back to article Shocker: EV charging infrastructure is seriously insecure

If you've noticed car charging stations showing up in your area, congratulations! You're part of a growing network of systems so poorly secured they could one day be used to destabilize entire electrical grids, and which contain enough security issues to be problematic today.  That's what scientists at Sandia National …

  1. Anonymous Coward
    Anonymous Coward

    KISS

    But somehow it is not easy to steal gasoline - at least not in advanced countries - even at self service stations. Why would each charging port need it's own web connection? Why would a cellphone charging app be necessary? There are already things like Apple Pay, etc, if you really need to use cellphone payment system. No need to reinvent the wheel.

    1. Yet Another Anonymous coward Silver badge

      Re: KISS

      Here the electricity company is nationalised and owns all the chargign stations - but somehow there are a "choice" of 4 different PPI-ed payment cards/apps. Of course different chargers support different sub-sets of the services so you need a phone full of apps and a car full of RFID cards

    2. Anonymous Coward
      Anonymous Coward

      Cracking gas pumps isn't rocket science either

      The trick being that there are more, and more competent, crews targeting the merchant transactions than the gas itself. At the end of the day, if a gas or charge vendor is getting hit with any frequency their main defense has nothing to do with the pumps, its' their CCTV and APNR system.

      I think their is one important point from the article and this thread that needs to be restated by itself.

      Strong regulation is the only thing that will change this market. Ban the crap and mandate something based on a tested and resilient open platform for a decade or so, that way the market is set on the right track, and new entrants will have to follow the existing infrastructure from that point.

      Right now the idiots are in charge, and nobody is really planning on building the charge network out in a way that will avoid some pretty obvious face plants. A fine example would be the abandonment of the charge ports for 240v charging from the commercial charge points. DC fast chargers are seen as being where the money is at, and change standards about every year and a half. The commercial charge lots don't want cars sitting around for 8 hours on a slow 240v spot taking up space they are paying for, so they don't have any. As a result, people who buy the EV's and PHEVs they are still selling with those ports are stuck with an unsupported charging system they are unlikely to be able to use on the road.

      Since the main thrust of this whole EV push is supposed to be to reduce tailpipe emissions, you want people with PHEVs to run as many electric miles as possible. This also lets those miles come from the lowest impact energy sources. The system we are building does the opposite of that, where most people are going to come home to peak electrical load on the local grid, and have to plug in to start the 8-10 hour slow charge from a residential outlet.

      So we need to mandate that in addition to the basic security baseline that EV charge points have at least a few slow charge points, or a mandated down-converter that all of them will support. Otherwise what will be built will only serve the piecemeal fly-by night operators that all hope to be the Uber of paid fast charge stations and will end up being the next Mobike fiasco that other smarter people clean up after. These operators are following a predatory interest to lock out competitors, hoover up installation subsidies, and leave someone else holding the bag.

      Regulate the market, plan the rollout, and penalize the violators enough that there is no window for profit off non-compliance. You can say it one line, and yet the regulators are 0 for 3 and still swinging at thin air.

      1. Anonymous Coward
        Anonymous Coward

        Re: Cracking gas pumps isn't rocket science either

        ...the piecemeal fly-by night operators that all hope to be the Uber of paid fast charge stations...

        This. Though I wish it was only the smaller players who were thinking this way. Our CEO actually said in a strategy-and-vision presentation a couple of years ago that "we want - no, we NEED - to become the Spotify of the (redacted) business". But we're the incumbent in said business in our home market, and have been for over 150 years; we have 20K+ employees in multiple countries and in considered one of the world leaders in our industry. How can we ever become the challenger? Sure, we need to constantly adapt and find new ways to stay relevant, but what we're doing has obviously worked OK so far on SOME level?

        (In the same presentation, the three-step plan to implement the new vision was illustrated with a picture of a Falcon Heavy rocket - "and that's not just fun clip art, people; but also a reminder that we need to get more into a SpaceX mindset". Still think that that's a good role model...?)

        1. Michael Wojcik Silver badge

          Re: Cracking gas pumps isn't rocket science either

          Save us all from "visionary" leaders.

      2. Henry Hallan

        Re: Cracking gas pumps isn't rocket science either

        As someone who actually owns an EV, the slow 8-hour charge (mine takes about 4-5) is the day-to-day reality. And that is fine.

