One Modem to Brick Them All -Vulns in EV Charging Comms

One Modem to Brick Them All - Vulns in EV Charging Comms

Speakers: Jan Berens, Red Teamer, Albertronic; Marcell Szakaly, PhD Student, University of Oxford

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=SQz4nySj4hg

Overview

This talk, "One Modem to Brick Them All," delivered by Marcell Szakaly from the University of Oxford and Jan Berens from Albertronic, delves into critical security vulnerabilities found within the Power Line Communication (PLC) modems used in modern Electric Vehicle (EV) charging infrastructure. The speakers expose a widespread issue: the almost universal reliance on just two specific Qualcomm communication chips (QCA7000 and QCA705) across the EV charging ecosystem, many of which run severely outdated and unpatched firmware. Their research reveals fundamental design flaws and implementation oversights that allow for remote denial-of-service attacks, configuration manipulation, and even arbitrary code execution on these crucial components.

The significance of these findings cannot be overstated. EV charging stations are rapidly becoming a vital part of critical infrastructure, and vulnerabilities at this foundational communication layer pose serious risks. Attackers could disrupt charging services, potentially brick individual chargers or entire charging parks, and exploit physical signal leakage to conduct attacks from a distance. The talk not only details the technical exploits but also highlights the systemic challenges of securing complex, long-lifecycle industrial devices, underscoring the urgent need for industry-wide security improvements and a reassessment of PLC technology for such critical applications.

Background

▶ Watch: Talk Introduction and Speaker Background (0:00)

The evolution of EV charging standards has led to a complex communication stack. While basic signaling initiates the connection, the crucial step for modern DC fast charging relies on Power Line Communication (PLC), specifically the HomePlug Green PHY standard. After PLC is established, an IPv6 network is set up for higher-level communication. This talk focuses exclusively on the PLC layer, which is standardized but, as the speakers reveal, subject to varied and often insecure real-world implementations. The primary charging cable standards discussed are CCS, CCS2 (common in Europe), and NACS (or Knax, common in the US), all of which utilize this underlying PLC technology for DC charging.

Motivated by a quest to understand real-world deployments and the security posture of the PLC layer, the researchers developed an EV emulator box. This portable device, comprising a Raspberry Pi, a power line modem, and a custom circuit board for electrical signaling, allowed them to safely connect to real EV chargers via data pins (avoiding power connections for safety). Using custom Python and C code (publicly available), the box emulated a normal EV, collecting data on charger capabilities and implementation details. Their extensive road trip across four European countries yielded data from 697 CCS plugs across 26 different manufacturers, including devices manufactured from 2013 to 2023, providing a comprehensive snapshot of the ecosystem's state. This study built upon prior work, notably the 2022 DEF CON talk by Sebastian Schinzel, which disclosed the Broken Wire attack, demonstrating how to wirelessly jam wired EV charging communications with minimal power, an attack believed to be fixable via firmware updates.

Key Findings

▶ Watch: Understanding EV Charging: Power Line Communication (2:30)

The research uncovered several alarming issues regarding the security of EV charging modems:

