FBI warns of Solar System Cyber Threat

[ThaiTaffy]

I feel like PFSense is great but there seems to be a bit of a learning curve to it. I've set up so many routers, port forwarding, the firewall rules to make it work, etc etc, but for some reason I've fought my PFSense box a little bit on it. I also have not sat down for more than 5 minutes to tinker with it either, but it seems a little less straightforward than most others I've dealt with, for some reason.

Maybe I'm just rusty since I've been out of that world for a few years. Amazing how quick some stuff fades when you're not working with it day in and day out.

I started with pfsense then moved to opnsense you would think that two systems built on freebsd by exactly the same initial developers would be practically the same but opnsense had a different way of building firewall rules, took me ages to get used to it. Now days I only log into it for updates, the odd addition to the static IP tables and to copy and paste a firewall rule to update something so I've practically forgotten everything.
It works so I leave it be, any issues with things on the network or access points are typically fixed with the age old trick of switch it off and on.

 

[padom]

I started with pfsense then moved to opnsense you would think that two systems built on freebsd by exactly the same initial developers would be practically the same but opnsense had a different way of building firewall rules, took me ages to get used to it. Now days I only log into it for updates, the odd addition to the static IP tables and to copy and paste a firewall rule to update something so I've practically forgotten everything.
It works so I leave it be, any issues with things on the network or access points are typically fixed with the age old trick of switch it off and on.

And this is why we use Arista NGFW (formally Untangle) it is much much more user intuitive and the reporting is leaps and bounds better than PFsense and OPNsense....

 

[ThaiTaffy]

And this is why we use Arista NGFW (formally Untangle) it is much much more user intuitive and the reporting is leaps and bounds better than PFsense and OPNsense....

I'm reliant on zerotier which untangle/pfsense didn't support but as far as reporting I've found zenarmor pretty good, also I'm a cheapskate so paying for features is a big turnoff for me guess being a napster child ruined my ability to pay for software even my windows licences typically are $3 asian ones.

 

[shavermcspud]

I don't use a private VPN as many would associate the word VPN with, mine is just a secure encrypted connection from point a to point b it's also open source and free it's called zerotier if your interested I just flip a switch on whatever device I'm using IE phone/tablet/laptop and then I'm technically on my home network.

Edit: I should add you need a router that can enable a zerotier connection pfsense did not but opnsense/openwrt does.

This is still a reverse tunnel, like Tailscale and many others, you are still trusting the endpoint security to a third party. if they get compromised so do you. the only real way is your own P2P VPN direct from one device to another device end point or your router.

 

[shavermcspud]

I don't use a private VPN as many would associate the word VPN with, mine is just a secure encrypted connection from point a to point b it's also open source and free it's called zerotier if your interested I just flip a switch on whatever device I'm using IE phone/tablet/laptop and then I'm technically on my home network.

Edit: I should add you need a router that can enable a zerotier connection pfsense did not but opnsense/openwrt does.

This is still a reverse tunnel, like Tailscale and many others, you are still trusting the endpoint security to a third party. if they get compromised so do you. the only real way is your own P2P VPN direct from one device to another device end point or your router.

 

[padom]

This is still a reverse tunnel, like Tailscale and many others, you are still trusting the endpoint security to a third party. if they get compromised so do you. the only real way is your own P2P VPN direct from one device to another device end point or your router.

Agreed. This is why we stay away from these services and run P2P Wireguard tunnels.

 

[ScrotpusGobbleBottom]

n the Apple ecosystem, they ARE your overload, and you WILL bow the knee and worship the almighty half-eaten fruit.

There are no earthly exceptions to this.
Aside from not eating said rotten apple.

 

[ThaiTaffy]

This is still a reverse tunnel, like Tailscale and many others, you are still trusting the endpoint security to a third party. if they get compromised so do you. the only real way is your own P2P VPN direct from one device to another device end point or your router.

P2P would require a static IP or some DDNS service which brings it's own security issues I understand I rely on zerotiers endpoint but its end to end encrypted so if zerotier cant access my data I'm unsure how others can.

