512-bit RSA key in home energy system gives control of "virtual power plant"

Ryan Castellucci recently discovered a significant security vulnerability in GivEnergy's home energy management system, which allowed them to gain unauthorized access to a virtual power plant with 200 megawatts of capacity, enough to power approximately 40,000 homes. This access was achieved through a 512-bit RSA key used for authentication, which Castellucci was able to factor for just $70 in cloud computing costs within 24 hours. The vulnerability stemmed from the use of an outdated cryptographic key size, which is considered insecure. GivEnergy quickly addressed the issue after Castellucci disclosed it. The incident highlights the risks associated with relying on third-party code libraries that may include insecure cryptographic options. GivEnergy acknowledged that the problematic encryption method was inherited from a third-party library used during their early development stages when the company had limited resources and expertise. The situation underscores the importance of regular security reviews and updates in software development.

- Ryan Castellucci exploited a 512-bit RSA key vulnerability in GivEnergy's system.

- The breach allowed control over 200 MW of energy capacity, equivalent to powering 40,000 homes.

- GivEnergy fixed the vulnerability within 24 hours of disclosure.

- The incident emphasizes the risks of using outdated cryptographic standards.

- GivEnergy's response highlights the need for ongoing security assessments in software development.