        The pattern of filling the car and rushing off doesn't apply to EVs. I get home or I get to work, I plug it in, and I ether sleep or work for hours. At work the electricity is free (to me) and at night I use a night-time tarriff similar to your UK "Economy 7." Fast charging is needed for long journeys, maybe, but I haven't used a public charger in years.

        What is needed is not more DC chargers. What is needed is AC chargers everywhere that cars are parked for long periods: roadside; residential car-parks; workplaces; and so on. (And what is also needed is construction-and-use regulation mandating 21kW AC charging for all EVs to make it practical.) Many more AC than DC chargers are needed, but fortunately AC chargers are about 1/20th of the price of DC chargers.

        They also use a very simple PWM charge control system that isn't vulnerable to software hacking: just a simple 12v square-wave to communicate available charger capacity.

        This article is all about DC public chargers, which are expensive and over-complicated. Ubiquitous AC destination charging is the way to enable EVs. DC charging is a rare beast for motorway service stations.

        I know most of you imagine the "filling station" model applying to EVs. I know the companies that own forecourts would like it to apply too. But EV owners know that it simply doesn't apply now -- any more than carrying hay and oats in the back of your vehicle applies today.

        1. Jimmy2Cows Silver badge

          Re: Ubiquitous AC destination charging is the way to enable EVs.

          Vastly increased electricity generating capacity and grid distribution are the way to enable EVs.

          No point having AC (or any) chargers everywhere until that has happened. And there's no point trying to force everyone to go electric until generation, distribution and charger availability have been significantly improved.

          Yet the world seems to be doing it backwards. Governments force manufacturers to only build hybrid, then only electric, Yet do the heavy side of fuck all to ensure there's enough electricity and charging available for their utopian vision. The market will fix it, they say. Bollocks. The market will sit on its arse gouging as much as possible while doing as little as possible.

          So here we are with "the market" all rushing to be the first to pop up a few fast chargers and bind customers into their platform - it's the only reason to have an app vs payment card or NFC payments - while creating shit, insecure hardware and software as fast as possible just to corner some vaguely desirable location before some other parasite gets there first.

          1. John Brown (no body) Silver badge

            Re: Ubiquitous AC destination charging is the way to enable EVs.

            "The market will fix it, they say. Bollocks. The market will sit on its arse gouging as much as possible while doing as little as possible."

            The obvious example (in the UK) being BTs abysmally slow roll out of DSL because they wanted to keep sweating the ISDN assets. Same with ADSL. And now the fibre roll-out is still patchy based on the returns in an area or if BT have competition in an area. Despite government grants, market forces will slow things down unless there is serious competition to spur upgrades.

            1. HereAndGone

              Government Specified Commercial Security? No, just no!

              Classically complete government specifications are released and mandated against obsolete technology.

              John Brown said: "... The obvious example (in the UK) being BTs abysmally slow roll out of DSL because they wanted to keep sweating the ISDN assets. Same with ADSL.

              DSL? OMG, I thought the UK was a first world country. I can just see official security specifying exactly how to use DSL.

              The problem is not generic EV charging infrastructure, it's individual vendors poorly implementing devices (in one case at least as a direct result of court ordered recompense for fraud). As long as the damage, financial or otherwise, is limited to the poor vendors the problem will solve itself without government hindrance.

              All the suggestions about reliability, ubiquity, automatic car recognition, and power have already been solved and implemented by "He who shall not be named".

          2. Henry Hallan

            Re: Ubiquitous AC destination charging is the way to enable EVs.

            If you Google around, you'll find the difference between daytime and nighttime electricity use in the UK is about 10GW. If home AC chargers draw 7kW then 13,000,000 cars could be plugged in at night before the daytime load is reached.

            Nighttime AC charging won't need a grid update for a while yet.

            There is a reason night rate electricity is cheap.

            1. Andre Carneiro

              Re: Ubiquitous AC destination charging is the way to enable EVs.

              That's right in the grand scheme of the whole grid. The problem is that you're shifting 10GW of load from industrial sites with plentiful transmission capacity to thousands of residential sites with transformers and distribution system designed with 2kW-per-household calculations.

              In my housing estate we have a substation and I am told that each phase has a 400A fuse.

              At 32A single phase draw, it would only take about 13 cars charging to overload that fuse. For the 3 phases let's say the whole housing state of 100+ houses would only manage 40 cars charging simultaneously. Some of these 100+ houses will more than likely have more than one car.

