EV charging security is a shit show

The growth of electric vehicles on the road means we need more EV charging stations. But research this month has raised a big old red flag regarding the security of electric vehicle charging. Researchers from Pen Test Partners explored six home electric vehicle charging brands and public EV charging networks and found significant problems. 

They found vulnerabilities in Project EV, Wallbox, EVBox, EO Charging’s EO Hub and EO mini pro 2, and Hypervolt, as well as the public charging network Chargepoint. They also examined EV’s Rolec but found no vulnerabilities. 

All hail the white hat hackers

You’ve got to love white hat hackers. They work tirelessly to find vulnerabilities before the bad guys do. Unbelievably the company they’ve found fault with often only acknowledges their efforts after media reporting. 

For home charging, smart EV chargers allow the car owner to remotely monitor and manage the charge state, speed, and timing of their car charger via an app. The mobile apps all communicate with the charger via an API and cloud-based platform. The chargers are usually connected to the owner’s home Wi-Fi network. 

The researchers found a range of vulnerabilities. They could hack the accounts of millions of EV chargers. In some, they could overtake accounts and turn remote control charging on and off.

In another, they could use the charge point as a remote ‘back door’ into the user’s home network, from where we could potentially compromise further devices in the user’s home. Specifically, no flaws were confirmed with Hypervolt other than that an RPi ‘could’ be vulnerable. No remote flaws or vulnerable endpoints were found.

Some of the chargers had gone old school by using a Raspberry Pi Compute Module. The Pen Testers note:

We love the Pi, but in our opinion, it’s not suitable for commercial use in public devices as it is very difficult to fully secure it against the recovery of stored data.

They do however note:

the risk of compromise seems low, given the need for physical access to the charger.

In the case of the public EV charger, they believe it would be possible to access another user’s account for a free charge. They also note a potentially bigger issue of destabilizing the grid by switching simultaneously switching charges on and off: 

While our power generators make huge efforts to maintain stability, these powerful chargers and security flaws combined have inadvertently created a cyber weapon that others could use to cause widespread power cuts.

Not the first rodeo for EV charger woes

This research is not the first example of security vulnerabilities in EV charging. 

In 2019, security researchers found security vulnerabilities in Schneider Electric’s EVlink Parking charging stations. Hackers could stop a car from charging and prevent anyone else from using the charger. A malicious actor could even unlock the cable while charging. Then, they could walk away with the cable. There was also plenty of opportunities to gain full privileges, add users, change files, and more.

Last year engineers at Southwest Research Institute simulated a malicious attack on an EV charger with a purpose-built spoofing device made with cheap hardware and simple software. Researchers could limit charging costs as well as overcharge and undercharge the battery — the latter could result in big safety problems. But fortunately, the battery management system was able to detect the overcharging and disconnect.

Don’t EV customers deserve better?

We know about all these problems due to the mighty work of researchers. But hacking is a genuine threat in an industry that’s scaling rapidly. Worse, the industries collectively fail to learn from the legacy shit show that is IoT security. 

Beyond controlling the charging functionality itself, hacking can result in identity theft, fraud, and malware insertion. It’s disturbing that white hats found some of the most rudimentary security elements lacking. These include the absence of API authorization and firmware signing. 

EV charging is the poster child of a security problem with potential attacks via mobile apps, firmware updates, and physical access points. 

EV charging security is a shit show While the safety issues of electric vehicles are covered mainly by the international standard ISO 6469, there is no comparable global EV security standard. Developing one requires collaboration between different parties such as automakers, charge point operators, manufacturers, utility companies, and third-party vendors. Each of these industries represents an entry point for hackers.  

The vulnerabilities specified in this article are fixed. However it won’t be long until another security risk is exposed — hopefully not in an act by cybercriminals. 

Do EVs excite your electrons? Do ebikes get your wheels spinning? Do self-driving cars get you all charged up?