DEF CON 33 - Rebadged, Relabeled, Rooted: Pwnage via Solar Supply Chain - Anthony Rose, Jake Krasnov
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 32:35
The video reveals critical security flaws in solar microgrid devices, highlighting opaque supply chains and vulnerabilities that allow remote attacks on power generation. Key vulnerabilities include unauthenticated Modbus communication, firmware that lacks authentication or integrity checks, and hardcoded credentials enabling full device control. These flaws enable attackers to brick devices, disrupt power supply, or gain access to sensitive data.
• Rebadged devices like EG4 (a rebrand of Lux Power) use identical code and Chinese debug comments, exposing supply chain opacity 14:24-15:24.
• Devices expose serial numbers and default credentials, allowing enumeration and account takeover without authentication 19:15-20:45.
• The TGO Cloud Connect Advance has a covert backdoor in its network API that enables remote code execution and denial of power generation 25:09-29:15.
• Solar inverters and monitoring systems are often directly exposed to the internet, with firmware updates controlled remotely by manufacturers 31:40-32:18.
These vulnerabilities demonstrate a systemic failure in solar security, where rapid deployment outpaces security design. Manufacturers often obscure supply chains and reuse unsecured Chinese software, with little transparency or accountability. The findings urge stronger oversight, better supply chain visibility, and mandatory security standards for solar infrastructure.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
As our speakers, we'll have Anthony Rose aka Korn and Jake Kranov aka Hubble. They'll be presenting on Rebadge, Reabeled, and Rooted. Let's go. >> Cool. >> Welcome everyone to our talk on rebadged, reabeled, and rooted. We're going to be talking about hacking the solar supply chain. Uh just a quick introduction, I'm Hubble. I also go by Jake. Um, my background was in astronomical engineering, uh, where I was in the Air Force doing missile testing stuff and I walked in one day at a fighter test squadron and they said, "You're our new cyber expert." And that's where I met him. Um, this is Anthony. Uh, but after that, I went to the 57th Information Aggressor Squadron where I got to do offensive security operations emulating like uh, Russian and Chinese threats um, for cyber, which was really …