• Ubiquitous and Outdated Hardware: The study revealed that virtually all tested chargers rely on one of two specific Qualcomm communication chips: the QCA7000 or the QCA705. These chips, while ostensibly different, are functionally very similar. This monoculture means that any fundamental vulnerability in these chips or their default firmware affects a vast majority of the EV charging infrastructure.
• Pervasive Ancient Firmware: Over half of the chargers surveyed were found to be running firmware that was more than 10 years old, with versions from 2013 or 2015 being common. This indicates a severe lack of ongoing maintenance and security patching, leaving devices vulnerable to exploits that have been known for years.
• Unpatched Critical Vulnerabilities: Despite the public disclosure of the Broken Wire attack in 2022, the researchers found no chargers with firmware newer than 2022. This directly implies that the significant wireless jamming vulnerability remains unpatched across the entire ecosystem, allowing attackers to wirelessly disrupt charging sessions.
• The "Pit Buster" Attack and Widespread Configurability Vulnerabilities: A core discovery was the ability to remotely read and write the Parameter Information Block (PIB), a proprietary binary configuration file, via the charging cable. This feature, intended for home network management, allows a rogue EV to overwrite a charger's configuration (and vice versa). The researchers confirmed that 41 out of 41 PIBs downloaded from chargers in California demonstrated no write protection, indicating a widespread vulnerability that allows for remote device bricking by uploading a malicious PIB that instructs the modem to cease all communication.
• Reset Bypass of Security Controls: Even when a specific security bit (at offset 1F8C within the PIB) was enabled to block remote configuration writes, the researchers found that a simple remote reset command was still accepted. This reset caused the device to revert to a hidden factory default configuration where the security bit was effectively disabled, allowing subsequent malicious configuration changes.
• Physical Layer Leakage and Ground Attacks: The high-frequency nature of PLC (1-30 MHz) leads to significant electromagnetic signal leakage (common mode injections), allowing communication to be sniffed or jammed wirelessly from a distance using inexpensive tools or even a spare wire. Furthermore, the shared PEN system ground between the car and charger means that an attacker can inject signals or perform denial-of-service attacks by connecting to any nearby ground point, such as building ground terminals, Ethernet cable shields, or even a car's wheel screws, making physical mitigation extremely difficult.

Technical Deep Dive

▶ Watch: Building the EV Emulator Research Tool (4:00)

The technical foundation of EV charging communication, particularly for DC fast charging, relies on Power Line Communication (PLC). This technology, specifically HomePlug Green PHY, is essentially Ethernet over power line, converting Ethernet packets into a waveform transmitted over the power cables. The speakers emphasize its similarity to Wi-Fi in terms of modulation schemes, though they are not compatible. A critical observation is the industry's reliance on just two Qualcomm chips, the QCA7000 and QCA705, which are part of the same product line used in consumer home network adapters. This commonality proved to be a significant enabler for their research.

The lack of public datasheets or firmware images for these chips initially presented a hurdle. However, the discovery that the same underlying technology is used in consumer Ethernet over power line adapters was a breakthrough. Qualcomm provides an open-source utility package, open PLC utils, for configuring and diagnosing these modems in a home network context. Remarkably, these tools work "flawlessly" on the EV charging chips, despite their intended industrial application.

A key component discovered through open PLC utils is the Parameter Information Block (PIB). This is a large, proprietary binary block that acts as the modem's configuration file. It lacks metadata or key-value pairs; instead, settings are located at specific memory offsets. Important settings include the MAC address, manufacturer string, and the Network Membership Key, which functions like a Wi-Fi pre-shared key for the HomePlug network formed between the EV and charger. The PIB can be read and written from the host system via special management messages over Ethernet.

The Pit Buster attack leverages a feature in open PLC utils designed for home networks: the ability to remotely update other modems in the network. By simply replacing the local MAC address with a remote one, an attacker can send configuration overrides to another modem over the power lines. In the EV context, this means a rogue EV can overwrite the configuration of a charger, and vice-versa. A malicious PIB can easily "brick" a device by instructing the modem to cease all communication, effectively rendering it inoperable.

Initial lab testing showed the attack worked on some devices but not others, leading to the hypothesis that a security setting existed within the PIB. Through a meticulous binary search process, comparing vulnerable and secure PIBs, the researchers pinpointed a single byte at offset 1F8C. If this byte is set to 0, reading and writing via the power lines is allowed; if set to 1, it is blocked. Their field study in California, where they successfully read PIBs from 41 out of 69 chargers, confirmed that all 41 lacked this write protection, making them vulnerable.

Further investigation uncovered a bypass for the security bit. Even when the bit was set (blocking PIB writes), a remote reset command was still accepted. This reset caused the modem to fall back to a hidden, default factory configuration where the security bit was not set, re-enabling remote PIB writes. While this allows for temporary disruption and configuration changes, its persistence depends on the modem's boot mechanism. In devices that use host booting (common in cars), the host controller reflashes the configuration at every boot, meaning any malicious changes would be reverted upon reboot. However, the attack can still interrupt charging sessions indefinitely until a reboot occurs.

