Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons / EV Charging Cybersecurity: How Charger Attacks Could Affect the Grid

Transcript

EV Charging Cybersecurity: How Charger Attacks Could Affect the Grid · Cybersecurity Under Pressure. Real Attacks, Real Lessons

0:47
We are halfway through the week and cybersecurity is still a
0:49
blazing hot topic. Today we're talking about how
0:51
electric vehicle charging systems are becoming a weak
0:54
point in automotive security. And it's a weakness that,
0:59
frankly, is scaling at a speed that is genuinely keeping me up
1:02
at night. Right, because this story has
1:04
everything. A real incident, a lesson nobody
1:07
wants to hear, and a detail that will make you check your own
1:10
systems. I want everyone listening to
1:12
just mentally place themselves in Tokyo.
1:14
It's January, We're at the Ping to Own Automotive 2026 event.
1:18
You have this massive conference room and it is packed with the
1:22
absolute most brilliant, lethal Whitehead hackers on the planet.
1:26
Oh man, P2 own? Yeah, that.
1:27
Was it was a bloodbath? You have these next generation
1:30
electric vehicles charging stations that look like they
1:32
belong in a sci-fi movie, and what we witnessed was literally
1:36
a digital massacre. Yeah, a massacre is the right
1:38
word. It was an exhibition of absolute
1:40
vulnerability. I mean, the final tally was 76.
1:43
76 zero day vulnerabilities. Unique ones.
1:47
And here is the detail that just completely breaks my brain.
1:50
Discovered in three days. Three days.
1:53
I mean, what are we even doing as an industry if in a long
1:57
weekend people can find 76 brand new ways to shred these systems?
2:01
Well, and that's the thing people don't fully grasp, right?
2:04
Those are just the flaws that the research teams managed to
2:06
exploit, chain together, and document within this tiny,
2:10
strict time window of a competition.
2:12
Right under pressure. Exactly.
2:14
Now extrapolate that level of exposure to the real world
2:17
ecosystem. You have malicious actors,
2:19
cybercrime syndicates who have months, sometimes years, to
2:22
patiently probe the defenses of these networks without anyone
2:26
running a stopwatch on. Them.
2:27
Yeah, they don't have a referee blowing a whistle.
2:29
They have all the time in the world.
2:31
And what really hit me while reading through the research we
2:33
pulled for our deep dive today is just this massive paradigm
2:36
shift. Historically, if you owned a
2:38
car, your biggest security concern was physical.
2:41
Sure, like a busted window. Yeah, you worried someone would
2:44
steal your hubcaps or smash the glass in a dark alley to RIP out
2:48
the radio. It was a problem of brute force.
2:50
Broken glass. Right, the threat basically
2:52
ended at the hood of your car. But now, I mean, the reality is
2:57
you have to worry that someone sitting in a basement on another
2:59
continent might remotely compromise a high voltage
3:03
computer, take total control of your two ton vehicle, extract
3:06
your financial data, and oh, by the way, maybe destabilize the
3:10
power grid for your entire neighborhood.
3:12
And all of this through what basically looks like a modern
3:15
gas pump. It's wild when you put it like.
3:17
That it really is. So our mission today for you
3:19
listening, whether you already have an EV in your garage or
3:22
you're just thinking about buying one down the line, is to
3:25
unpack this nightmare. We really need to dissect how we
3:30
allow these public and private charging stations to become
3:33
highly complex computers operating with almost zero
3:36
protection. Well, it's because we've
3:38
essentially created this perfect storm of vulnerability.
3:41
You have this critical tech being deployed and it's evolving
3:44
so much faster than the regulatory frameworks can keep
3:47
up, and more importantly, faster than corporate security teams
3:51
can manage. Because they're just rushing to
3:53
get them in the ground. Exactly, you're mixing heavy
3:56
industrial hardware with these super agile cloud applications,
4:00
all driven by this massive commercial urgency to plant one
4:04
of these things on every single street corner on the planet.
4:07
Which brings us right to the heart of the issue.
4:09
What I like to call the illusion of physical scale because of the
4:13
expansion we're talking about is insane.
4:15
The infrastructure numbers I was looking at are staggering,
4:17
192,000 physical charging ports in the US alone.
4:21
Another 34,000 or so in Canada. Yep, they are everywhere.
4:25
It's like we build a massive global network of Internet
4:28
connected computers, left them sitting out in the rain and
4:31
desolate parking lots and gas stations, and just basically
4:35
forgot to put passwords on half of them.
4:37
The physical expansion is entirely eclipsed with the
4:40
analysts at Upstream Security. Call their cyber security
4:44
maturity. That analogy of the computers
4:46
left out in the street is painfully accurate, but honestly
4:49
I think it even falls short because the fundamental issue
4:52
here, the root of all those zero days at PU 22 own, is this
4:56
tectonic mismatch and how we even understand the technology.
5:00
What do you mean by mismatch? Well, the operators of these EV
5:03
supply equipment units, the EVSC is they're often energy
5:07
companies or these new infrastructure startups and they
5:10
are trying to protect critical cyber kinetic systems using well
5:14
traditional office IT tools. So they're using band aids to
5:17
stop an arterial bleed. That's exactly it.
5:19
They're trying to use conventional network firewalls
5:22
and standard antivirus solutions that were built for e-mail
5:24
servers, and they're slapping them on to embedded firmware,
5:27
microcontrollers, programmable logic protocols, stuff that
5:31
operates at the bare metal level.
5:33
And that just doesn't translate. Not at all.
5:35
Your office software cannot protect a machine that is
5:37
engineered to pump 800 volts of electricity.
5:41
OK, wait, let me stop you right there 'cause I really want to
5:43
address something I've been thinking about, and I bet a lot
5:45
of you listening have this in your head too.
5:47
I call it the illusion of the plug.
5:49
Like, isn't a charger at its most basic core just a giant
5:54
glorified, extremely expensive extension cord?
5:58
Oh, I wish, I really do. But think about the physical
6:00
action. You drive up, you grab the hose,
6:03
plug it into your car, those thick copper pins make contact,
6:07
electricity flows into the battery, and you're done.
6:09
It's basic physics. Where on earth is the attack
6:12
surface on a cable that just pushes raw current?
6:15
Yeah, that is the sweet blissful ignorance of the early days
6:19
phase of electrification right there.
6:21
I genuinely wish it was just a heavy duty extension cord, but
6:25
the reality is so much more terrifying.
6:27
When you take that heavy connector and snap it into your
6:29
vehicle, electricity doesn't just start flowing immediately.
6:33
No. If it did you would probably fry
6:35
the car circuit instantly or electrocute yourself.
6:38
What actually happens in that first millisecond is a massive
6:42
digital handshake. A handshake like like 2 old dial
6:46
up modems connecting. More like a high speed security
6:49
interrogation. The car and the charger have to
6:52
have this incredibly detailed technical conversation before a
6:56
single electron of power is authorized to move.
7:00
OK, So what are they talking about?
7:01
The charger through these specific communication pins
7:04
inside that cable basically asks the car, hey, who are you
7:09
exactly? What is your vehicle
7:10
identification number? Your VIN?
7:12
What kind of battery chemistry are you running?
7:14
What is your current temperature, your state of
7:16
charge? How much maximum current can you
7:18
take right now without bursting into flames?
7:20
OK, so the charger is basically acting like a bouncer at a club,
7:23
validating the car's ID. Exactly.
7:25
And it doesn't even stop there. Once the car responds and they
7:28
agree on the physics parameters, the charger turns around, so to
7:32
speak, and opens a connection over cellular Internet or Wi-Fi
7:36
to an application programming interface cloud API.
7:39
Right. Calling home?
7:40
Yep. And it tells its central server
7:42
hey I've got this specific vehicle plug into port 3.
7:45
Does this user have funds in their digital wallet?
7:49
Is their credit card active? What is the dynamic billing rate
7:53
in this exact zip code right this second?
7:55
My God, So I'm not plugging in a cable, I am initiating a full
7:59
spectrum network transaction. It is a hyper complex network
8:03
choreography. You are chaining together
8:06
vehicle identifiers, digital certificates, dynamic charging
8:09
profiles, user accounts, cloud databases, mobile apps, and
8:12
international payment gateways, and it all happens in
8:16
milliseconds. That is insane.
8:18
It really is literally a high performance edge computer fully
8:21
integrated with the commercial cloud that, oh by the way, just
8:24
also happens to dispense lethal levels of electricity as a side
8:28
feature. And when you read the research,
8:30
like that upstream security report we devoured for this deep
8:32
dive, it is just brutal to see the state of that edge computer.
8:36
They point directly to the fact that this entire emerging
8:38
industry lacks the most basic encryption standards.
8:42
Yeah, it's bad. They mentioned that they suffer
8:44
from authentication gaps that would embarrass a college
8:47
freshman in computer science. We are basically connecting our
8:51
$80,000 vehicles to charging ports in a dark grocery store
8:55
parking lot that have less perimeter security than my
8:58
Netflix account. Oh, I guarantee you it is so
9:00
much worse than your Netflix account.
9:02
At least Netflix encrypts its streaming traffic by default.
9:05
You know, so your neighbor can't intercept the data packets and
9:08
see exactly what episode you're watching.
9:11
What upstream security pointed out with a lot of alarm.
9:14
Is this chronic lack of encryption standards at the
9:16
communication layer of these chargers?
9:19
This means that the data flowing between that machine on the
9:22
street and the energy network is often traveling in plain text.
9:25
It is not scrambled at all. So anyone sniffing the network
9:29
and just read it like an open book?
9:30
Exactly, and the authentication gaps mean the mechanisms the
9:34
charger uses to verify who on earth is sending it.
9:37
Remote commands are incredibly weak or sometimes just non
9:41
existent. Think about it from a tactical
9:43
perspective. If you don't really know who is
9:45
talking to you, and on top of that you aren't hiding what
9:47
you're talking about, you are a static target with a neon sign
9:51
flashing Attack me. OK, I think we have permanently
9:54
destroyed the illusion of the plug.
9:56
We get that these posts on the street are vulnerable,
9:58
unprotected computers. So let's actually dig into the
10:00
tactics. How are the hackers actually
10:02
getting in? Let's talk about the attack
10:04
vector. Sure, let's get into it.
10:05
When I went through the research notes from the OSTI, the
10:08
Department of Energy, they kept bringing up the OCPP 1.6
10:11
protocol over and over like it was the structural Achilles of
10:15
this whole ecosystem. What is it exactly, and why is
10:18
it such a disaster? The OCPP, the Open Chargepoint
10:21
protocol. You really have to understand
10:23
its history to get why it's such a massive problem today.
10:26
Essentially, it's this universal open source language that
10:29
physical charge points use to talk to central management
10:32
systems. The cloud servers that monitor
10:34
the networks. Exactly, and version 1.6 is the
10:37
dominant standard in the industry right now.
10:39
The vast majority of public chargers use it.
10:42
So what's the flaw? Do they just design it poorly
10:44
from day? Well, the problem is the
10:46
original context of the design. When OCPP was first conceived,
10:50
the assumption was that these charges were going to operate
10:53
inside private, isolated corporate networks.
10:56
Oh, closed loop networks. Right, closed loops where you
10:59
could inherently trust every connected device.
11:02
So the creators thought, hey, why add the processing overhead
11:06
of heavy encryption if everything is sitting inside our
11:09
own trusted private network anyway?
11:11
I see. But now we've taken that exact
11:13
same protocol, which was designed for a walled garden,
11:16
and we just threw it out in the Wild West of the public
11:18
Internet. You nailed it.
11:20
So now you have this protocol that doesn't enforce encryption
11:23
by default, chatting over public cellular networks or gas station
11:26
Wi-fi's, and it is, like you said, just riddled with massive
11:30
structural holes. The research specifically
11:32
highlights man in the middle vulnerabilities, and because
11:36
there's no forced encryption, I assume it's trivial to just step
11:39
right into that conversation. Is chillingly easy.
11:43
Imagine you are at a restaurant. You're giving your order to a
11:46
waiter, but there's an invisible silent guy standing exactly
11:51
between the two of you. OK, he intercepts your food
11:53
order, changes it so he can order something way more
11:56
expensive from the waiter, takes your credit card number that you
11:59
handed over, and then when you're done, he hands you a
12:01
completely fake receipt and neither you nor the waiter ever
12:04
knew he was there. Wow.
12:06
And translating that to the EV charger, the attacker is
12:10
spoofing the connections. The charger thinks it is talking
12:13
securely to the energy company's headquarters, reporting how much
12:16
power it's pumping. But in reality.
12:18
But in reality it's suffered a session hijack.
12:20
The attacker manipulates the network traffic, maybe they
12:23
alter the DNS resolutions and they redirect that charger to an
12:26
unauthorized server. The charger is now taking
12:28
commands from a cyber criminals malicious server.
12:31
And what can they even do with that control?
12:33
Are they just stealing credit card data?
12:35
Oh, that's the least of it. I mean, they can steal payment
12:38
info, sure, but they they can also spoof charging sessions,
12:41
making other users foot the bill for charging entire commercial
12:44
fleets. Or, in a much more destructive
12:47
scenario, they can launch massive denial of service
12:49
attacks. The docs attacks.
