Smart Charging, Smarter Hackers: The Unseen Risks of ISO 15118

## Overview

Salvatore Gariuolo, a senior threat researcher with Trend Micro’s Forward-Looking Threat Research (FTR) team, presents an analysis of the ISO 15118 standard and its impact on the electric vehicle (EV) charging threat landscape at Black Hat 2025. With projections estimating up to 600 million EVs by 2040 (constituting 30% to 40% of the global vehicle fleet), charging demands introduce severe grid strain, potential transformer damage, and risk of total localized blackouts. Additionally, rapid shifts in renewable energy generation (such as solar and wind) cause generation/consumption imbalances, illustrated by an April 2025 incident in Spain where a surplus of renewable power and safeguard delays led to a 48-hour national blackout that also impacted southern France and Portugal.

Because private vehicles remain parked roughly 95% of the time, they can act as decentralized battery storage. ISO 15118 was introduced to facilitate this through: - **Smart Charging:** Modulating vehicle charge draw based on grid capacity. - **Vehicle-to-Grid (V2G) Communication:** Drawing excess power or discharging stored power back to the grid. V2G is fully supported in ISO 15118-20 (released in 2022), whereas the earlier ISO 15118-2 (2014) lacked full V2G support. - **User Convenience and Security:** Replacing manual payment methods with automated "Plug & Charge."

---

## Security Improvements Mitigating Legacy EV Threats

ISO 15118 establishes security boundaries specifically over the communication link between the EV and the charging station:

- **Plug & Charge via PKI and TLS:** EVs store a digital certificate issued through a Public Key Infrastructure (PKI) tied to the user's account. Mutual identification and payment authorization occur automatically upon physical connection over a TLS-encrypted channel. - **Mitigation of Credential Cloning:** By replacing easily skimmed, cloned, or stolen physical tokens (RFID cards, credit cards), unauthorized charging sessions become significantly harder. An attacker would have to compromise the Certificate Authority (CA) or physically tamper with EV hardware to extract private keys. - **Centralization of Payment Responsibilities:** Billing logic shifts from individual charging stations to e-Mobility Service Providers (EMSPs). While this creates a high-value target (a breach could compromise millions of accounts rather than hundreds or thousands at a single charger), it replaces a fragmented ecosystem with centralized, scalable security policies.

---

## Architecture Blind Spots and Attack Techniques

A key vulnerability highlighted in the presentation is the standard's core assumption that the physical charging station is a secure, trusted entity. In practice, ISO 15118 deliberately excludes charging station hardening from its scope, creating dangerous blind spots:

- **Station Hardware and Firmware Exposure:** Audits demonstrate that charging stations often utilize off-the-shelf hardware (such as Raspberry Pi boards), maintain open maintenance interfaces, expose unsecured debug ports, and permit insecure remote access. Because chargers are publicly accessible, attackers can physically access hardware, flash modified operating systems, or escalate privileges to full root. - **Denial of Service (DoS):** Once root access is obtained, an attacker can trivially disable station functionalities, rendering the protected communication protocol unusable. - **Unsafe Power Delivery Override:** While ISO 15118 specifies an initial power negotiation between the vehicle and station, it lacks an enforcement mechanism to mandate compliance. A compromised station operating as a cyber-physical system can ignore the negotiated limits post-handshake, delivering dangerous power levels capable of causing equipment damage and physical safety hazards. - **Certificate Validation Bypass via Clock Tampering:** ISO 15118 omits any mechanism requiring charging stations to synchronize their internal clocks with a trusted, tamper-proof time source. An attacker with control over the station can manipulate the system clock backward or forward, tricking the station into accepting expired or revoked digital certificates to conduct unauthorized charging sessions.