Engineers at Southwest Research Institute (SwRI) have discovered a vulnerability in DC fast-charging stations that allows hackers to access an electric vehicle and modify its firmware.
The problem lies in PLC (Power line communication) technology. It is a way of transmitting data through existing power cables, such as electrical outlets. It works by transmitting a harmonic signal into the power line, and then receivers on the other end interpret and extrapolate the data in that harmonic. In this way, transmissions such as voice, video, and even daily internet traffic can be sent and received directly through electrical wiring. This technology has been around since 1922.
Today, there are dozens (if not hundreds) millions of electric cars driving around the world. About 59% of electric car owners use public chargers every week. There are about 10,000 Level 3 DC fast charging points in the U.S. That’s 10,000 potential hacking sites and millions of potential vulnerabilities in the U.S. alone.
Level 3 DC charging stations, which are the fastest way to recharge an electric vehicle, use an IPv6-based PLC to communicate with the vehicle to monitor faults and collect data — from the state of charge to the vehicle identification number (VIN).
By exploiting the PLC-level vulnerability, attackers could gain access to the network key and digital addresses of both the chargers and the car through an AitM (adversary-in-the-middle) attack that could emulate both the electric vehicle and the charging equipment.
«During our penetration testing, we found that the PLC layer is poorly secured and has no encryption between the vehicle and the chargers», — SwRI says.
In 2020, SwRI researchers were able to hack into the system of a J1772 charger – the most common type of charger in the United States – to disrupt the charging process by simulating a malicious attack. They could send signals to the car to simulate overcharging, adjust the charging speed, or simply block charging completely.
Attacks on Level 3 DC charging stations give potential hackers the ability to inject code into the car’s firmware, changing its functions or disabling them entirely. It may even allow remote access and control via the vehicle’s mobile Internet connection.
In 2015, there was already a Jeep hack when a pair of hackers from Missouri took control of an unmodified Jeep Cherokee. The hackers went so far as to turn off the engine, take control of the steering, and force the vehicle off the highway before turning off the brakes. And all this was done while monitoring the car’s position via GPS. This complete control was achieved remotely, using only the infotainment system.
«Due to the network access provided by unsecured direct access keys, it was easy to access and reprogram non-volatile memory on PLC-enabled devices. This opens the door to destructive attacks such as firmware corruption,» says SwRI.
Changing the firmware of an electric vehicle by an attacker can have serious consequences, as it offers almost limitless possibilities due to the fact that modern electric vehicles are highly dependent on software and internet connectivity. In essence, they are data centers on wheels. For example, the brain behind the latest Tesla Model S electric car is an AMD Ryzen processor and an AMD Radeon graphics processor. These are the same components that can be found in a desktop computer at home or at work. The car also has about 63 other processors.
Simply adding encryption to the embedded systems of electric vehicles can also pose a potential danger. Any error in decrypting or authenticating a piece of data can cause an electric vehicle’s systems to fail. Imagine trying to brake, but your car decides not to because it has failed to receive an authenticated signal from your pedal through the ABS module.
To remedy this, SwRI has developed a new «zero trust» architecture that can bypass encryption layers. Zero trust works on the premise that if an attacker wants to breach the firewall, it is highly likely that they will do so and there is no way to stop them. Zero trust, however, would require every asset – laptop, server, or electric vehicle – to verify its identity and membership in the network at the root level before executing a command. The network is the car itself.
Spelling error report
The following text will be sent to our editors: