Security and Monitoring of Sofar HYD 6000-ES Inverters for yourself - an investigation

 A friend has a Sofar HYD 6000-ES hybrid PV inverter installed, and I was interested in

1. The possible security implications of its nominal WiFi/Internet connection
2. How to get the logging data directly into one's own software and bypass the "cloud" which is located in China!

Security Issues

In respect of the first point, this webpage has some interesting insights viz. the Access Point (AP) interface remains active even when you've configured it as a Station (STA) to access your home WiFi, including the following interfaces, according to the article:

1. 53/UDP, DNS
2. 80/TCP, HTTP
3. 8899/TCP, Datalogger Info
4. 48899/UDP, HF AT Interface

Depressingly, the article shows how easy it is to hack the passwords from copies of the firmware :-/, so given the importance of the kit, it's probably good to take some remedial action.

Possible actions:

1. Access Point access: The configuration screens allow for the SSID to be hidden, which at least prevents casual detection/connection, although obviously not for a proper hacker
2. DNS: Article doesn't address this, might be worth investigation, not sure what DNS operations this might support, although I guess it will just provide DNS function for devices connecting to the AP
3. Web interface: I think the most important, and probably simplest, thing is to change the interface user/password to a non-standard value, probably documenting it on the inverter front panel with some printed labels (I love printed labels!!).
4. Datalogger Info: This is the datalogging interface, apparently "from a security perspective this service is not terribly interesting"!! It presents an interface from which inverter performance data can be extracted, of which more later.
5. HF AT: This is a potentially interesting vulnerability - it potentially exposes lots of scary functions, including 
1. Upgrading firmware of WiFi interface
2. Getting / Setting Wi-Fi configuration data (including keys)
3. Getting / Setting service (eg. web server) credentials
4. Getting / Setting 'user' configuration (device-specific info)
5. Setting GPIO pin status
6. Navigating to URLs in a proxy-like fashion
   
7. "User" functions which potentially include upgrading inverter firmware!

Unfortunately "The only protection for this service is a 'password' which doubles as the network discovery string. The password is hardcoded in the firmware and cannot be changed and since it is part of the discovery protocol it cannot be considered confidential." Urgh. Basically, since this is an AP, it's accessible regardless. The only real remedial action is to use the alternative Ethernet interface, which at least can't be accessed without physical intervention. 

Data Monitoring

There are quite a few examples for this - I'm looking for Python examples:

• Omniksol-PV-Logger - Python
• https://github.com/Woutrrr/Omnik-Data-Logger - Python
• http://www.mb200d.nl/wordpress/2015/11/omniksol-4k-tl-wifi-kit/ - C, but quite clear!

None of this is particularly complicated, I think if I were looking to do this I'd use an adapter to the EmonHub software running on an RPi, so that would collect all the data and provide lots of useful analysis.

The most recent Sofar firmware lets you add up to two additional destinations for data delivery, so just add the installed EmonHub on the local network. The more interesting thing is to prevent the inverter sending stuff to the SolarMan.cn cloud site, I guess you'd have to sort out a firewall setting or other, probably on the wireless router.

Alternative Monitoring Options

This GitHub site has a C++ library which runs on an ESP8266 connected to your local wifi, and the RS485 S output of the inverter to publish lots of additional data over MQTT. Since it is reckoned to work with Sofar HYD...00ES I'd look at this to either add Battery status info to the Python stuff, or just hack this into the inverter and remove the need for a security problem like the official WiFi interface!

Or there's this which uses an RS422/485 - USB interface connected to an RPi which sends data to an instance of EmonHub. This is just a script that has to be run every n seconds, currently run inside nodeRed. That could easily be changed to just loop. It could also in principle run on an ESP8266, if we can get the RS485 interface to work from that. Excellent.

So it looks like there are lots of home-brew options, and many possible interface devices e.g. NodeMCU (ESP8266), RPi 0 and so on. 

Another Wrinkle...

It turns out that owner of HYD 6000-ES actually wants to use the SolarMan.cn site because the installation engineer can monitor it from there if there are any problems. Hmm. Secure options for that are

• Install an Ethernet interface, rather than a WiFi one, on the basis that it isn't accessible 
• Install an RS485-attached wifi-enabled device e.g. ESP8266, that translates the ModBus data into the proprietary SolarMan format, sends it to SolarMan and also records it locally

I suspect the latter is more likely, as there don't seem to be any LSE-3 (the product name apparently) examples for sale. It will probably be a bit fiddly getting the proprietary format to work, but it's been reverse engineered so should be doable. 

For myself, I doubt the engineer will be able to do much over the cloud link, I don't think the SolarMan app allows any configuration changes, and it certainly wouldn't if the reverse channel wasn't available. 

More Discoveries

Reading the dongle manufacturer's manual, it appears that there may be the possibility to turn off the AP function using the configuration screens, or the AT command interface. In that case, maybe it'll be ok to do that - at least the open system access to anyone walking past with a laptop will be prevented!