              I am glad that I managed to get my EVSEs and batteries installed early, as the DNO is going to start looking very closely at capacity calculations. Between charging cars, batteries and heating water with off-peak energy I am already hitting the 100A limit on my supply for 5 hours every night (in the winter. Summer is a different story)

              There will definitely need to be some sort of upgrade done closer to "the edge" of the electrical network once home energy supply for mobility, heating and cooking becomes exclusively (or nearly exclusively) electric.

        2. PRR Silver badge

          Re: Cracking gas pumps isn't rocket science either

          > any more than carrying hay and oats in the back of your vehicle applies today.

          HAY!!

          Last week we loaded the back of the minivan with horse-bedding.

          1. John Brown (no body) Silver badge
            Joke

            Re: Cracking gas pumps isn't rocket science either

            Must be hard times out in rural land. When I were lad we always used an old mattress in the back of the van.

  2. Yet Another Anonymous coward Silver badge

    Raspberry Pis without secure bootloaders

    If you can get inside the machine to get at the SD card in a Pi you can presumably do anything you like to the machine

    1. b0llchit Silver badge
      Facepalm

      Re: Raspberry Pis without secure bootloaders

      If you can get inside the machine

      That is enough to cause all problems. These machines have generally no or inadequate tamper detection.

  3. that one in the corner Silver badge

    SDR? Why is there any wireless comms used here at all?

    Aside from tap-to-pay, which by now should be an entirely off-the-shelf module, what is the need for wireless?

    There is a honking great cable going from the car to the charge station - surely there is room in that for a little bit (more) data? A nice standardised panel on the dashboard and/or drop you phone into a cradle (if the link from your phone to your car is insecure then the problem is nothing to do with charging!)

    Ditto the charger station, especially those that are grouped together (FWIW can't think of anywhere round here that has less than 5 or 6 charge bays) - they already have wires going to them, so wire them to a switch and use whatever is the most secure 'Net connection available, using all the standard encrypted links. Even if that is via radio - 4G - all that a nearby SDR ought to be able to do is disrupt the connection and drop the charger back to local control, not snarf credentials.

    1. AndrueC Silver badge
      Meh

      Re: SDR? Why is there any wireless comms used here at all?

      A nice standardised panel on the dashboard and/or drop you phone into a cradle (if the link from your phone to your car is insecure then the problem is nothing to do with charging!)

      Why does it even need to involve your phone? Why can't the tonne-or-more of metal be the payment device?

      Sure it means that the thief could get petrol at your expense (though refunds in event of theft should be possible) but at least when it's reported stolen you can disable the car's account at which point it can only be driven so far before the thieves have to abandon it.

      All the systems needs is for each vehicle to have a unique ID (which they already do) then the charging station uses that to identify the account.

      1. Dale 3

        Re: SDR? Why is there any wireless comms used here at all?

        Until the next exploit we hear about being unique ID spoofing.

      2. that one in the corner Silver badge

        Re: SDR? Why is there any wireless comms used here at all?

        Totally agree. Just didn't want to alienate anyone who has their phone welded to their hand :-)

        1. AndrueC Silver badge
          Meh

          Re: SDR? Why is there any wireless comms used here at all?

          There is I suppose one scenario where car-as-payment-device doesn't really work. That's where a car is shared by multiple unrelated people. Husband/wife/partner sharing is probably still fine as they can just share a household vehicle account. But if you're in the habit of letting random friends borrow your vehicle it won't work so well.

          Then again in the UK at least that kind of random sharing is difficult anyway due to insurance requirements.

          I suppose you could sign users into the car but that's worse than just requiring them to have a phone connected.

          1. Michael Wojcik Silver badge

            Re: SDR? Why is there any wireless comms used here at all?

            I can't see lending one of my vehicles to anyone I wouldn't trust to offer to compensate me for whatever fuel, or electricity if I had an EV, they used. I'd decline, but they'd offer. Except family members who've learned not to bother, of course.

            But if you're in the habit of letting people you don't trust drive your car, then ... I'm not seeing how this threat model works.

  4. Gene Cash Silver badge
    FAIL

    The American EV charging infrastructure is seriously BROKEN

    I've had times when I roll up to (say) an EVgo station, and it's dead. Broken. No life. LCD is blank. So I check the EVgo app, and it says the station is fine. Then I check the PlugShare app (which is a VERY popular open sourced app) and EVgo has posted "this station is dead, sorry!" and still nothing on their own app!

    Plus there are compatibility problems. My bike will have no problem charging with a Signet charger, but a Delta charger won't handshake/initialize.

