Security flaws found in popular EV chargers

U.K. cybersecurity company Pen Test Partners has identified several vulnerabilities in the APIs of six home electric vehicle charging brands and a large public EV charging network. While the charger manufacturers resolved most of the issues, the findings are the latest example of the poorly regulated world of Internet of Things devices, which are poised to become all but ubiquitous in our homes and vehicles.

Vulnerabilities were identified in the API of six different EV charging brands — Project EV, Wallbox, EVBox, EO Charging’s EO Hub and EO mini pro 2, Rolec, and Hypervolt — and public charging network Chargepoint. Security researcher Vangelis Stykas identified several security flaws among the various brands that could have allowed a malicious hacker to hijack user accounts, impede charging, and even turn one of the chargers into a “backdoor” into the owner’s home network.

The consequences of a hack to a public charging station network could include theft of electricity at the expense of driver accounts and turning chargers on or off.

A Raspberry Pi in a Wallbox charger. (Image: Pen Test Partners (opens in a new window))

Some EV chargers used a Raspberry Pi compute module, a low-cost computer that’s often used by hobbyists and programmers.

“The Pi is a great hobbyist and educational computing platform, but in our opinion it’s not suitable for commercial applications as it doesn’t have what’s known as a ‘secure bootloader’,” Pen Test Partners founder Ken Munro told TechCrunch. “This means anyone with physical access to the outside of your home (hence to your charger) could open it up and steal your Wi-Fi credentials. Yes, the risk is low, but I don’t think charger vendors should be exposing us to additional risk.”

The hacks are “really fairly simple,” Munro said. “I can teach you to do this in five minutes,” he added.

The company’s report, published this past weekend, touched on vulnerabilities associated with emerging protocols like the Open Charge Point Interface, maintained and managed by the EVRoaming Foundation. The protocol was designed to make charging seamless between different charging networks and operators.

Munro likened it to roaming on a cell phone, allowing drivers to use networks outside of their usual charging network. OCPI isn’t widely used at the moment, so these vulnerabilities could be designed out of the protocol. But if left unaddressed, it could mean “that a vulnerability in one platform potentially creates a vulnerability in another,” Stykas explained.

Hacks to charging stations have become a particularly nefarious threat as a greater share of transportation becomes electrified and more power flows through the electric grid. Electric grids are not designed for large swings in power consumption — but that’s exactly what could happen, should there be a large hack that turned on or off a sufficient number of DC fast chargers.

“It doesn’t take that much to trip the power grid to overload,” Munro said. “We’ve inadvertently made a cyberweapon that others could use against us.”

While the effects on the electric grid are unique to EV chargers, cybersecurity issues aren’t. The routine hacks reveal more endemic issues in IoT devices, where being first to market often takes precedence over sound security — and where regulators are barely able to catch up to the pace of innovation.

“There’s really not a lot of enforcement,” Justin Brookman, the director of consumer privacy and technology policy for Consumer Reports, told TechCrunch in a recent interview. Data security enforcement in the United States falls within the purview of the Federal Trade Commission. But while there is a general-purpose consumer protection statute on the books, “it may well be illegal to build a system that has poor security, it’s just whether you’re going to get enforced against or not,” said Brookman.

A separate federal bill, the Internet of Things Cybersecurity Improvement Act, passed last September but only broadly applies to the federal government.

There’s only slightly more movement on the state level. In 2018, California passed a bill banning default passwords in new consumer electronics starting in 2020 — useful progress to be sure, but which largely puts the burden of data security in the hands of consumers. California, as well as states like Colorado and Virginia, also have passed laws requiring reasonable security measures for IoT devices.

Such laws are a good start. But (for better or worse) the FTC isn’t like the U.S. Food and Drug Administration, which audits consumer products before they hit the market. As of now, there’s no security check on technology devices prior to them reaching consumers. Over in the United Kingdom, “it’s the Wild West over here as well, right now,” Munro said.

Some startups have emerged that are trying to tackle this issue. One is Thistle Technologies, which is trying to help IoT device manufacturers integrate mechanisms into their software to receive security updates. But it’s unlikely this problem will be fully solved on the back of private industry alone.

Because EV chargers could pose a unique threat to the electric grid, there’s a possibility that EV chargers could fall under the scope of a critical infrastructure bill. Last week, President Joe Biden released a memorandum calling for greater cybersecurity for systems related to critical infrastructure. “The degradation, destruction, or malfunction of systems that control this infrastructure could cause significant harm to the national and economic security of the United States,” Biden said. Whether this will trickle down to consumer products is another question.