Clashing EV Chargers in The Pentesting Arena

Clashing EV Chargers in The Pentesting Arena

Speakers: Abdellah Benotsmane, Junior Security Researcher, PCAutomotive

Conference: Hacktivity

YouTube: https://www.youtube.com/watch?v=sYYmet2WxUE

Overview

In an era of rapidly accelerating electric vehicle (EV) adoption, the security of their charging infrastructure has become a critical concern. Abdellah Benotsmane, a Junior Security Researcher at PCAutomotive, delivered a compelling talk at Hacktivity titled "Clashing EV Chargers in The Pentesting Arena," shedding light on pervasive vulnerabilities found in modern EV charging stations. This presentation offered a deep dive into various attack surfaces, from physical hardware access and network services to web interfaces and wireless protocols like Bluetooth, demonstrating how seemingly disparate weaknesses can be chained together for significant impact.

Benotsmane's research highlights that many EV chargers, despite being increasingly connected and deployed in diverse public and private settings, often lack fundamental security protections. The talk meticulously detailed the methodologies used to compromise three distinct EV charger models, revealing vulnerabilities that could lead to unauthorized free charging, denial-of-service (DoS) attacks, remote code execution, and even the compromise of private networks. This work underscores the urgent need for enhanced security-by-design principles in the development and deployment of EV charging technology, emphasizing that securing these devices is paramount for the reliability and safety of future transportation ecosystems.

The implications of these findings extend beyond individual charging sessions, touching upon critical infrastructure security. As EV chargers become more ubiquitous and integrated into smart grids, their exploitation could have widespread consequences, from financial losses for operators to grid instability and privacy breaches for users. Benotsmane's comprehensive analysis serves as a stark reminder for both manufacturers and operators to prioritize robust security measures, urging a shift towards proactive penetration testing and adherence to secure coding practices to safeguard this vital component of the automotive industry's future.

Background

▶ Watch: Introduction and talk agenda (0:00)

The proliferation of electric vehicles has led to a corresponding surge in the deployment of EV charging stations, transforming them from niche amenities into critical components of modern infrastructure. This rapid expansion, coupled with their inherent connectivity, has unfortunately created a fertile ground for cyber threats. Unlike traditional, isolated electrical appliances, modern EV chargers are often internet-connected, managed by central systems, and interact with mobile applications, introducing a vast array of potential attack vectors.

Benotsmane's research specifically targets the latest generation of EV chargers, designed for both private and commercial use. The motivation behind this focus stems from the understanding that these devices are no longer simple power outlets but complex embedded systems with significant computational capabilities and network exposure. The problem often arises from a historical lack of security considerations during the design phase of many embedded systems, which are now being retrofitted with connectivity features without adequate security hardening.

Prior work in this domain, as referenced by the speaker, includes a valuable global study published in the year prior to the talk. This research reviewed common cyberattacks and defenses pertinent to EV chargers, establishing a foundational framework for analysis. Building upon this, Benotsmane and his team aimed to delve deeper, providing practical, hands-on insights into real-world vulnerabilities.

A crucial first step in assessing the security of embedded systems like EV chargers is firmware extraction. The talk outlined several methods for obtaining firmware:

1. Vendor Official Websites: While seemingly straightforward, this is often not a reliable source as vendors may not publicly release firmware images.
2. Leaked Firmware Images: These might surface on the internet through unofficial channels.
3. Intercepted Auto-Updates: Monitoring network traffic during firmware updates can reveal the source and accessibility of new images.
4. Direct Memory Chip Extraction: This "hands-on approach" involves physically accessing and dumping the firmware from memory chips on the device's board. Benotsmane emphasized that this was the method successfully employed for their target EV chargers, highlighting the necessity of physical access in many penetration testing scenarios. This often involves techniques like desoldering eMMC flash memory chips or utilizing specific test points and tools for direct readout.

This comprehensive approach to firmware acquisition laid the groundwork for the subsequent analysis, allowing the researchers to scrutinize the device's operating system, applications, and configurations for potential weaknesses.

Key Findings

▶ Watch: Charger 1: Heap overflow leading to RCE (10:00)

The research conducted by Abdellah Benotsmane and PCAutomotive uncovered a significant array of vulnerabilities across the three modern EV charger models analyzed, demonstrating a pervasive lack of robust security controls. The core findings revealed that these devices are susceptible to various attack vectors, leading to substantial impacts such as unauthorized free charging, denial-of-service, remote code execution, and sensitive information disclosure.

Among the most critical discoveries were:

• Default Enabled SSH: Two of the three chargers had SSH services enabled by default, often with weak authentication mechanisms (e.g., easily changeable root passwords, default public keys, or even blank passwords for root after configuration manipulation). This immediately provided a high-privilege entry point into the device's operating system.
• Insecure Web Interfaces: Charger one and three exhibited multiple web vulnerabilities, including broken authentication schemes that allowed attackers to bypass login controls or create arbitrary tokens. SQL injection flaws were found in multiple locations, leading to the exfiltration of sensitive data stored in clear text, such as user passwords, Wi-Fi credentials, and IPsec backend logs.
• Remote Code Execution (RCE): This high-impact vulnerability was identified in two chargers. In Charger one, an unvalidated buffer length in a proprietary service led to a heap overflow, allowing for RCE. For Charger two, RCE was achieved by injecting commands via unsanitized user input passed through Bluetooth, leveraging a privilege escalation vector to gain root access.
• Insecure Bluetooth Implementation: Charger two's Bluetooth connectivity relied on the insecure "Just Works" pairing method, eliminating the need for user interaction or authentication. This, combined with a lack of access restrictions on the BGX Express Stream Service, allowed any proximate attacker to fully control the Bluetooth module and, subsequently, the charger's functionalities.
• Binary Security Deficiencies: Charger one's firmware binaries lacked crucial security measures such as debug symbols stripping, input validation, and the absence of exploit mitigation techniques like canaries, DEP (Data Execution Prevention), and ASLR (Address Space Layout Randomization), making low-level binary exploitation significantly easier.
• Sensitive Information Disclosure: Through various attack paths (SQL injection, Bluetooth, TCF agent), the researchers were able to retrieve clear-text Wi-Fi credentials, OCPP endpoint credentials, and backend logs, posing risks to both user privacy and network security.
• Denial of Service (DoS): Exploiting the heap overflow in Charger one or performing a factory reset via a compromised web interface on Charger three could render the charging station non-functional, disrupting services for approximately 3 minutes in one demonstrated scenario.

These findings collectively paint a picture of an industry where security often lags behind innovation, leaving critical infrastructure components exposed to a wide range of cyber threats.

Technical Deep Dive

▶ Watch: Charger 2: Bluetooth exploit for OCPP credentials (19:00)

The technical deep dive into the three EV chargers revealed a series of sophisticated attack vectors and exploitable vulnerabilities. The methodology often involved chaining multiple weaknesses to achieve high-impact compromises.

Charger 1: Firmware Extraction and Binary Exploitation

The journey into Charger 1 began with straightforward firmware extraction from an accessible SD card. Once the firmware was obtained, initial reconnaissance revealed that SSH was enabled by default, requiring a simple root password change to gain access.

A critical finding was an open port 1534 operating under TCP, associated with the Target Communication Framework (TCF) agent. TCF, a lightweight, open-source agent supported by Eclipse, is designed for resource-constrained communication with embedded systems, offering debug services like memory inspection and code patching. Crucially, the TCF's file system services allowed the researchers to access and modify the charger's file system as a root user, successfully altering the shadow file.

Further analysis of the firmware binaries highlighted significant security shortcomings:

• Debug Symbols: The binaries contained debug symbol information, which was not stripped during compilation, greatly aiding reverse engineering efforts for malicious actors.
• Missing Input Validation: A general lack of input validation was observed in user-accepted inputs.
• Absence of Exploit Mitigations: Critical protection measures such as canaries, DEP (Data Execution Prevention), and ASLR (Address Space Layout Randomization) were absent. These measures are vital for preventing low-level memory corruption attacks.

A real-world exploitation scenario involved a proprietary XCP port service. A constant binary, CM (Charger Manager), running on the charger, controlled charging operations and authentication. It utilized a socket service to handle requests on the XCP port, where each request consisted of a header and a body. The header included a field for the body length, but this value was not validated. Sending a body exceeding the fixed buffer size resulted in a heap overflow, crashing the CM binary and rendering charging operations non-functional. This vulnerability also presented a path to Remote Code Execution (RCE).

The web interface of Charger 1 also suffered from broken authentication, broken access control, and injection vulnerabilities, alongside a potential denial-of-service vulnerability.

Charger 2: Bluetooth and Remote Code Execution

Charger 2's firmware extraction was more involved, as it was built around a Raspberry Pi Compute Module 3 with a BCM 2837 processor and 4GB eMMC flash. Access was gained by disabling a specific jumper on the compute IO board module and using the Raspberry Pi USB booting code project from GitHub to treat the eMMC as a mass storage device. Like Charger 1, SSH was enabled, but this time using public key authentication, which was bypassed by simply adding the attacker's public key to the authorized_keys file. Notably, Charger 2 had no discoverable web interface.

The primary attack vector for Charger 2 was its Bluetooth connectivity. It utilized a straightforward "Just Works" default pairing method, which requires no user intervention, password, or numeric comparison. This method suffered from a lack of authentication during the second pairing phase, where a temporary key was set to zero, allowing for easy interception and eavesdropping on all communication.

Using tools like gatttool, the researchers discovered the BGX Express Stream Service (UUID for the express stream service) linked to Silicon Labs' bgx module. This service features three characteristics: RX, TX, and Boss Mode. The BGX module is pre-programmed, acting as a cable replacement for serial interfaces, connecting to the host embedded MCU. The critical flaw was the lack of configuration or access restrictions on this BGX service. The "Command Mode," which allows customization of the Bluetooth module's default settings (publicly available commands), was accessible without any password or authentication.

This meant anyone in close proximity could connect using the freely available BGX Commander mobile app (from Silicon Labs) or custom Python libraries like Python BlueZ and blink-light. The charger's mobile app communicated with the EV charger via custom Bluetooth JSON messages through the BGX service. By successfully bypassing a verification process within these messages, the attackers gained full control over all mobile app features via Bluetooth.

This enabled several high-impact attacks:

• Free Charging: Attackers could unlock "private mode" or restricted access settings, allowing them to initiate free charging sessions and then revert the state once done.
• OCPP Endpoint Credential Disclosure: Using a custom Python tool, the researchers could retrieve OCPP (Open Charge Point Protocol) endpoint configurations, including ID and password, presented in clear text.
• Wi-Fi Credential Theft: Previously saved Wi-Fi connection credentials could be exfiltrated, potentially providing a gateway to the user's private network.
• Remote Code Execution via Bluetooth: After extensive searching, a Bluetooth method was found that accepted user input. Despite initial sanitization, the researchers discovered that injecting backticks (` `) into an extra argument passed to the Dropbear service configuration could achieve RCE. Since the shadow` file and password file showed no password required for the root user, they configured Dropbear to accept connections from the root user without requiring public key authentication, effectively allowing blank password logins. A remote reboot of the charger, triggered via the BGX service, applied these changes, granting full root access.

Charger 3: JWT Vulnerability

Charger 3's firmware was also extracted from eMMC flash memory. This involved identifying test points on the board, attempting to dump with a flash programmer (which yielded corrupted data due to bit errors), and finally resorting to physically lifting the eMMC chip off the board using a hot air station, reading it via an adapter.

The single, yet highly impactful, vulnerability uncovered in Charger 3 was related to its web interface authentication, which relied on JSON Web Tokens (JWT). The system was configured to accept JWTs signed using the none algorithm. This allowed attackers to create arbitrary tokens without needing a valid signature. By crafting a token with an appropriate timestamp (e.g., valid from Friday, 2013-01-01 to 2030-01-01, as shown in the example), they could gain privileged access to the charger's web interface and its associated features. This privilege enabled control over various charger functions, including performing a factory reset, which could render the device non-functional.

Across all chargers, the common theme was a blend of insecure defaults, poor coding practices, and a lack of robust security architecture, leading to critical vulnerabilities at multiple layers of the system.

Demo / Proof of Concept

▶ Watch: Charger 2: SSH root access via Bluetooth RCE (20:40)

While the presentation did not feature a live, real-time demonstration, Abdellah Benotsmane meticulously described and illustrated the technical steps and outcomes of various proofs of concept throughout his talk. The detailed explanation of how each vulnerability was exploited, often accompanied by screenshots of code snippets, terminal outputs, and tool interfaces, served as a compelling virtual demonstration of the attack methodologies.

For instance, the speaker elaborated on using the TCF agent in Eclipse to modify the shadow file on Charger 1, showcasing the impact of root file system access. The heap overflow on Charger 1 was explained by detailing the unvalidated body length in the proprietary XCP port service and its resulting crash.

For Charger 2, the process of interacting with the BGX Express Stream Service via Bluetooth was thoroughly explained. This included using gatttool to list services and attributes, employing the BGX Commander mobile app, and leveraging custom Python tools developed with blink-light library to interact with custom Bluetooth JSON messages. The speaker specifically illustrated how they obtained OCPP endpoint configuration credentials (ID and password) in clear text using their Python tool. Furthermore, the Remote Code Execution on Charger 2 was detailed by showing how backticks were injected into dropbear service arguments via Bluetooth, followed by a remote reboot to enable root login with a blank password.

Finally, for Charger 3, the creation of an arbitrary JSON Web Token (JWT) using the none algorithm was presented with an example token, demonstrating how it granted privileged access to the web interface. Although not a live demo, the prescriptive nature of the technical explanations, coupled with the explicit mention of tools and code, provided a clear understanding of how these vulnerabilities were exploited in practice.

Defensive Implications

▶ Watch: Mitigation strategies for vendors and users (23:15)

The vulnerabilities highlighted in this research necessitate a multi-faceted approach to fortify the security of EV charging infrastructure, involving both manufacturers and end-users.

