Charging Ahead: Exploiting an EV Charger Controller at Pwn2Own 24

Charging Ahead: Exploiting an EV Charger Controller at Pwn2Own 24

Speakers: Alex Plaskett, Exploit Development Group, NCC Group; McCaulay Hudson, Exploit Development Group, NCC Group

Conference: 44CON

YouTube: https://www.youtube.com/watch?v=ct8yVPw6ayQ

Overview

This talk, "Charging Ahead: Exploiting an EV Charger Controller at Pwn2Own 24," delivered by Alex Plaskett and McCaulay Hudson from NCC Group's Exploit Development Group, details their successful campaign at the inaugural Pwn2Own Automotive competition. The presentation focuses on the Phoenix Contact Charx SE C 3100, a critical component used in building Electric Vehicle (EV) charging infrastructure. Plaskett and Hudson provide a comprehensive walkthrough of their vulnerability research methodology, reverse engineering challenges, and the exploit chain that led to unauthenticated root code execution on the target device.

The research highlights the nascent state of security in the rapidly expanding EV charging ecosystem. With governments worldwide, including the UK, pushing for a transition to electric vehicles and projecting hundreds of thousands of public charging points in the coming years, the security of this infrastructure is paramount. Compromised EV chargers could lead to widespread disruption, privacy breaches, fraud, or even pose risks to the electrical grid and connected vehicles. This talk serves as a crucial wake-up call, demonstrating that even foundational components of this critical infrastructure are susceptible to relatively straightforward attacks, underscoring the urgent need for enhanced security measures.

The Pwn2Own Automotive competition, a new category introduced by Trend Micro's Zero Day Initiative (ZDI), specifically targets devices within the automotive sector, including in-vehicle infotainment systems, operating systems, and EV chargers. NCC Group's participation and successful exploitation of an EV charger controller not only earned them prize money and disclosure to the vendor but also provided invaluable insights into the current threat landscape for these devices. The findings presented reveal a landscape ripe for exploitation, characterized by common weaknesses such as input validation flaws, default credentials, and insecure configuration management, even in devices designed for critical infrastructure deployment.

Background

▶ Watch: Talk introduction and Pwn2Own Automotive competition overview (0:00)

The context of this research is rooted in the evolving landscape of cybersecurity competitions and the critical importance of secure infrastructure. Pwn2Own, a renowned vulnerability research competition, expanded its scope with the introduction of Pwn2Own Automotive. Unlike previous iterations focusing on desktop or mobile software, this new category specifically targets automotive technologies, acknowledging the increasing interconnectedness and complexity of vehicles and their supporting infrastructure. Notably, Pwn2Own Automotive allowed for physical access to devices during the research phase, reflecting the real-world accessibility of public EV chargers, though physical hardware attacks were prohibited during the competition itself. This distinction is crucial, as it recognizes that attackers might have opportunities for initial reconnaissance or setup that go beyond purely remote network access.

The growing reliance on Electric Vehicles necessitates a robust and secure charging infrastructure. The UK, for instance, aims to ban the sale of petrol cars by 2035, projecting over 300,000 public EV charging points by 2030. This exponential growth in deployment underscores the criticality of securing these devices. EV chargers can be categorized into private residential, public Charging Point Operator (CPO), and Strategic Road Network (SRN) types. The device targeted by NCC Group, the Phoenix Contact Charx SE C 3100, falls into the latter two categories. It's not a consumer-grade residential charger but rather a sophisticated control module designed for integrators to build their own EV charging infrastructure. This module runs an embedded Linux system, supports the Open Charging Point Protocol (OCPP) for backend management, and even offers Vehicle-to-Grid (V2G) communication capabilities. Its "developer-friendly" nature, with REST API and MQTT API documentation, ironically also expands its attack surface.

NCC Group's approach to attack surface research began with a thorough understanding of the physical interfaces. The Charx SE C 3100 exposes a SIM card slot (for V2G), a microSD card slot, a USB port (potentially for admin access), and two Ethernet ports (LAN and WAN). Beyond physical access, the device exhibits an interesting "device state" concept, operating in either client mode or server mode. This mode dynamically alters the exposed network services and outbound communication patterns. For attackers, understanding and potentially manipulating these states is key. The team discovered that a server-to-client mode switch could be triggered by simply running a DHCP server on the 192.168.4.0/24 range, while a client-to-server switch could be forced by interacting with an undocumented service to change the system name to "ev3000," bypassing typical web interface authentication.

