More impressive still, they may use the language to send telegrams to FREs that control real electric systems of their lab, the identical types which might be connected to the true Radio Ripple Control system. The video below shows the researchers stopping an actual 40 kWp photovoltaic system from feeding energy into the grid.
Photovoltaic system disconnect.
For ease, they used a Flipper Zero device that they had configured to send the right telegram to the photovoltaic system. They did this after discovering that the Flipper Zero’s RFID reading mode may very well be used to send signals modulated with frequency-shift keying to receivers inside a one-meter distance.
Credit:
Positive Security
With confidence that an attacker could send unauthorized Radio Ripple Control telegrams that instructed real electrical systems connected to the grid, the researchers got to wondering: What is the maximum amount of injury a malicious actor—most certainly one working for a nation-state—could inflict?
The researchers surveyed the grid to measure the capability of power that small- and medium-sized renewable facilities could feed into the grid. They arrived on the estimate of 40 GW. Combined with the 20 GW of load they theoretically can add, that amounted to an unbalanced capability of 60 GW, enough to power roughly all of Germany. They posited that a sudden change that added or ditched that quantity of electricity from the grid could create enough instability to take it down entirely.
Like dominoes falling over
In a broadcast summary of last month’s presentation, the researchers explained their pondering behind the estimate:
To grasp, we’d like to take a look at the grid frequency. It’s 50 hertz, and it should all the time stay there.
- If it reaches 50.2 hertz or more, interventions are triggered to cut back the availability. For instance, using the technology we’re discussing today to show off solar parks.
- If the frequency drops below 49.8 hertz, other interventions occur, comparable to activating energy reserves or disconnecting industries which have contractually agreed to this happening. Also, the primary hardware fails because it happened at Vienna airport.
- If the frequency reaches 49 Hz or less, automated stepwise load shedding begins, as much as 50% at 48.5 Hz. That may sound a bit technical and sober, but what it means for the European grid is over 200 million people without power.
- At 47.5 Hz, power plants disconnect from the grid to guard themselves from damage. At that time, the grid must be rebuilt from scratch.
In theory, with a completely loaded grid at 300 GW, making a 1 Hz change to achieve this private load-shedding threshold requires an imbalance of 18 GW. Nevertheless, such a big imbalance—though not even that massive in comparison with the 60 GW estimate—has never been seen.
In practice, some of the recent incidents was in 2021, when roughly 3 GW of power were unexpectedly lost in Poland, causing the grid frequency to drop by 0.16 hertz. What this demonstrates is that the grid hasn’t yet faced such a major imbalance.
But when we start talking about imbalances of 18 GW, or 60 GW, or much more when considering other countries, there’s a further issue besides the theoretical effect on grid frequency. That issue is power transfer.
If a major amount of power is missing in a single region, it should be transferred there over power lines that would turn into overloaded. These lines might then shut off to stop damage, which could overload other lines, causing them to shut off too.
Such a domino effect—or cascade—happened in 2006, when an influence line was shut off to accommodate a cruise ship transport. The planning wasn’t thorough, and a cascade of failures followed. So, the theoretical limits of the grid don’t fully capture the potential for much larger disruptions.
Taking all of that under consideration, it’s clear there’s enough power under radio control to cause serious trouble.
Diagram showing strategies for making a network of renewable energy sources.
Credit:
Positive Security
Send malicious telegrams to pick FREs
There are enough obstacles to make triggering such a catastrophic disruption difficult at best (Bräunlein’s and Melette’s assessment) or doubtful to unlikely (the assessment of an out of doors grid expert). The researchers noted three key requirements for such an attack.