For Manufacturers and Developers:

1. Employ Secure Firmware Images: This is foundational. Firmware should be developed with security-by-design principles, ensuring all default configurations are secure. This includes disabling unnecessary services like SSH by default or enforcing strong authentication.
2. Introduce Proper Mitigation Against Binary Vulnerabilities: Critical exploit mitigation techniques such as canaries, DEP (Data Execution Prevention), and ASLR (Address Space Layout Randomization) must be implemented during compilation. Additionally, debug symbols and unnecessary sensitive information should be stripped from production binaries to hinder reverse engineering efforts.
3. Establish Access Control Aligned with the Least Privilege Principle: All system components, services, and user accounts should operate with the minimum necessary privileges. This prevents a compromise at one level from immediately escalating to full system control. Robust access control mechanisms should be in place for web interfaces, APIs, and physical access points.
4. Ensure Presence of Filtration and Sanitization of User-Provided Data: This is crucial for preventing injection attacks. All user inputs, whether from web forms, mobile apps, or Bluetooth commands, must be rigorously validated and sanitized to prevent malicious data from being processed or executed. This would mitigate vulnerabilities like SQL injection and Remote Code Execution via command injection.
5. Conduct Routine Penetration Testing: Manufacturers should proactively engage in regular, comprehensive penetration testing by independent security researchers or firms. This helps to identify and remediate vulnerabilities before they can be exploited in the wild, ideally as part of a continuous security lifecycle.
6. Secure Communication Protocols: Implement strong encryption and authentication for all communication channels, including Bluetooth, Wi-Fi, and any proprietary protocols. The "Just Works" Bluetooth pairing method should be avoided in favor of more secure alternatives like authenticated pairing with user confirmation.
7. Secure Credential Management: Sensitive information, such as Wi-Fi credentials, user passwords, and OCPP endpoint credentials, should never be stored in clear text. Strong encryption, secure storage mechanisms, and proper key management are essential.

For Users and Operators:

1. Stay in the Loop with EV Charger Updates: Regularly check for and apply firmware updates released by the manufacturer. These updates often contain critical security patches addressing newly discovered vulnerabilities.
2. Avoid Linking EV Chargers to Private Networks: If possible, segment EV chargers onto a separate, isolated network (e.g., a guest Wi-Fi network or a dedicated VLAN) to prevent them from becoming a pivot point for attackers to access sensitive private or corporate networks.
3. Think Before Exposing EV Chargers to the Internet: Unless absolutely necessary and with robust security measures in place (e.g., VPNs, firewalls, strong access controls), avoid directly exposing EV chargers to the public internet. This minimizes the attack surface from remote adversaries.

By implementing these defensive strategies, the security posture of EV charging infrastructure can be significantly enhanced, protecting against the array of threats detailed in this insightful research.

Key Takeaways

• Pervasive Vulnerabilities: Modern EV chargers, despite their critical role, exhibit widespread security weaknesses across physical, network, web, and wireless interfaces, indicating a general lack of security-by-design.
• Multiple Attack Vectors Lead to High Impact: Attackers can leverage various entry points, including default-enabled SSH, insecure web interfaces, and unauthenticated Bluetooth, to achieve severe impacts such as free charging, denial-of-service, sensitive data disclosure (Wi-Fi, OCPP credentials), and full Remote Code Execution with root privileges.
• Binary Security is Critical: The absence of basic binary protections like debug symbol stripping, input validation, canaries, DEP, and ASLR significantly lowers the bar for exploit development, making devices vulnerable to low-level memory corruption attacks like heap overflows.
• Weak Authentication is a Common Flaw: Broken authentication mechanisms, whether through easily bypassable web logins, insecure JSON Web Token (JWT) implementations (e.g., none algorithm), or unauthenticated Bluetooth pairing (e.g., "Just Works"), are recurrent themes that grant unauthorized access.
• Proactive Security Measures are Essential: Manufacturers must prioritize secure development lifecycle practices, including robust input validation, secure default configurations, comprehensive exploit mitigations, and continuous penetration testing, to build resilient EV charging infrastructure.
• User Vigilance is Also Required: End-users and operators play a role in mitigating risks by regularly applying firmware updates, isolating chargers from private networks, and exercising caution when exposing devices to the internet.

About the Speaker(s)

Abdellah Benotsmane is a Junior Security Researcher at PCAutomotive, a company dedicated to enhancing the security and safety of the automotive industry through best-in-class cyber security services. His journey into cybersecurity began with a Bachelor's degree in Computer Science from Algeria, which laid the foundation for his passion in the field. He further pursued a Master's degree in Cybersecurity at ATA University in Hungary through a scholarship, gaining valuable insights into the domain. With over a year of professional experience at PCAutomotive, Abdellah specializes in identifying and mitigating security vulnerabilities in critical automotive components, including EV charging systems. His work, as showcased in this Hacktivity presentation, reflects his commitment to contributing to a more secure future for transportation.