 

[shavermcspud]

Agreed. This is why we stay away from these services and run P2P Wireguard tunnels.

I still use Tailscale for non critical uses as its easy and fast to deploy, but I also have a dedicated roll your own VPN to my pfsense router with my own certificates. that's probably about as safe as you can get.

 

[shavermcspud]

Agreed. This is why we stay away from these services and run P2P Wireguard tunnels.

I still use Tailscale for non critical uses as its easy and fast to deploy, but I also have a dedicated roll your own VPN to my pfsense router with my own certificates. that's probably about as safe as you can get.

 

[shavermcspud]

P2P would require a static IP or some DDNS service which brings it's own security issues I understand I rely on zerotiers endpoint but its end to end encrypted so if zerotier cant access my data I'm unsure how others can.

Not sure how mapping a dynamic IP address with a DYN provider is insecure, there is no routing done, its just a DNS updated frequented by a changing IP address. Regardless your WAN IP, be it static or Dynamic is available for all to see unless CGnat'd. You are forgetting, the connection you think is secure with Zerotier is only as strong as their end. the tunnel is initiated on a trust basis, if someone were to have your credentials for zerotier, they could also easily add their own end point and then access to your local network at home

 

[SparkyJJO]

I do use a DDNS service but that's just because when my ISP changes my IP randomly it becomes a pain. It rarely changes, but when it does, it is bound to be at the most inconvenient time.
I know I know, convenience vs security, blah blah. i weighed options, made my choice. Shove off lol. My DDNS name isn't going to show up under anything of any importance, it'll barely be any more exposure than my public IP is, so whatever.

 

[padom]

DDNS is no different than DNS. Both are a name tied to an IP.

Only difference, DNS is tied to a static IP, DDNS uses an updater to update the IP tied to your DDNS address.

This is not insecure...

 

[ThaiTaffy]

Not sure how mapping a dynamic IP address with a DYN provider is insecure, there is no routing done, its just a DNS updated frequented by a changing IP address. Regardless your WAN IP, be it static or Dynamic is available for all to see unless CGnat'd. You are forgetting, the connection you think is secure with Zerotier is only as strong as their end. the tunnel is initiated on a trust basis, if someone were to have your credentials for zerotier, they could also easily add their own end point and then access to your local network at home

Maybe I'm wrong in thinking it but giving yourself a public DNS entry or a static IP means you have a fixed address for someone to constantly probe? As far as zerotier credentials I see your point it's a bit warden password in my case but I should change it more often. Though if I wanted to make it more secure I could limit the zerotier access on my home network to purely my home assistant instance which would mean another password and 2FA but even if I didn't everything that zerotier would be able to access is behind individual bitwarden passwords atleast but most have 2FA also.

 

[SpongeboB Sinewave]

Can we find the actual FBI warning ? Maybe I missed it in the link but it was a very short article and I saw a bunch of NON-relevant links to solar panel scams and such.

One of the vulnerabilities that they might be talking about would be the Rule 21 and Rule 14H battery grid tie communications where the utility can tell your inverter to "ride-through" a brownout to help the main grid to recover from renewables when clouds come by, etc.
But that system which I think is overseen by IEEE and Sunspec is being fairly well thought out to prevent hacks from others.

But maybe they are talking about something else ? Like internet connected systems like Tesla Powerwalls and the like ?

boB

 

[ksmithaz1]

I do networking for a living.I have Fortinet, Palo Alto, Juniper, Cisco, blah,blah. My biggest gripe with all these devices is that they insist on Wifi, because the simplest thing to block access is to unplug the ethernet cable, only there isn't one, the run on Wifi.

I live in a neighborhood, and the houses are NOT on top of each other.. My system has identified a ton of Rogue AP's. If you let Cox (for example) set one of their modems on your network, it will grant access to anyone with a Cox account by default. Below SETUP-5380, and the two BAxxxx devices are actually mine. These wifi devices should have a host/client hardware switch for starters. Secondarily, I have no way of stopping them from globbing on to some open or otherwise available access point on it's own and sending traffic thru someone else's network, and I would have no reasonable way to know. OTOH if it's a wire, I can do whatever I want to allow/block traffic.