The external network attack surface varies significantly between WAN and LAN ports, and between client and server modes. Common services like SSH, NTP, and mDNS were present, but the most promising targets were the custom services written by Phoenix Contact. These included the web admin interface on port 80, a REST API on port 5000, and several other undocumented custom REST services that required extensive reverse engineering. To automate and streamline their initial analysis, NCC Group developed an in-house tool called Thermalizer. This tool takes an unpacked firmware image and extracts crucial information such as user accounts, password files, running binaries, and applied security mitigations. Thermalizer also supports firmware diffing, allowing researchers to quickly identify changes between versions, such as altered binaries or mitigation updates, to focus their efforts on potentially vulnerable areas.

Key Findings

▶ Watch: Pwn2Own competition rules, including physical access (3:30)

NCC Group's research into the Phoenix Contact Charx SE C 3100 yielded several critical vulnerabilities, demonstrating significant security weaknesses in this foundational EV charging component. The team identified and exploited three distinct vulnerability chains, two of which were reported post-competition, while the third was successfully used to achieve root code execution at Pwn2Own Automotive.

The first vulnerability chain, which was not used in the competition but reported subsequently, revealed a critical flaw in firmware update management. It was discovered that a firmware update would reset the app user's password to default credentials. The NCC Group team devised a method to force a firmware update without authentication. By setting up a DHCP server to trick the Charx into client mode, and then hosting a fake web server to present a legitimate, signed firmware update (even if it was the same version), they could trigger a reboot. Post-reboot, the app user's password would revert to its default, allowing SSH access and subsequent password change. This vulnerability was assigned CVE-2024-27954 with a CVSS score of 8.6, highlighting a significant security oversight.

The second vulnerability uncovered was a straightforward privilege escalation (PE) bug, also not used in Pwn2Own due to its nature but crucial for the research process to gain root access for debugging. This vulnerability exploited a misconfiguration in the sudo privileges. The app user, once logged in (either through physical access or by exploiting CVE-2024-27954), could execute a custom Phoenix Contact script named CHX_pack_logs with sudo permissions. This script, intended for log packing, passed user-supplied input directly to the tar utility. By injecting specific tar options, specifically --checkpoint and --checkpoint-action=exec /bin/sh, the app user could force tar to execute an arbitrary shell command as root, thereby achieving a root shell. While this was a duplicate report, it underscores the prevalence of basic configuration weaknesses.

The primary and most impactful finding, which secured the Pwn2Own Automotive win, was a sophisticated unauthenticated remote code execution (RCE) chain combining an arbitrary file upload with a configuration injection. This exploit, assigned CVE-2024-27953, allowed the team to upload a malicious shell script to the device's file system and then trigger its execution as root. The core of this RCE involved exploiting a custom, undocumented REST endpoint that allowed the upload of arbitrary file content, despite some filename validation. The uploaded file, stored at a fixed path (/dupicar_abc.db), was inexplicably given executable permissions. Subsequently, by manipulating the device's mode (client to server) and leveraging an unauthenticated configuration service (system_config_manager), the team injected commands into the pppd (Point-to-Point Protocol Daemon) configuration. Specifically, pppd options like init, connect, or welcome could be set to execute a script upon a cellular connection attempt. By injecting the path to their uploaded script into one of these pppd options, and then forcing a reboot, the script would execute as root. This multi-stage attack demonstrated a profound lack of input validation and secure design principles.

Overall, the findings from Pwn2Own Automotive painted a concerning picture of EV charger security. All targeted chargers at the competition were successfully exploited, predominantly through "simple bugs" such as input validation flaws, memory safety issues (even in native code alongside managed languages), and logic vulnerabilities stemming from cleartext communication, insecure network configurations, and firewall misconfigurations. The NCC Group team noted that the time investment for these exploits was not "significant months," suggesting that the "low-hanging fruit" vulnerabilities were still prevalent across the tested devices, indicating a general immaturity in the security posture of these critical infrastructure components.

Technical Deep Dive

▶ Watch: Importance of EV charger security and infrastructure growth (4:40)

The technical journey to exploiting the Phoenix Contact Charx SE C 3100 involved a meticulous process of attack surface mapping, advanced reverse engineering, and a chained exploitation strategy.

