Exploiting Vulns in EV Charging Comms
Discloses vulnerabilities in QCA 7000 HomePlug modems used across CCS and NACS EV charging systems that enable communication hijacking and denial of service.
Summary
Power-Line Communication in EV Charging Infrastructure
Electric Vehicle (EV) charging systems rely on Combined Charging System (CCS) and North American Charging Standard (NACS) protocols, which utilize HomePlug Green PHY power-line communication (PLC) for vehicle-to-grid data exchange.
Vulnerabilities in the QCA 7000 Modem Series
Jan Berens, Marcell Szakály, and Sebastian Köhler analyze the widely used Qualcomm QCA 7000 modem series, uncovering multiple critical vulnerabilities in PLC message processing and firmware execution.
Remote Communication Hijacking and Denial of Service
Exploiting flaws in HomePlug link negotiation allows attackers to intercept charging session telemetry at a distance, inject spoofed control commands, or trigger persistent denial-of-service conditions that prevent vehicle charging.
Firmware Reverse Engineering and Code Execution
Reverse engineering the QCA 7000 firmware revealed memory corruption vulnerabilities enabling arbitrary code execution on the modem hardware, highlighting urgent security needs across global EV charging infrastructure.
Related talks
Car Hacking Village·43 min
Jan Berens · Marcell Szakaly
Discloses vulnerabilities in QCA 7000 HomePlug modems used across CCS and NACS EV charging systems that enable communication hijacking and denial of service.
Main Stage·21 min
Noam Moshe
Demonstrates remote code execution and edge compromise across Axis enterprise IP cameras, turning surveillance devices into offensive pivot points.
Main Stage·33 min
Christopher Roberts - Firmware Slap: Automating Discovery of Exploitable Vulnerabilities in Firmware
Christopher Roberts
Presents Firmware Slap, a framework combining concolic execution and fuzzing to automatically discover exploitable bugs in embedded firmware.