[Request] Alert users when "Search ID" command is received

[sebastianha]

Is your feature request related to a problem? Please describe.

Yesterday Heise reported that there is a massive security problem with more or less all Hoymiles inverters which use the DTU proprietary protocol which also is used by OpenDTU (https://www.heise.de/news/Sicherheitsalbtraum-Wechselrichter-Hoymiles-laesst-Nachbarschaften-verstummen-11357067.html). See also #3136

By sending a "Search ID" command all inverters respond with their serial number which then can be used to control the inverter.

Describe the solution you'd like

For now there is no known mitigation other than shutting down the inverter.

It would be nice if OpenDTU could listen for such events and log these. Also if reported via MQTT one could setup a alert via e.g. HomeAssistant.

This is no direct mitigation but OpenDTU users would know if they are potentially attacked.

Describe alternatives you've considered

No response

Additional context

I did not look deep into the OpenDTU source and I do not know if this is possible to implement, it would be nice if a dev could investigate if this would be possible.

PS: Keep up the good work, using OpenDTU for several years know without any problem. Thank you for the project!

[fsck-block]

Add a countermeasure feature:

If an "Search ID" command is received, answer with thousands of fake serial numbers to overload the attackers equipment.

😒 😒 😒

[octomike]

Correct me if I'm wrong, but openDTU is not the receiver of said "search ID" command, right?
The inverter's firmware is.

[jetronic18s]

Yes, the inverter responds to this command and the openDTU unit will then receive it as well

[vaterlangen]

Add a countermeasure feature:

If an "Search ID" command is received, answer with thousands of fake serial numbers to overload the attackers equipment.

😒 😒 😒

Don't know if OpenDTU would also receive it (eventually some tuning is required for this). Maybe OpenDTU could also answer with fake responses if OpenDTU receives a response that looks like someone tried to query inverters.

Edit: Flooding the air with fake responses must also respect the TX budget - that might be a limitation (without knowing the exact numbers)

[puni2k]

See my comment here #3135 (reply in thread)

From my understanding the 'Search ID' command is only an issue for inverters not communicating with a DTU.
Inverters communicating with a DTU have always been easy targets for attacks due to the lack of encryption. The issue of how these inverters react to the 'Collect RF software and hardware information' command "only" helps attackers to discover nearby inverters faster.