The initial phase focused on attack surface research. Physically, the device presented a SIM card slot, microSD card slot, USB port, and two Ethernet ports (LAN/WAN). While hardware attacks were disallowed in Pwn2Own, understanding these interfaces was crucial for initial reconnaissance and potential debug access during preparation. A unique aspect of the Charx was its device state: it could operate in client mode or server mode, dynamically altering its exposed network services. The team discovered two critical mode-switching vulnerabilities:

1. Server to Client: Running a DHCP server on the 192.168.4.0/24 range would cause the Charx to switch from server to client mode, expecting the DHCP server to be a Charx server.
2. Client to Server: An undocumented vulnerability allowed interaction with a service to change the system_name configuration setting to "ev3000," which would force a client-to-server mode switch upon reboot, bypassing administrative authentication normally required for such changes.

Network-wise, the attack surface varied significantly based on the port (LAN/WAN) and the device mode. Standard services like SSH, NTP, and mDNS were present, but the primary focus was on custom services implemented by Phoenix Contact. These included a web admin interface on port 80, a REST API on port 5000, and several other undocumented REST services that required extensive reverse engineering. To aid this, NCC Group utilized their in-house tool, Thermalizer, which automates the analysis of unpacked firmware images, extracting details like users, password files, binaries, and security mitigations, and facilitating firmware diffing.

Reverse Engineering Challenges:

A significant hurdle was that many custom binaries were written in Python but compiled with Cython into C/C++ code. This conversion made static analysis challenging; a single line of Python could generate hundreds or thousands of lines of boilerplate C code, obscuring the original logic. To overcome this, McCaulay Hudson developed custom Ghidra scripts to retype symbols, rename functions and variables, and leverage the stringTab structure (which stores all Python strings) to reconstruct the original Python logic. By cross-referencing string usage in the C code, the team could effectively "puzzle the pieces back" and understand the original Python's intent, even if an exact reconstruction wasn't possible. This allowed them to identify potential vulnerabilities within the custom service logic.

To accelerate the testing process before physical devices arrived, the team performed dynamic analysis using QEMU emulation. They extracted the unencrypted firmware from the vendor's website, chrooted into the file system with qemu-arm-static, and modified configuration files to enable debugging and run custom services in their emulated environment. While some hardware-dependent functionality didn't work, the majority of the custom services were operational, allowing early vulnerability testing.

Vulnerability Chain 1: Firmware Update Password Reset (CVE-2024-27954, CVSS 8.6)

This vulnerability involved resetting the app user's password to default credentials upon a firmware update.

1. Trigger Client Mode: An attacker runs a DHCP server on the 192.168.4.0/24 network, causing the Charx (initially in server mode) to switch to client mode, treating the attacker's host as its management server.
2. Fake Firmware Server: The attacker then runs a fake web server. When the Charx (now in client mode) performs HTTP requests for firmware updates, the fake server responds, advertising the latest legitimate firmware version from Phoenix Contact. The Charx accepts legitimate, signed firmware even if it's the same version or higher.
3. Forced Reboot & Reset: The Charx downloads and installs the firmware, triggering a reboot. Crucially, this process resets the app user's password to its default.
4. SSH Access: The attacker can then SSH into the device using the default app credentials, set a new password, and gain low-privileged user access.

Vulnerability Chain 2: Privilege Escalation via sudo tar (Duplicate Report)

This PE vulnerability required initial low-privileged access (e.g., via CVE-2024-27954 or physical access).

1. app User Access: As the app user, the attacker examines the /etc/sudoers file.
2. Vulnerable sudo Script: They discover a custom script, CHX_pack_logs, which can be executed as root via sudo without password. This script takes a filename as input.
3. tar Command Injection: The script internally constructs a tar command, passing the user-supplied filename directly. By appending tar options like --checkpoint=1 and --checkpoint-action=exec /bin/sh to the filename, the attacker can force tar to execute /bin/sh as root, yielding a root shell.

Vulnerability Chain 3: Pwn2Own RCE (CVE-2024-27953)

This was the winning exploit chain, achieving unauthenticated root code execution.