Beyond configuration attacks, the talk delves into the physical layer. The high-frequency nature of PLC (1-30 MHz) generates strong electromagnetic fields, leading to common mode injections. This signal leakage means communication can be passively sniffed or actively jammed wirelessly. While expensive CCS listener devices with induction coils exist for development, the researchers showed that a cheaper development board or even a simple piece of wire can pick up the signals from up to a meter away without amplification. This confirmed the feasibility of the Broken Wire attack (an SDR-based wireless jamming technique) and led to a new discovery: the ground terminal attack. Because the car and charger form a PEN system (Protective Earth and Neutral combined), they share a common ground. This allows an attacker to inject signals or perform denial of service (DoS) by connecting to any nearby ground, such as a building's ground terminal, the shield of an Ethernet cable, or even the screws on a car's wheel. DoS is particularly easy because PLC uses a sliding window protocol; flooding the windows with rogue packets effectively halts all communication, and finding such a rogue device connected to ground is "literally impossible."

The deepest dive involved firmware analysis and achieving code execution. By examining a developer board, the researchers identified the QCA chip and its connection to an external flash chip via SPI (Serial Peripheral Interface). They dumped the 2MB flash chip, revealing an NVM chain structure – a doubly linked list of headers and data blocks containing firmware and configuration. The boot chain involves a soft loader, several small code modules, a firmware loader, and finally, the main firmware image. Initial analysis suggested the main firmware was encrypted, but further reversing of the firmware loader (which was standard ARM v5 code) revealed it was merely LZMA compression.

Achieving code execution was possible because the soft loader and initial code modules were neither encrypted nor signed, allowing modification of the flash chip to execute arbitrary code. The challenge was the lack of I/O, as most peripherals (PLC, Ethernet, GPIOs) are only initialized by the main, compressed firmware. To overcome this, they devised a clever exfiltration method: using the SPI interface for reading the flash chip, they treated the data they wanted to exfiltrate (e.g., bootloader memory) as memory addresses and issued read commands. By sniffing the SPI commands with a logic analyzer, they could reassemble the entire bootloader image. This revealed more hardware interfaces (host SPI, flash SPI, and even Ethernet drivers for variants of the chip). With the ability to decompress the firmware and a deeper understanding of the bootloader, the path is now open for creating C headers for peripherals, decompiling the main firmware, and ultimately developing custom firmware for the PLC modems, enabling new functionalities or even more potent hacking tools.

Demo / Proof of Concept

▶ Watch: Key Finding: Old Modem Firmware on Chargers (6:00)

The talk featured several compelling demonstrations to illustrate the discovered vulnerabilities:

1. PIB Write Protection and Bypass Demo:

• Using open PLC utils, the speakers demonstrated how to interact with the modem.
• They first showed how to modify the PIB to set the security bit (at a specific offset in the raw file) to block remote communication.
• After flashing this modified PIB to a victim modem, they attempted to read information from it using an attacker modem. As expected, the communication was blocked, confirming the security bit's function.
• However, they then demonstrated the reset bypass. Even with the security bit active, a remote reset command was accepted. Immediately after the reset, they could successfully dump the victim modem's configuration again, showing that the security bit was no longer present in the active configuration. This illustrated how a fundamental security control could be circumvented by simply issuing a reset, causing the device to fall back to an insecure default.

1. Doom on Chip Demo:

• This proof of concept dramatically showcased the extent of arbitrary code execution achieved on the Qualcomm QCA chip.
• A development board containing the QCA chip was connected to a computer via Ethernet.
• Upon plugging the chip into power, it booted up, established a UDP connection to the host computer, and began sending video frames.
• The screen then displayed a live, custom version of Doom running directly on the QCA modem chip. Input (keyboard and mouse) was sent from the host computer to the chip via UDP.
• This demo, while humorous, underscored the profound level of control an attacker could achieve over these modems once code execution is established, demonstrating the ability to run custom, complex software far beyond their intended purpose.