 

[ksmithaz1]

If you are on wire you can guarantee your efforts will work. Even on Wifi, It's generally easiest to assign or hard code the IP address for the device in question and simply create a rule blocking outbound for the device. With Wifi make sure the device is not using a floating mac address, and assign it trivial on every cheapo router I've ever dealt with. I had some camera's:


That liked to phone home. I actually blocked everything that desired to use the iLink service. It's easy enough to build a rule as granular as you want on even many of the cheap firewalls, just create a rule <ip of device> to <0.0.0.0/0> dis-allow.

Most of the more modern cheapo firewalls will let you leave the rule and allow you to disable/enable it, so if you needed it to get out for maintenance, you disable the rule, do what you gotta, then re-enable the rule.

VLANS and all that is a little overkill for a home network. I run about 4 VLANS, but I have a complex setup with multiple ISP's and failover, and I'm running some of the external lans over the same switch gear, because I do a lot of testing and cruft, with multiple IPSEC and, BGP, and ...\

Summary: Force the gear onto a specific IP address with a MAC assignment or code on the device. Put a rule on your firewall to control that IP. Don't over-complicate it.

 

[padom]

If you are on wire you can guarantee your efforts will work. Even on Wifi, It's generally easiest to assign or hard code the IP address for the device in question and simply create a rule blocking outbound for the device. With Wifi make sure the device is not using a floating mac address, and assign it trivial on every cheapo router I've ever dealt with. I had some camera's:

View attachment 229810
That liked to phone home. I actually blocked everything that desired to use the iLink service. It's easy enough to build a rule as granular as you want on even many of the cheap firewalls, just create a rule <ip of device> to <0.0.0.0/0> dis-allow.

Most of the more modern cheapo firewalls will let you leave the rule and allow you to disable/enable it, so if you needed it to get out for maintenance, you disable the rule, do what you gotta, then re-enable the rule.

VLANS and all that is a little overkill for a home network. I run about 4 VLANS, but I have a complex setup with multiple ISP's and failover, and I'm running some of the external lans over the same switch gear, because I do a lot of testing and cruft, with multiple IPSEC and, BGP, and ...\

Summary: Force the gear onto a specific IP address with a MAC assignment or code on the device. Put a rule on your firewall to control that IP. Don't over-complicate it.

The main reason we use vlans as you know is so you can group devices and create different policies and rules for each vlan without having to do this for lots of devices individually.. that would be a complete nightmare.

I'm running 6vlans, 2 fiber and 1 5G WAN, failover, multiple IPSEC and wireguard tunnels, ESXI with lots of various VMs and 100s of devices.

This isn't typical home setup I agree.

But a few vlans like a main/mgmt network, IoT and Guest network with a different policy or rules for each, like block all Non-WAN for starters is appropriate.

We don't run any ISP modems or routers at any of our residential clients (these are high end multi million dollar homes). They are all fiber or Copper direct connections from the ONT to our firewalls and most have a 5G WAN failover.

Residential isn't our business but we do a few

 

[ScrotpusGobbleBottom]

Seems like this guy saw it coming.

 

[ScrotpusGobbleBottom]

Can we find the actual FBI warning ? Maybe I missed it in the link but it was a very short article and I saw a bunch of NON-relevant links to solar panel scams and such.

i agree, where is it

 

[DPC]

Seems like this guy saw it coming.

This guy saw it coming too lol

 

[ksmithaz1]

The main reason we use vlans as you know is so you can group devices and create different policies and rules for each vlan without having to do this for lots of devices individually.. that would be a complete nightmare.

I'm running 6vlans, 2 fiber and 1 5G WAN, failover, multiple IPSEC and wireguard tunnels, ESXI with lots of various VMs and 100s of devices.

This isn't typical home setup I agree.