1. Arbitrary File Upload (Server Mode): The attack begins with the Charx in server mode. The team discovered a custom, undocumented REST endpoint (/return_database) that allowed uploading arbitrary file content. Although there was some validation to prevent path traversal in the filename, there was no validation on the file content itself. The uploaded file was stored at a fixed path, /dupicar_abc.db, and critically, was uploaded with executable permissions, despite being ostensibly a database file. This allowed the attacker to plant a malicious shell script on the device's filesystem.
2. Mode Switch to Client: The attacker then triggers a server-to-client mode switch by running a DHCP server on the 192.168.4.0/24 range.
3. Config Injection (Client Mode): While in client mode, the system_config_manager service (accessible unauthenticated) allows setting configuration values. The team found that some values in Phoenix Contact's proprietary configuration file would propagate into the pppd (Point-to-Point Protocol Daemon) configuration file, specifically within the cellular network section. While direct newline injection was blocked, pppd supports multiple options on the same line separated by spaces.
4. pppd Script Execution: The team leveraged pppd options like init, connect, or welcome, which are designed to execute a specified script when a cellular network connection event occurs. By injecting welcome /dupicar_abc.db (or init/connect with the path to their uploaded script) into an existing pppd configuration value (e.g., idle-disconnect by appending it with a space), they configured pppd to execute their payload.
5. Mode Switch to Server & Reboot: The device is then switched back to server mode (by changing system_name to "ev3000" via the same system_config_manager service) and rebooted using an unauthenticated reboot endpoint.
6. Root Code Execution: Upon reboot, the Charx attempts to establish a cellular connection (as it's now in server mode). This triggers the pppd daemon, which then executes the planted script (/dupicar_abc.db) as root, achieving unauthenticated remote code execution.

This multi-stage exploit showcased a blend of unauthenticated access, improper input validation, and insecure configuration propagation, culminating in full system compromise.

Demo / Proof of Concept

▶ Watch: Technical details of the CHARX control module (7:30)

The demonstration for the Pwn2Own Automotive competition focused on proving root code execution within the strict 10-minute time limit. For the winning exploit (CVE-2024-27953), the NCC Group team executed a sequence of actions culminating in a visual confirmation of compromise rather than a direct root shell, due to timing considerations.

The demonstration started with the Phoenix Contact Charx SE C 3100 in its default server mode. The first step involved the arbitrary file upload. The team used their crafted exploit to send an HTTP request to the undocumented /return_database endpoint, uploading a custom shell script. This script, designed for the competition, performed two primary actions: triggering a "light show" on the device's LEDs and resetting the app and root user passwords for persistent access.

Next, the exploit triggered the mode switch to client mode by initiating a DHCP server on the attacker's host. Once the Charx transitioned, the configuration injection phase began. The team interacted with the unauthenticated system_config_manager service, sending specific REST API requests to modify the cellular network configuration. This injection appended the welcome /dupicar_abc.db option to an existing pppd configuration line, effectively telling the daemon to execute their uploaded script upon a cellular connection attempt.

Following the injection, the device was forced back into server mode by changing the system_name via the system_config_manager service. Finally, an unauthenticated reboot endpoint was called. This reboot was critical, as it caused the device to re-initialize in server mode and attempt to establish a cellular connection. Upon this attempt, the pppd daemon executed the welcome script, which was the malicious payload previously uploaded.

The proof of concept for the judges was the immediate "light show" on the Charx's LEDs. This visual cue provided instant confirmation of root code execution, which occurred within approximately 8-9 minutes of the 10-minute competition window. While the shell script also reset the app and root passwords, allowing for a root shell, accessing the SSH service took around 11 minutes due to boot-up times. To ensure they met the competition's strict time limits, the light show served as a more reliable and timely indicator of success. This pragmatic decision highlights the real-world pressures of live exploitation competitions.

Defensive Implications

▶ Watch: Initial approach to attack surface research (8:00)

The successful exploitation of the Phoenix Contact Charx SE C 3100 at Pwn2Own Automotive carries significant defensive implications for the EV charging infrastructure and the broader IoT/ICS landscape. The vulnerabilities discovered, while not overly complex, demonstrate that critical components of a rapidly expanding and essential infrastructure are susceptible to relatively straightforward attacks.

For EV Charger Manufacturers and Integrators:

• Robust Input Validation: The prevalence of input validation flaws (e.g., the arbitrary file upload, sudo tar injection) underscores the need for stringent validation of all user-supplied input, both in terms of content and format, across all interfaces (web, REST APIs, configuration files).
• Secure Firmware Update Mechanisms: The firmware update password reset vulnerability highlights the need for secure handling of credentials during updates. Firmware updates should maintain existing user configurations or provide clear, secure mechanisms for password management that do not revert to insecure defaults.
• Principle of Least Privilege: The sudo misconfiguration allowing privilege escalation demonstrates a failure to apply the principle of least privilege. Custom scripts should be carefully reviewed to ensure they only execute necessary commands with the minimum required permissions.
• Comprehensive Attack Surface Review: The varying attack surface based on device mode (client/server) and network port (LAN/WAN) indicates that manufacturers must conduct thorough security reviews across all possible operational states and network configurations. Undocumented REST APIs are a particular risk.
• Secure-by-Design and Code Review: The use of Cython-compiled Python introduces complexity, but ultimately, the underlying logic flaws persist. A focus on secure coding practices and rigorous code reviews, even for managed languages, is essential to catch logic bugs before deployment.
• Default Credentials and Hardcoded Values: The repeated reliance on default or easily discoverable credentials, or the ability to force them, is a fundamental security weakness that must be eliminated.
• Supply Chain Security: As these devices are components in larger infrastructure, ensuring the security of third-party libraries and modules is also critical.

