curve. Manual sampling at that threshold yielded a 99% true-positive rate.

E Probability Threshold Selection

  • A threshold of 0.25 was selected at the curve’s elbow, where predicted host counts shift from steep decline to gradual decrease.The threshold sweep covered 0.10 to 0.90 in increments of 0.05.Source: E Probability Threshold Selection · p. 17
  • At the 0.25 threshold, a random sample of 100 hosts yielded a 99% true-positive rate.The threshold was applied with five-run consensus voting to remove hosts classified unstably across training perturbations.Source: E Probability Threshold Selection · p. 17

F Geographic Distribution of Exposed DERs

Internet-exposed solar DER hosts are distributed globally but concentrated in a few countries, with a substantial long tail. Geographic counts require caution because interface location may differ from the physical location of the underlying DER.

F Geographic Distribution of Exposed DERs

  • Canada accounted for 24.2% (16,050) and the United States for 18.6% (12,332), together nearly half of observed exposure.Figure 10 maps geolocated Internet-facing interfaces associated with validated solar DER platforms.Source: F Geographic Distribution of Exposed… · pp. 17–18, Figure 10 · p. 18
  • A long tail of 147 additional countries contributed 13.5% (8,937) of exposed hosts, indicating exposure across diverse markets and regulatory environments.The paper characterizes Internet exposure as a systemic issue and says mitigation requires changes to installation and operational practices at scale.Source: F Geographic Distribution of Exposed… · pp. 18–19
  • China accounted for 2.7% (1,777) of observed hosts; the authors suggest limited direct exposure may reflect connectivity and deployment practices.Possible factors include carrier-grade NAT, private or utility-managed networks, cloud-mediated control, and norms discouraging direct Internet exposure.Source: F Geographic Distribution of Exposed… · pp. 18–19
  • Host geolocation records the network location of an Internet-facing interface, which may differ from the underlying DER’s physical location.Cloud-hosted monitoring portals, ISP backhaul, and centralized installer infrastructure are examples given for this discrepancy.Source: F Geographic Distribution of Exposed… · p. 19
  • Exposure broadly aligns with regions with high residential and small-commercial PV penetration and installer-managed monitoring platforms.The paper links this pattern to standard deployment and management practices.Source: F Geographic Distribution of Exposed… · p. 19

G Extra Tables

Table 10 distinguishes vendors present in both measurement snapshots from vendors added in the expanded second snapshot.

G Extra Tables

  • Vendors without a dagger were included in both Snapshot 1 and Snapshot 2.Snapshot 1 included 34 vendors.Source: Table 10 · p. 20
  • The 62 dagger-marked vendors were added in Snapshot 2, bringing coverage to 96 vendors total.Source: Table 10 · p. 20

Related papers

Loading 2609.07783v2…