His Power Level is Over 9000! Vulnerabilities in Solar Panel Controllers
summary
Mobile apps are mono builds that call a native binary to compute an MD5+CRC installer password from a device serial, firmware packages sit in an open S3 bucket as encrypted .eepkg files, and the local eecrypt tool on the device decrypts them. Using Gator clips to dump the U‑boot flash, changing bootdelay to access the console, and extracting the eecrypt binary (eecrypt dump via Gator clips) yields the AES key (derived from eight shuffled blocks) and decrypted firmware, which reveals a command-injection via force parameter leading to code execution; serials are printed on box/PCB and cloud data can be falsified (examples: 900 kW, 121 GW) and an embedded VPN cert offers a remote tunnel.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:34Background
- 1:35The Enphase Home Energy Solution
- 3:16Solar Apps
- 5:00Installer Authentication
- 6:18Open S3 bucket
- 7:42Encrypted Firmware Images
- 10:54Typical Embedded Linux Boot Process
- 19:42Reading / Re-flashing SPI NOR flash (U-boot)
- 20:21Re-flashing bootloader
- 22:06eecrypt
- 24:50CVE-2020-25755 (Un-sanitized user input RCE)
- 27:21Multiple authentication issues from pam_emu.so
- 30:21Secure Key Materials
- 32:21VPN tunnel to...
- 34:42Why stop there?
related talks
35mGridlock: The Dual-Edged Sword Of EV And Solar APIs In Grid Security
44mExposing Critical Threats In Millions Of Connected Devices
41mPrison Break Season 6: Defeating the Mitigations Adopted by Android OEMs
36mOut Of The Box Exploitation Breaking The Trust Chain Of The Ethereum Phone
49mAll the 4G Modules Could be Hacked
45mOutside the box: pwning IoT devices through their applications
41mSecrets Of Simos18: REng The Secure Boot Mechanism Of An ECU
31mAnti-Forensics: Reverse Engineering a Leading Phone Forensic Tool