Berlin 2024 | EV Charging Stations Security - Free Of Charge

### Overview In this presentation, an industrial control systems (ICS) security researcher explores the security posture of electric vehicle (EV) charging stations and wall boxes. Driven by the exponential growth of the EV market and the industry's rush to ensure user convenience comparable to refueling petrol cars, station manufacturers frequently rely on outdated technologies while neglecting foundational security practices. The speaker analyzes the physical security, internal architecture, network protocols, and authentication mechanisms of EV chargers, demonstrating multiple vulnerabilities that allow attackers to reboot stations, extract sensitive data, and obtain free charging.

### Key Topics - **EV Charging Infrastructure & Protocols**: Examination of the Open Charge Point Protocol (OCPP) architecture, backend communications, and regulatory mandates in Germany (such as requirements for ad hoc charging and card payment terminals). - **Physical Security Deficiencies**: Weak housing protections, easily bypassed standard cabinet locks, lack of tamper detection, and vulnerable internal components. - **Authentication Weaknesses**: Reliance solely on RFID/NFC card Unique Identifiers (UIDs) without cryptographic validation, enabling straightforward cloning and authorization spoofing. - **Network & Service Flaws**: Unauthenticated local web interfaces, exposed administrative functions, information leaks in log files, and remote reboot denial-of-service vulnerabilities. - **Vendor Response & Responsible Disclosure**: The hurdles encountered during coordinated vulnerability disclosure, culminating in vendors declaring affected products end-of-life rather than issuing fixes.

### Technical Details - **Physical Access & Hardware Layout**: The speaker demonstrated that charging station cabinets frequently use standard electrical locks easily opened with basic triangular keys or improvised tools, lacking tamper switches or robust seals. Internally, stations feature an Ethernet switch, embedded computer boards, microcontrollers, smart meters, power relays, and often a cellular SIM modem for remote maintenance. Connecting to an unused port on the internal switch allowed direct, unauthenticated local network access without needing hardware debug headers like JTAG or UART. - **Denial-of-Service via Port 8192**: Running an Nmap scan revealed open ports on the embedded system. Sending a specially crafted packet to port 8192 forced the charging station to reboot. Because stations on the test network were interconnected, this reboot packet could be routed across the backend to remotely crash stations located hundreds of kilometers away. The speaker noted that synchronized reboots across large numbers of high-draw stations could theoretically be combined with other grid-level attacks to threaten grid stability. - **Unauthenticated Web Server (Port 8888) & Log Extraction**: An unprotected HTTP server was identified running on port 8888. It exposed an administrative interface permitting any connected user to download system log files (including the authorization cache) without authentication. These logs stored authorization IDs in decimal and hexadecimal, along with vehicle telemetry such as Electric Vehicle IDs (EV-IDs), vehicle models (e.g., BMW i3), and remaining battery capacities. This data could facilitate long-term tracking of specific vehicles. - **Free Charging via UID Spoofing & Whitelisting**: Station access control depended entirely on reading the static UID of NFC/RFID charging cards (e.g., MIFARE Classic). Attackers can obtain valid UIDs from rental cars, brute-force sequential IDs, or extract historical authorized UIDs directly from the exposed station log files. Once extracted, the UID can be emulated using devices like a Chameleon Mini or Flipper Zero, or a new custom UID can be added directly via the station's unauthenticated web-based RFID whitelist. To demonstrate arbitrary power drawing, the speaker connected a test box with a standard AC socket to power a waffle maker.

### Takeaways The speaker concluded that many deployed EV charging stations are effectively broken by design due to flawed security assumptions—specifically assuming physical enclosures cannot be breached and treating unencrypted, legacy protocols (like OCPP 1.6) as sufficient. When these vulnerabilities were disclosed to the manufacturer, communication stalled after the vendor dismissed their security developer, ultimately leading the vendor to mark the hardware end-of-life to avoid releasing a firmware patch. True security improvements will require mandatory backend encryption, cryptographic card authentication (such as ISO 15118 support in OCPP 2.0.1), and robust physical tamper protections.