billcarson avatar image
billcarson asked

Victron Ecosystem vulnerable to hackers?

as you have probably heard, the influential think-tank "world economic forum" is "concerned" about a "next pandemic" but this time it might will be a cyber-pandemic, as they say. they don't go deeper into the ins and outs of this, as it would feed conspiracy theories, but my concern with the victron ecosystem in this regard, is that VRM is not usable locally, or is it?

I mean I get it, one can use victron-connect, and wait around for values to populate, but real efficient telemetry you only get via the VRM portal, which is afaik "online-only". how is this, and why is this?

can we get ethernet only functionality with VRM? there are some privacy conscious people in your userbase, how do they monitor their systems without having to send all data to centralized vulnerable external servers first?

is there a workaround for this? I don't need online connectivity to my systems, it is neat, but too dangerous given the track record of the WEF with pandemic predictions and such.

so my question: can I use VRM via ethernet only and shun it from access to the internet?

system integrationethernetsafety
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

4 Answers
Guy Stewart (Victron Community Manager) avatar image
Guy Stewart (Victron Community Manager) answered ·

Hi @billcarson

I am proud to say that Victron is one of the first companies that I have ever worked for that has felt secure, takes IT security seriously, and gives the necessary time and resources to stay on top of it.

A big reason for this is that the owner, Matthijs Vader has a personal working knowledge of software and IT systems. It's not an afterthought, or something left until it goes wrong. It's an integral part of the development, release and maintenance processes.

We have a very strict internal permissions system, which has only gotten more restrictive over time. I have less access and control today than I did in years past, with my admin privileges now mostly limited to this Community. Someone compromising my accounts would not yield them very much, besides embarrassing me.

As an example I can no longer even independently publish Victron manuals and documentation any more, as that process has been improved for quality control and consistency, but also as a side effect now has a clearer chain of custody and control.

Generally we have regular penetration tests, that independently test the computer systems themselves, but also the social attack vectors, which are also a common weakness. When weaknesses are found, we receive firm guidance and training.

I don't want to go into TOO much detail because Victron is a target, and we are subject to attacks, but I think that one thing working in our favour is we aren't an extremely high value target, at least not the specific IT systems that manage peoples power systems.

There would be some notoriety for a hacker, and we really do take it super seriously because we believe power systems are critical importance and value user trust, but in terms of an attacker extracting a financial return for the efforts required, there are many many easier targets (see for example).

I have seen some novel features for VRM held back for many months to give enough time for the security researchers to properly understand their security implications.

Indeed right now we'd love to expand beta testing for the next generation of remote console, but won't until everyone in the chain is confident in its security. Not to say all will always be perfect, we are writing new code to provide remote access after all, but it isn't something that is rushed or ignored.

Now on to your proposal, there are solutions today such as grafana that can be run locally right now without requiring an internet connection.

They leverage the existing software stack of MQTT and then allow a seperate and quite independent system to ingest that and make it workable. This is very useful, and also very lightweight to support from Victron's perspective.

The reason for not having a verbatim version of VRM itself running locally is ironically because that would take the focused and single platform oriented team that currently develops VRM and then require them to grapple with an entirely new set of requirements and restrictions - it's not feasible, and whenever we've come close to attempting it, everyone (customers included) balk at the costs that would be involved.

VRM itself is something of a fortune of the commons, there are so many users that the massive development and maintenance costs can be spread out to reasonable numbers, and justified.

There aren't nearly the same number of people demanding onsite service, so the significant development costs and opportunity cost of focus remain very very large per user.

If you're still concerned, there are some additional practical steps you can take to harden your Victron system outlined here -

2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

uguraladag avatar image
uguraladag answered ·

Using a smartphone, a computer or any device connected to the internet will be enough to get hacked. You cannot live with such suspicions, if you stay away from all of them, you will not have any problems...The choice will be yours...I wish you a carefree, fearless year, love...

1 comment
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

jestron avatar image jestron commented ·

"any device connected to the internet will be enough to get hacked" - well, but may be not as relevant as shutting down otherwise power systems designed for resilience. I would take the concern more seriously - so, think before you type?

-2 Likes -2 ·
billcarson avatar image
billcarson answered ·

your advice is not to worry? how about victron gives us ethernet only functionality instead? if the device (cerbo gx in this case) can be configured to be accessed only locally, hackers have no way in. pretty simple. it's not just hackers though, the data out in the open on centralised servers is a privacy nightmare as well and might be abused by totalitarian governments, victron should allow us to opt out of this scenario by technical means.

2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

kenzo avatar image kenzo commented ·

What functionality exactly are you talking about that Victron forces you to use, that will require you to send any data to the Internet?

You don’t have to enable VRM logging, neither two way communication or support reverse tunnel. Please compare Victron‘s technical approach with what those famous Chinese vendors deliver. After watching, I reviewed VRM two way communication and must I’m very pleased about how Victron approached this - you cannot misuse anything here afaics, since there’s no service started that could be misused if that setting is off - no half-baked solution, but well designed and executed.

For those who cannot use VRM but want comparable functionality, Victron provides

Do you have any actual examples that are of real concern to you?

1 Like 1 ·
Fideri avatar image Fideri commented ·


I agree. It can be done but it's complex. A simple switch would be better. Though in my particular situation, being offline would defeat the purpose.


0 Likes 0 ·
Jeremy Albrecht avatar image Jeremy Albrecht commented ·

Your request doesn't make any sense. Ethernet is just the technology used to connect a device to a network via cable. I assume you probably mean local only access, which you have by disabling VRM. If you're asking to be able to access VRM from only your local network, then that's impossible as VRM is a cloud service. It isn't running on your local device, it's running on Victron's servers.

As someone who has worked in IT security for over 2 decades compromise of my Victron/VRM data is one of my smallest concerns.

0 Likes 0 ·
madcodger avatar image
madcodger answered ·

An add-on question, please, just to clarify:

Can the CerboGX provide essentially the same DATA (without the graphing, etc,) as we see using VRM, but just locally, "on-screen"? I currently use Venus on a RPi but am considering adding a Cerbo for my next build. If I can see the system data without an internet connection, that would be an added incentive to add a Cerbo. Thanks.

2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

Related Resources

Additional resources still need to be added for this topic