12:51
Right, they can send malicious commands through the spoofed
12:53
OCPP that caused every single charger in a city to reboot in
12:58
an infinite loop, just paralyzing an entire
13:00
infrastructure network in seconds.
13:02
But the cloud and the Wi-Fi aren't even the only issues
13:05
here. And this is where the reading
13:06
got truly technical and fascinating for me.
13:09
The pure hardware and protocol flaws.
13:12
I want to talk about firmware rollbacks, which we saw in the
13:15
point to own documents. Walk me through the mechanics of
13:18
a rollback. The rollback is such a classic,
13:20
devastating attack against Internet of Things devices.
13:23
Look, manufacturers aren't totally blind.
13:26
Sometimes they realize there's a massive security hole in their
13:29
code, so they develop a patch and push an over the air for a
13:32
more update to the charger to fix it.
13:34
Like when my smartphone forces me to reboot at 3:00 AM to
13:37
install a security patch. Exactly the same concept.
13:41
The charger downloads the new software and becomes
13:45
theoretically secure against that specific flaw.
13:48
But if the chargers update mechanism isn't rigorously
13:51
protected by cryptography, if it doesn't strictly verify digital
13:55
signatures, a local or remote attacker can trick the device.
13:59
Trick it how? They can send a command that
14:02
literally forces the charger to uninstall the safe software and
14:06
reinstall an old obsolete version.
14:08
Wait, you're saying they've force the machine to physically
14:11
time travel at the software level?
14:12
Yes, they force the device to roll back to a version from,
14:16
say, two years ago, and the reason they do this is that the
14:19
old version contains known public vulnerabilities that the
14:22
manufacturer already documented and the attacker already has
14:26
prefabricated tools to exploit perfectly.
14:28
That is just diabolical. It's like a burglar magically
14:31
convincing you to remove your high tech electronic front door
14:34
lock and reinstall that old brass lock that everyone in the
14:36
neighborhood already has a copy of the key for.
14:39
They know the currency system is too hard so they just downgraded
14:41
to one they can break in their sleep.
14:43
Wow. And then there are the math
14:45
vulnerabilities which should be coned detailed in their post
14:48
Ping to own reports. They talk a lot about buffer
14:51
overflows triggering remote code execution or RCE.
14:55
And there was also this flaw that sounded similar but is
14:57
apparently different. Let me check my notes here.
15:00
Right, the CWE 839. It's described as a numeric
15:04
range input flaw, right? For those of us who don't spend
15:07
our weekends compiling C++ code, what is the actual difference
15:11
between these two attacks? Because they both just sound
15:13
like overloading the system. It's a crucial technical
15:16
distinction, and people mix them up a lot.
15:19
Let's start with the classic, the buffer overflow.
15:22
This happens at the level of the device processors physical
15:25
memory. Imagine the system sets aside a
15:28
tiny block of memory, a buffer to store let's say the name of
15:31
your vehicle. It expects a maximum of 20
15:34
characters. OK, seems normal.
15:36
But the attacker sends a name that is 5000 characters long,
15:39
and right in the middle of those characters they hide malicious
15:41
software code. So the system is trying to pour
15:43
a gallon of water into a tiny shot glass.
15:46
And the water spills all over the table.
15:48
In hardware terms, those thousands of extra characters
15:51
overflow from their assigned block and overwrite the adjacent
15:54
parts of the devices. Critical operating memory.
15:57
And by doing that, the attacker can trick the processor into
16:00
executing those malicious instructions they hid in the
16:03
spilled water. Which is the remote code
16:05
execution RCE. Exactly.
16:08
You now have total administrator level control over the hardware.
16:12
You can make the charger do whatever you want.
16:14
Got it. So that's a brute force attack
16:15
on the memory architecture itself.
16:18
So what about The CW 839? The integer handling?
16:21
If it's not a memory overflow, what is it?
16:23
CWE 839 is much more subtle. It is purely a logic flaw, not
16:27
physical memory. It refers to situations where
16:30
the software just fails to properly verify if a number
16:33
entered by the user, or in this case the car, makes any sense in
16:37
the real world. Give me an example of how that
16:38
looks on a charging station. OK, say the charger has a logic
16:42
security gate that says if the battery percentage reported by
16:46
the car is less than 100, keep charging.
16:48
If it hits 100, stop the current immediately so you don't start a
16:51
fire. The software logically expects
16:54
to receive an integer between 0 and 100.