    Then I went up to a station I'd used before, and it worked fine in the past, but now it would connect, charge for about 6 seconds, and disconnect. Over and over again. No error message. So I called support and said "WTF bitches?" and they said "oh your card is expired" - what, you can't put a fucking "payment declined" message up? Seriously?

    I'm not surprised that they're insecure on top of all this. They're a useless bag of dicks.

    1. EricB123 Bronze badge

      Re: The American EV charging infrastructure is seriously BROKEN

      You are definitely American, distinguishable be you colorful language. Don't confuse that statement for not agreeing with you 100 percent though.

    2. John Brown (no body) Silver badge

      Re: The American EV charging infrastructure is seriously BROKEN

      and they said "oh your card is expired"

      Doesn't your card issuer automatically send you a new one a month or so before the old one expires? Or is this a case of registering your card with the company, not having it read at the point of use so you don't actually need the card present to use it?

  5. ThatOne Silver badge
    Unhappy

    And so castles made of sand...

    > What did we learn from the IoT days? Apparently nothing.

    Yet when I suggested this, I was downvoted by the "this is too shiny state of the art to fail" crowd...

    Sorry fanboys, seems it's just another bunch of cowboys riding a trend in the hope of making a quick buck. Unfortunately it will take some effort and a lot of toil to make charging efficient or even usable on a large scale (meaning if the majority of cars out there become EVs).

    1. Androgynous Cupboard Silver badge

      Re: And so castles made of sand...

      Downvoted for suggesting you've met an EV driver that had a positive opinion about charging infrastructure. Had you claimed to have met one with ten heads and a pet unicorn, I might have bought it

      1. ThatOne Silver badge

        Re: And so castles made of sand...

        > suggesting you've met an EV driver that had a positive opinion about charging infrastructure

        First of all thank you for taking the time to explain. Well, I've met a lot of people (owning an EV or not, I didn't check) who claimed charging points are irrelevant to them since they'd be charging at home overnight, or/and at their office parking lot. Which obviously is only possible for a few very specific locations, professions and/or income levels. I didn't say anything about positive, I just said they claim existing infrastructure (charging opportunities, grid) would automagically be sufficient to cover the load of all vehicles in the country going fully electric. *shrug*

        Disclaimer: Despite being a petrolhead I admit EVs are necessary and bound to happen, but a revolution of that magnitude requires some serious and costly infrastructure changes first. What is actually happening is a textbook case of putting the cart before the horses.

  6. Anonymous Coward
    Anonymous Coward

    Reg's regs ref

    The UK regulations mentioned only cover private & workplace chargers - they explicitly exclude public chargers.

  7. Inventor of the Marmite Laser Silver badge

    I drive up to a petrol pump, have my standard Visa card read. I fill up. I have my Visa card back. I leave.

    In contrast, I arrive at an EV charger and check who the supplier is. Especially if it is run by one of the mail oil companies I check if the thing is dead like one in three of their fleet. Oh goody, it isn't.

    I check if I have their app or maybe their RFID card. I don't so I get my phone again and join their website

    Oh. No phone signal. No WiFi either. Now I'm screwed.

    Why did EV charge network providers take a working model and then stamp on it?

    1. Anonymous Coward
      Anonymous Coward

      Cos this is what disruptive technology looks like!

      The fun bit is when you have a row of chargers but only one works at a time due to the power coming in from the grid on a wet bit of string. Quite a few like that in the UK.

      1. 42656e4d203239 Silver badge
        Happy

        Magic Smoke Release

        "only one works at a time due to the power coming in from the grid on a wet bit of string."

        The string won't stay wet for long if they all try to work at the same time... it will get all hot and bothered, letting out the magic smoke... so I guess the chargers are in self preservation mode - they know they will die if they all work at the same time so just take it in turns.

        Seriously - the inadequacy of the wet string is down to the owner/operator of the chargers rather than anything else. I don't think there is a law that says you have to pay for a decent (as in more than minimally) sized piece of wet string to your chargers but, arguably, there should be!

        1. PRR Silver badge
          Flame

          Re: Magic Smoke Release

          > I don't think there is a law that says you have to pay for a decent (as in more than minimally) sized piece of wet string to your chargers...

          And yet, when I contact the electric utility to connect a house, they *require* 100 Amp service(1). Unless they think the house is big enuff that they can require 200 Amp service. Not a legal law but a supplier rule. Yes, a little conservative (I can hardly suck 50A on laundry day) but based on a century of wire-burning experience. (There is an NEC rule for sizing domestic supply which is much closer to typical, but moot since you gotta do what PSE&G/LILCO/JCP&L/BangorHydro says you gotta do to get a connection.)