For EV Charging Point Operators and Infrastructure Deployers:

• Network Segmentation: Deploying EV chargers within segmented network zones can limit the blast radius of a compromise. Isolating chargers from critical backend systems and corporate networks is crucial.
• Monitoring and Logging: Comprehensive logging and security monitoring are essential to detect anomalous behavior, such as unauthorized mode switches, unusual API calls, or unexpected reboots.
• Regular Patching: Operators must ensure that chargers are kept up-to-date with the latest firmware patches from vendors. The ease of exploitation demonstrated by NCC Group emphasizes the urgency of timely patching.
• Physical Security: While physical hardware attacks are out of scope for Pwn2Own, the availability of physical interfaces (USB, microSD, Ethernet ports) means that physical security measures for publicly accessible chargers are paramount to prevent initial access.
• Cloud Security: As noted in the talk, many EV charging backend systems utilize cloud infrastructure. Operators must ensure robust access controls and secure configurations for cloud environments to prevent privacy breaches and data leaks.

Broader Threat Landscape:

The post-exploitation discussion highlighted several alarming potential threats:

• Reputational Damage and Defacement: Already observed in the wild, compromised chargers displaying offensive messages can erode public trust.
• Privacy and Data Leakage: Insecure backend systems can expose sensitive user data.
• Mass Disruption and Ransomware: The most concerning threat is the ability to build a botnet of compromised chargers, enabling denial-of-service attacks or ransomware campaigns against an entire country's EV charging infrastructure. This could cripple transportation and have severe economic impacts, especially as EV adoption increases.
• Electrical Grid Disruption: Research suggests that compromising multiple chargers could potentially cause instability or disruption to the electrical grid, especially with widespread V2G capabilities.
• Fraud and Power Theft: Attackers could enable free charging or manipulate payment systems.
• Vehicle Attacks: The emerging threat of attacking connected vehicles through a compromised charger, leveraging communication protocols between the car and the charger, represents a new frontier for automotive security.

The Pwn2Own results, where "every single" charger was hacked, often through "simple bugs," should serve as a wake-up call. The relative ease and low time investment for these exploits indicate a lack of mature security practices in the EV charging sector. Defenders must prioritize fundamental security hygiene, conduct thorough security assessments, and advocate for more robust security engineering throughout the design, development, and deployment lifecycle of EV charging infrastructure.

Key Takeaways

• EV Charger Security is Immature: All EV chargers targeted at Pwn2Own Automotive were successfully exploited, predominantly through "simple bugs" like input validation flaws, default credentials, and insecure configurations, indicating a significant lack of mature security practices.
• Attack Surface is Broad and Complex: EV chargers present a rich attack surface, encompassing physical interfaces (USB, microSD, SIM), varying device states (client/server modes), and numerous network-accessible custom services, many of which are undocumented.
• Firmware Update Processes are Critical Vulnerabilities: Insecure firmware update mechanisms, such as those that reset user passwords to defaults (CVE-2024-27954), provide clear pathways for unauthenticated access.
• Input Validation is Paramount: Basic input validation failures, as demonstrated by the arbitrary file upload (CVE-2024-27953) and sudo tar injection, can lead directly to remote code execution and privilege escalation.
• Managed Languages Don't Eliminate Logic Bugs: Even when code is written in managed languages like Python and compiled with Cython, logic vulnerabilities, configuration flaws, and issues in native code components (e.g., pppd) remain critical attack vectors.
• Potential for Significant Real-World Impact: Compromised EV chargers pose threats ranging from reputational damage and privacy breaches to large-scale disruption, ransomware attacks on critical infrastructure, electrical grid instability, and even direct attacks on connected vehicles.

About the Speaker(s)

Alex Plaskett and McCaulay Hudson are members of the Exploit Development Group at NCC Group. Their work focuses on vulnerability research and exploit development across various technologies. As demonstrated in their Pwn2Own Automotive participation, they possess expertise in embedded systems security, reverse engineering, and finding novel ways to compromise complex devices. Alex noted that Pwn2Own Automotive was his "first time looking at Automotive components," highlighting the adaptability and broad skill set within their team at NCC Group, which benefits from extensive automotive and hardware security experience within the company.