I forgot to respond to this sentence in the sibling response.
Supply chain attacks can be executed by intermediaries of the supply chain, or by manufacturers themselves: develop the capability to deny a foreign nation its energy infrastructure. The manufacturer is not a hacker in a basement. Manufacturers can be pressured by their local gorvernments, militaries, 3 letter agencies, ...
A precautionary principle would induce potential target nations to surreptitiously catalogue the inverter boards, sort them by most-GW serving type, and consider which control traces to cut to control the internal energy transfers in its inductors, capacitors, ... from a trusted parasite board. Just develop and test a few parasite boards for the most common inverters, and preferably have critical stock ready.
The main value in inverters is the power switches, inductors, capacitors, ... it would be cheaper to reroute the control to a trusted controller in the event of a calamity. We would survive fine, but it will be a painful few days.
I was responding to:
> With a hardware switch, none of that malware will survive a reboot of the device.
A reboot of the inverter would not prevent a supply chain attack using MPPT measurement electronics for an optical backdoor channel.
The hardware backdoor channel is present anyway because MPPT needs it.
The software can abuse the measurements to listen for optically transmitted commands.
