Gridlock: The Dual-Edged Sword Of EV And Solar APIs In Grid Security
summary
Cloud‑facing EV and solar platforms show concrete failures: API IDORs and RCEs discovered with Burp, JADX, APKLab and Shodan, demo accounts or mailinator signup used to enumerate devices, and a DigitalOcean droplet used for testing. Findings include missing auth, consecutive IDs, platform admin access, firmware‑update pipelines and backdoors into internal networks, large data troves (Growatt ~300 GB, Solax ~140 GB, others ~110–160 GB), risks to grid stability and device bricking, some vendors fix quickly (SolarMan, ChargePoint), many ignore reports.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:48Solar energy basics
- 5:51Grid risks from solar APIs
- 8:20API vulnerability research
- 10:03Photovoltaic API findings
- 13:52Vendor disclosure failures
- 17:41Growatt’s API flaws
- 21:12Solax’s platform flaws
- 22:14EV charger security
- 23:17EV charger vulnerabilities
- 25:23Spanish EV charger flaws
- 26:49UK charger ban and Pi flaws
- 28:37ChargePoint’s GraphQL exposure
- 30:00Legal and ethical considerations
- 30:43Recommendations for clients
- 33:35Network isolation best practices
- 34:17Q&A
- 35:00Closing remarks
related talks
53mCybersecurity of SmartGrid
31mProtecting the Attack Surface and Data Silos of an EV Charging Network
21mCritical infrastructure and IoT: How to harden what you can’t replace
40mHis Power Level is Over 9000! Vulnerabilities in Solar Panel Controllers
16mCAUTION: HIGH VOLTAGE, LOW SECURITY – A Familiar Tale of...
01h 00mHack to the Future
26mHacking buildings: Security flaws in embedded building control systems
17mHotWire: Real-World Impersonation and Discharge Attacks on Electric Vehicle Charging...