          So seems to me that to hook-up a charging-lot the electric company should WANT TO require some ample power level. Since I can't put a really fast-charger on my 100A house even with the dryer disconnected, I'm thinking 200A (@240V) per spot.

          (1) 100 Amp may seem large to UK eyes. This started when air-conditioning prices fell and power-sellers got greedy for that energy load, wanted to be sure all new houses were provisioned for A/C on top of the usual "All Electric" package.

          1. I could be a dog really Bronze badge

            Re: Magic Smoke Release

            AIUI in the UK new supplies are typically 100A unless there are reasons not to - e.g. lack of capacity in the local infrastructure. Older supplies could be one of a variety of capacities - my house, which I think was built during or shortly after WWII, has a 63A supply.

            But we don't (for most domestic supplies) have capacity charges - unlike places like France and Spain where I believe it's common to pay standing charges dependent on the capacity of the supply (enforced by an MCB fitted in the supply by the provider). I think that's largely down to a system built with less future proofing, and hence not capable of providing large supplies to everyone in many areas without massive (i.e. costly) system upgrades.

            But in Europe we do have the "smart" meter rollout, at great expense which based on the last figures I saw will be higher than the claimed savings. This is all about load side management - i.e. "persuading" people to adapt their usage to fit with capacity (i.e. don't cook dinner if the wind isn't blowing and it's dark). At the moment they aren't ubiquitous in the UK (I'm in no rush to have one), so the supply industry can't really apply the sticks too hard - so it's mostly carrots at the moment (see this or this).

            The sticks will come soon enough, and are starting to show - exactly what was promised couldn't happen given the checks and balances in the procedures.

      2. Tempest 3K

        Wet piece of string? Hadn't realised that Openreach had licensed that model out to others.....

    2. Filippo Silver badge

      This, a hundred times this. FFS, I have a credit card. It even works contactless. Paying a machine for stuff is a solved problem. Just put a CC reader on each charging point, or even just one for the whole row (like at many gas stations), if that's a problem. Why reinvent the wheel?

      1. ComputerSays_noAbsolutelyNo Silver badge

        https://en.wikipedia.org/wiki/Not_invented_here

        ... and that's why we can't have nice things.

      2. yetanotheraoc Silver badge

        Usury!

        Can't be giving the CC network their 2%. Mine, mine, give me all the %s. Plus it's easy, we hired this great team of IOT developers....

    3. Andre Carneiro

      Or, if you're a Tesla driver, you arrive, plug in, charge and leave. Your can skip the "having your Visa card read" step.

      That's how it should be everywhere. It can be done.

  8. NIck Hunn

    It's the grid that's different.

    Petrol pumps are essentially autonomous. If you hack one, then at worst it spews out petrol and sets one gas station on fire. EV chargers are connected to the grid, so you can cause damage by attacking them in concert. As we get more high current chargers, that can start to be significant, especially if you're also targeting home chargers. Or you can just turn them off and strand enough EVs on the M25 to make the stop oil protest look trivial.

  9. RetiredAndGood

    QNX is the Solution

    Instead of using Linux they should be using QNX the most secure operating system available. All the Car manufactures other than Tesla use QNX as their core RTOS. It is the only safety certified RTOS. Blackberry is leading the way on securing the edge with QNX and Cylance, why someone would try and reinvent the wheel when a solution exists is insane.

    https://blackberry.qnx.com/en/resource-center/resources

    1. I could be a dog really Bronze badge

      Re: QNX is the Solution

      It's not the specific thing they are using, it's the way they are using it.

      For example, you could mandate fitting really tough secure doors on houses - but if the builder then fits the cheapest most insecure locks then it's not going to make any difference to burglary stats.

      So it's not the fact that they use linux that's a problem, it's the fact that they are using it without applying even the most basic of already known security settings/processes to it. And in the general case it's not a safety critical system. Sure there are issues such as controlling charging current so as not to melt wires - but that can (and should) be handled by that time tested device known as a fuse (or the more modern, circuit breaker).

    2. Anonymous Coward
      Anonymous Coward

      Re: QNX is the Solution

      Sorry - you're wrong here. It doesn't matter what OS you use, if you don't have securityat the forefront from the start of your design process then your final product will not be secure.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like