But a few vlans like a main/mgmt network, IoT and Guest network with a different policy or rules for each, like block all Non-WAN for starters is appropriate.

We don't run any ISP modems or routers at any of our residential clients (these are high end multi million dollar homes). They are all fiber or Copper direct connections from the ONT to our firewalls and most have a 5G WAN failover.

Residential isn't our business but we do a few

For a home user, ... Getting into managed switching (Maybe we could create a vlan with 802.1x for wired, create an essid for my IOT stuff, control it by mac on the wifi controller, then, ....) is going to send most folks into a spiral. At home you would have your Netgear, Linksys, or built-in provided by comcast/cox/whoever device. It is doubtful you would have over 10 or so devices. Just add them by mac, assign them IP's If you want to get a little more grouping, set aside a reserved block for your IOT devices, and create rules for the space. This requires general knowledge of IPv4, and dhcp

For example If your space is (gag) 192.168.1.0/24 (aka 255.255.255.0) and your gateway is 192.168.1.1 change your dhcp scope to assign 192.168.1.64-191. Assign all your controlled devices manually or via assignment to 192.168.1.192-254 and make the rule for the upper block.

IP: 192.168.1.192/26 (or mask 255.255.255.192) deny to 0.0.0.0/0

1 House 1 netblock (/24, 250 addresses) the last 60 odd addresses are not allowed out. KISS. If your a network geek or very savvy, get some higher end gear and get happy. Move devices automagically via layer 2 to the correct VLAN via 802.1X or whatever, and set up a layered access scheme to the various resources you have. I think most people just want to be able to get to the device to manage it and not allow it out to phone home without explicit permission. I could be wrong. I'm lucky if I can get my dad to not open malicious email, and he gets p*ssed if the Roku doesn't work. I don't want to own a VLAN setup at his house.

 

[Rednecktek]

You'd be surprised that hackers have actually managed to gain access to air gapped networks/offline systems but most of the time its valuable stuff and takes a lot of work like sending data through power supply frequencies not something a solar enthusiast should worry about atleast for now untill quantum computers become more mainstream.

Well, my camp is currently shut down soooo....

Breaker from utility to cabin open? Check!
Breaker from source (pump house where utility comes in) to main panel in cabin open? Check!
Breaker built into battery open? Check!
Breaker from DIY battery to inverter open? Check!
Inverter turned off? Check!
Coms cables NOT installed? Check!
WiFi dongle on inverter NOT installed? Check!

OK Hackers, bring it!

 

[BarracudaBob]

Well, my camp is currently shut down soooo....

Breaker from utility to cabin open? Check!
Breaker from source (pump house where utility comes in) to main panel in cabin open? Check!
Breaker built into battery open? Check!
Breaker from DIY battery to inverter open? Check!
Inverter turned off? Check!
Coms cables NOT installed? Check!
WiFi dongle on inverter NOT installed? Check!

OK Hackers, bring it!

You are ready for the Solar CME!

 

[ThaiTaffy]

Can we find the actual FBI warning ? Maybe I missed it in the link but it was a very short article and I saw a bunch of NON-relevant links to solar panel scams and such.

One of the vulnerabilities that they might be talking about would be the Rule 21 and Rule 14H battery grid tie communications where the utility can tell your inverter to "ride-through" a brownout to help the main grid to recover from renewables when clouds come by, etc.
But that system which I think is overseen by IEEE and Sunspec is being fairly well thought out to prevent hacks from others.

But maybe they are talking about something else ? Like internet connected systems like Tesla Powerwalls and the like ?

boB

I did a little searching and the only thing I could find was this https://industrialcyber.co/threats-...eats-to-expanding-us-renewable-energy-sector/
seems to be a private industry notification sent out some time late june.

Other sources are saying the FBI and researchers are trying to design a passive sensor to warn them of any issues with residential grids( seems the FBI want to fit a "sensor" to protect your community) the little info on this can be found here https://www.utilitydive.com/news/fbi-cyber-threat-renewable-generation-microgrids-dragos/720509/