Carding Forum
Professional
- Messages
- 2,788
- Reaction score
- 1,177
- Points
- 113
Fast charging can be a digital intrusion into your vehicle.
Engineers from the American Southwest Research Institute (SwRI), located in Texas, discovered a vulnerability in fast charging stations for electric vehicles, which allows hackers to gain unauthorized access and even modify the firmware.
Power Line Transmission (PLC) technology uses existing electrical cables to transmit data. The same technology allows you to transmit voice, video, and Internet traffic through electrical wiring. This method of information exchange has existed for more than a hundred years: it was invented and started to be used back in 1922.
Today, about 40 million electric vehicles drive on the roads of the world. Approximately 86% of their owners charge their cars at home, and about 59% use public charging stations on a weekly basis. There are about 10,000 direct current Fast charging stations (DCFC) in the US, which creates many potential vulnerabilities for car owners.
Layer 3 charging stations use an IPv6-based protocol to communicate with the vehicle, monitor and collect data, including the state of charge and vehicle identification number. Researchers at Southwest Research identified vulnerabilities in the PLC layer that allowed them to access the network key and digital addresses of both charging stations and the connected car. This was made possible by a specialized AitM attack.
"Our testing showed that the PLC layer was poorly protected and lacked encryption between the vehicle and the charging stations," said Katherine Kozan, lead engineer at SwRI.
Earlier, in 2020, employees of the same institute managed to hack the J1772 charging system to simulate a malicious attack, sending signals to simulate recharging, changing the current flow rate, and even completely blocking the charging process.
Level 3 charging station vulnerabilities allow potential hackers to go even further and, for example, embed malicious code in the car's firmware, changing its functions or disabling them, as well as providing remote access to machine control via the Internet.
An example of such attacks is the 2015 incident when hackers from Missouri took control of a Jeep Cherokee, controlled its movement and even disabled the brakes, using a vulnerability in the built-in multimedia system.
"Network access via insecure keys makes it easy to extract and reprogram PLC devices, which opens the door to destructive attacks such as firmware corruption," said F. J. Olugbody, an engineer at SwRI.
Changing the firmware of an electric car by an attacker can have serious consequences for the driver and others. Modern cars, packed to the brim with various software, processors, and Internet connections, are essentially turning into mobile data centers.
The new Tesla models, for example, use an AMD Ryzen central processing unit and an AMD Radeon graphics processor, similar to desktop home computers. The car also has about 63 other processors installed to perform other specific tasks.
Southwest Research engineers, in turn, already have a potential solution to this type of attack. Researchers have developed a new "zero-trust" architecture designed specifically for use in electric vehicles.
The zero-trust principle is based on the assumption that if an attacker wants to break into your firewall, it is likely that they will do so, and you will not be able to stop them. However, to ensure zero trust, each digital asset at the root level will need to confirm its identity and belonging to the network before executing the command. The network in this case is the car itself.
The system is also able to monitor its integrity, detecting any anomalies and illegal communication packets in real time in case an attacker still gets access to the car. Although there is still no zero-trust architecture in modern cars, the development of SwRI engineers can be a good start for its widespread implementation.
Source
Engineers from the American Southwest Research Institute (SwRI), located in Texas, discovered a vulnerability in fast charging stations for electric vehicles, which allows hackers to gain unauthorized access and even modify the firmware.
Power Line Transmission (PLC) technology uses existing electrical cables to transmit data. The same technology allows you to transmit voice, video, and Internet traffic through electrical wiring. This method of information exchange has existed for more than a hundred years: it was invented and started to be used back in 1922.
Today, about 40 million electric vehicles drive on the roads of the world. Approximately 86% of their owners charge their cars at home, and about 59% use public charging stations on a weekly basis. There are about 10,000 direct current Fast charging stations (DCFC) in the US, which creates many potential vulnerabilities for car owners.
Layer 3 charging stations use an IPv6-based protocol to communicate with the vehicle, monitor and collect data, including the state of charge and vehicle identification number. Researchers at Southwest Research identified vulnerabilities in the PLC layer that allowed them to access the network key and digital addresses of both charging stations and the connected car. This was made possible by a specialized AitM attack.
"Our testing showed that the PLC layer was poorly protected and lacked encryption between the vehicle and the charging stations," said Katherine Kozan, lead engineer at SwRI.
Earlier, in 2020, employees of the same institute managed to hack the J1772 charging system to simulate a malicious attack, sending signals to simulate recharging, changing the current flow rate, and even completely blocking the charging process.
Level 3 charging station vulnerabilities allow potential hackers to go even further and, for example, embed malicious code in the car's firmware, changing its functions or disabling them, as well as providing remote access to machine control via the Internet.
An example of such attacks is the 2015 incident when hackers from Missouri took control of a Jeep Cherokee, controlled its movement and even disabled the brakes, using a vulnerability in the built-in multimedia system.
"Network access via insecure keys makes it easy to extract and reprogram PLC devices, which opens the door to destructive attacks such as firmware corruption," said F. J. Olugbody, an engineer at SwRI.
Changing the firmware of an electric car by an attacker can have serious consequences for the driver and others. Modern cars, packed to the brim with various software, processors, and Internet connections, are essentially turning into mobile data centers.
The new Tesla models, for example, use an AMD Ryzen central processing unit and an AMD Radeon graphics processor, similar to desktop home computers. The car also has about 63 other processors installed to perform other specific tasks.
Southwest Research engineers, in turn, already have a potential solution to this type of attack. Researchers have developed a new "zero-trust" architecture designed specifically for use in electric vehicles.
The zero-trust principle is based on the assumption that if an attacker wants to break into your firewall, it is likely that they will do so, and you will not be able to stop them. However, to ensure zero trust, each digital asset at the root level will need to confirm its identity and belonging to the network before executing the command. The network in this case is the car itself.
The system is also able to monitor its integrity, detecting any anomalies and illegal communication packets in real time in case an attacker still gets access to the car. Although there is still no zero-trust architecture in modern cars, the development of SwRI engineers can be a good start for its widespread implementation.
Source
