The energy transition, the rise of renewable energy and the promise of electrification represent such a profound transformation that it is not without risk. Nor its facilities. This is what comes out of it To see wind and sunCreated by Modat Magnify, in collaboration with Bouke van Laethem from the National Cybersecurity Center (NCSC-NL) in the Netherlands. Analyzing the European Union and candidate countries and EFTA, the researchers identified more than 8,000 interfaces without the necessary security measures, which belong to open renewable installations on the public grid. It’s a worrying picture that highlights the huge risks facing the European energy panorama.
And Spanish too. The study also indicates that Spain integrates almost one in three open solar park systems identified in the countries studied. Although this conclusion does not mean that all of them have been violated, the number concentrated in our country is noteworthy.
What does the data say? Internet intelligence and cybersecurity platform Modat Magnify scanned wind and solar farms in 35 countries and identified 8,547 exposed systems, more or less accessible from public networks. According to the Efe report, the solar park has 7,942 interfaces and 605 wind farms that are vulnerable to varying degrees: “Some are management interfaces for a single turbine. Others are located at higher levels and control several turbines or even an entire farm from a single screen,” the study indicates.
The Spanish case. The study also highlights that 2,766 systems associated with Spanish solar installations are also accessible from the Internet. They represent about 35% of detected, one in three, and put Spain at the top of the list in the solar category, while Germany and Italy lead the weak in wind power.
Sofian El Yadmani, founder of Modat and one of the authors of the study, attributes this fact to the size of the Spanish renewable park and the amount of its solar installations. According to the Moncloa.com website, this will also be explained by the dispersion of suppliers, the rotation of technical personnel and the accelerated growth of installed capacity.
Passwordless system. According to El Yadmani’s statement reported by Efe, through these cracks a wind turbine can be stopped, restarted, restarted… only with an internet connection, since they are accessible from public networks without adequate security. “Some of these panels were without any kind of authentication or protection,” the researcher explained.
Indeed, in research they demonstrate how they reached industrial regulators that dictated machinery and allowed certain processes to be physically controlled; Also how they were able to access the web interface of a turbine and from there consult in real time the power it produced and its location.
Being exposed does not mean attacking. The study, while it emphasizes the vulnerability of some facilities, also makes it clear that just because they’re disclosed doesn’t mean they’ve been attacked or that someone has accessed them. That is, it does not automatically translate into 2,766 cyber attacks in our country. The study counts digital interfaces and systems, not independent installations.
As EFE explains, if an attacker manages to access these systems, the impact can affect the entire country. Therefore, both Modat and NCSC-NL recommend removing these administrative interfaces from the public network and controlling potential access by suppliers and external companies, as well as manual control of industrial systems in case of an incident.
big unknown. But there is no reason to believe. On the one hand, the study highlights that it is difficult to know how many systems are actually exposed. The statistics they offer indicate only those that have been safely attributed to a particular installation, but the researchers make clear that there will be many more vulnerable systems that cannot be linked because there is not enough information.
Picture | Casper Ray
In Xataka | A cyberattack overturned French supermarket refrigerators and another affected European chains.
