They found vulnerabilities in Project EV, Wallbox, EVBox, EO Charging’s EO Hub and EO mini pro 2, and Hypervolt, as well as the public charging network Chargepoint. They also examined EV’s Rolec but found no vulnerabilities.
All hail the white hat hackers
You’ve got to love white hat hackers. They work tirelessly to find vulnerabilities before the bad guys do. Unbelievably the company they’ve found fault with often only acknowledges their efforts after media reporting. For home charging, smart EV chargers allow the car owner to remotely monitor and manage the charge state, speed, and timing of their car charger via an app. The mobile apps all communicate with the charger via an API and cloud-based platform. The chargers are usually connected to the owner’s home Wi-Fi network. The researchers found a range of vulnerabilities. They could hack the accounts of millions of EV chargers. In some, they could overtake accounts and turn remote control charging on and off. In another, they could use the charge point as a remote ‘back door’ into the user’s home network, from where we could potentially compromise further devices in the user’s home. Specifically, no flaws were confirmed with Hypervolt other than that an RPi ‘could’ be vulnerable. No remote flaws or vulnerable endpoints were found. Some of the chargers had gone old school by using a Raspberry Pi Compute Module. The Pen Testers note: They do however note: In the case of the public EV charger, they believe it would be possible to access another user’s account for a free charge. They also note a potentially bigger issue of destabilizing the grid by switching simultaneously switching charges on and off:
Not the first rodeo for EV charger woes
This research is not the first example of security vulnerabilities in EV charging. In 2019, security researchers found security vulnerabilities in Schneider Electric’s EVlink Parking charging stations. Hackers could stop a car from charging and prevent anyone else from using the charger. A malicious actor could even unlock the cable while charging. Then, they could walk away with the cable. There was also plenty of opportunities to gain full privileges, add users, change files, and more. Last year engineers at Southwest Research Institute simulated a malicious attack on an EV charger with a purpose-built spoofing device made with cheap hardware and simple software. Researchers could limit charging costs as well as overcharge and undercharge the battery — the latter could result in big safety problems. But fortunately, the battery management system was able to detect the overcharging and disconnect.
Don’t EV customers deserve better?
We know about all these problems due to the mighty work of researchers. But hacking is a genuine threat in an industry that’s scaling rapidly. Worse, the industries collectively fail to learn from the legacy shit show that is IoT security. Beyond controlling the charging functionality itself, hacking can result in identity theft, fraud, and malware insertion. It’s disturbing that white hats found some of the most rudimentary security elements lacking. These include the absence of API authorization and firmware signing. EV charging is the poster child of a security problem with potential attacks via mobile apps, firmware updates, and physical access points. EV charging security is a shit show While the safety issues of electric vehicles are covered mainly by the international standard ISO 6469, there is no comparable global EV security standard. Developing one requires collaboration between different parties such as automakers, charge point operators, manufacturers, utility companies, and third-party vendors. Each of these industries represents an entry point for hackers. The vulnerabilities specified in this article are fixed. However it won’t be long until another security risk is exposed — hopefully not in an act by cybercriminals. Do EVs excite your electrons? Do ebikes get your wheels spinning? Do self-driving cars get you all charged up?