Defensive Implications

▶ Watch: Key Finding: Unpatched 'Broken Wire' Vulnerability (7:30)

The findings presented in this talk paint a concerning picture for the security of EV charging infrastructure, demanding immediate and sustained defensive action.

Firstly, the widespread use of outdated firmware and the lack of patching for known vulnerabilities (like the Broken Wire attack) highlights a critical need for robust firmware update mechanisms and policies. Qualcomm, as the chip manufacturer, must release patches for the discovered vulnerabilities, and EV charger manufacturers and operators must prioritize the deployment of these updates. Given the long lifecycle of industrial devices, this will be a significant logistical challenge, with the speakers estimating a decade for widespread adoption, if ever. The current slow pace of updates leaves a massive attack surface exposed.

Secondly, the "Pit Buster" attack and its reset bypass mechanism demonstrate that fundamental configuration security is lacking. Charger manufacturers should ensure that the security bit within the PIB (at offset 1F8C) is enabled by default in all deployed devices and that the reset function does not revert to an insecure state. Ideally, a robust authentication mechanism should be required for any configuration changes or resets over the PLC, preventing unauthorized manipulation.

Thirdly, the physical layer vulnerabilities, including common mode injections and the ground terminal attack, are particularly challenging to mitigate. While using shielded cables and adding ferrite cores to input wires might offer some minimal protection against signal leakage, the shared PEN system ground between the car and charger fundamentally exposes the communication to interference from any nearby ground point. This implies that physical security measures around charging stations need to be re-evaluated, and reliance on the physical isolation of the cable is insufficient. Monitoring for unusual electromagnetic activity or unexplained charging disruptions could be part of a detection strategy.

Finally, the fundamental design flaws of the SLAC protocol (used to establish PLC), which transmits the Network Membership Key in clear text, mean that anyone sniffing the communication can easily join the network and manipulate traffic. The speakers strongly suggest that PLC is "broken beyond repair" for critical infrastructure and should be replaced with more secure communication technologies. Until such a replacement is feasible, robust network segmentation, intrusion detection systems, and anomaly detection at the higher IPv6 layer are crucial to identify and potentially block malicious PLC traffic.

Key Takeaways

• A vast majority of EV chargers rely on two specific, often outdated, Qualcomm PLC modems (QCA7000/705), creating a widespread single point of failure.
• More than half of deployed chargers run firmware over a decade old, leaving them vulnerable to unpatched exploits, including known wireless jamming attacks (Broken Wire).
• The "Pit Buster" attack allows remote bricking or configuration manipulation of chargers by exploiting a design flaw in the Parameter Information Block (PIB) update mechanism, with 100% of tested California chargers found vulnerable.
• A "reset bypass" vulnerability exists, allowing attackers to disable security configurations even when explicitly set, by forcing a device reset that reverts to an insecure default state.
• Physical attacks are enabled by common mode injection (signal leakage) and a novel "ground terminal attack," allowing remote denial-of-service from any nearby ground point due to shared infrastructure grounding.
• Researchers achieved arbitrary code execution on the modems, demonstrating deep control over the hardware, including running custom software like Doom.
• The fundamental SLAC protocol is insecure, transmitting network keys in clear text, and the industry faces a decade-long challenge to patch and update vulnerable infrastructure.

About the Speaker(s)

Marcell Szakaly is a PhD student at the System Security Lab at the University of Oxford. His doctoral research focuses on the security of EV charging systems, a field where he is supported by technical expertise and funding from Armaswiss. Marcell also engages in independent research projects, often delving into more "fun" security topics that may not fit traditional academic papers. He has made the source code for his EV emulator box publicly available through his research group's GitHub.

Jan Berens works as a red teamer for Albertronic, one of the largest EV charger manufacturers globally. In addition to his professional role, Jan conducts his own security research, much of which cannot be publicly disclosed due to its sensitive nature. He is also a dedicated volunteer at various conferences, including DEF CON, where he serves as a "goon."