16:56
Rates of percentage. But the developers, in a rush,
16:59
forgot to tell the system what to do if it receives a number
17:03
that breaks the laws of physics. So the attacker manipulating the
17:06
communication doesn't send 90%, they send the number -50,000.
17:12
Or they send 3 billion. And how does the programmable
17:15
logic controller handle that? Does it just crash?
17:18
It depends on the system, but often the results are
17:20
disastrous. The software tries to process
17:22
the logic of charging a battery up to -50,000%.
17:26
It gets mathematically confused and throws an unhandled error
17:29
state. And in a lot of these poorly
17:31
designed industrial systems, when a critical logic error
17:34
happens, the system defaults to a fail open state instead of
17:37
fail closed. Fail open meaning instead of
17:40
locking down and shutting off for safety, the controls fail by
17:43
just leaving everything wide open.
17:45
Exactly. The logic lock breaks and the
17:48
door swings wide open. It allows the attacker to bypass
17:51
safety checks, evade authentication, or just keep the
17:55
current flowing without any restrictions.
17:57
It's unbelievable. We're talking about overflowing
18:00
physical memory and injecting impossible math, and all of this
18:03
assumes they're attacking through the charger cellular
18:05
network. But this leads us to the
18:07
vulnerability that honestly disturbed me the most when I was
18:10
reading the physical attack at the cable level.
18:13
Oh yeah, the SWC can. Attack right?
18:15
Forget the gas station Wi-Fi. Forget intercepting cloud
18:18
communications. The teams at Tune to Own prove
18:20
they could access the SWCS can interface the single wire CAN
18:25
bus by injecting code directly through the pins of the physical
18:28
plug. You have to explain the CAN bus
18:30
to the listener because this completely changes the rules of
18:32
automotive security. The CAN bus is, without
18:35
exaggeration, the absolute central nervous system of your
18:38
car. It is the deep internal
18:40
communication network that allows all the critical
18:43
components like the engine control module, the anti lock
18:46
brake sensors, the power steering and the high voltage
18:49
battery management systems to talk to each other in real time,
18:53
thousands of times a second and. By design, it was always assumed
18:56
that internal network was physically isolated from the
18:59
outside world, right? Like a super secure intranet
19:01
trapped inside the steel shell of the car.
19:04
Correct. Historically, if you wanted to
19:06
meaningfully hack a car's can bus, you had to physically smash
19:10
the window, climb under the dashboard, find the OBD 2
19:14
diagnostic port, and plug a device directly into the car's
19:17
wiring. It was an intrusive physical
19:20
attack, but the EV revolution broke that isolation complete.
19:24
Because the car now has to have that complex conversation with
19:26
the power pump outside. Exactly because the vehicle
19:30
needs to intimately communicate with the street charger to
19:32
negotiate voltages and manage the thermals of the lithium
19:36
batteries, the manufacturers had to extend a bridge from that
19:39
secure internal canvas out into the real world.
19:43
That communication line, the single wire can or similar
19:46
systems now travels right along that thick charging cable you
19:50
hold in your hand. So when I grab that hose at a
19:52
highway rest stop, that cable is not just a copper pipe for
19:56
electricity, it is literally a direct Ethernet cable plugged
20:00
straight into the deepest brain tissue of my car.
20:03
It is a drawbridge that the manufacturers have permanently
20:06
lowered, and what the researchers demonstrated is
20:09
chilling. If they compromise the public
20:11
charger, or if they managed to manipulate the physical pins or
20:14
the PLC modems inside the cable, they can completely bypass all
20:18
the sophisticated wireless cybersecurity defenses that the
20:21
car manufacturer built in the cloud.
20:23
They just start injecting low level unauthenticated commands
20:27
directly onto the hardware bus of the vehicle.
20:29
You're bypassing the castle's firewall by crawling up through
20:32
the sewer pipes. Basically, yeah.
20:33
They can tell the brakes to disengage, they can tell the
20:36
battery to ignore it's temperature sensors.
20:38
It is the absolute worst case scenario.
20:41
Everything we are discussing here can't.
20:43
Bus injections, man in the middle protocols, firmware
20:46
rollbacks. It all sounds like really
20:48
advanced sci-fi. Like intelligence agencies by
20:50
tactics. But then when you keep reading
20:53
the sources, you hit the real world examples of how actual
20:57
charging station providers are managing their infrastructure,
21:00
and the dissonance just makes you want to bang your head
21:02
against a desk. I know the massive, unfathomable
21:05
gap between the mathematical sophistication of the threat
21:08
vectors and the raw, almost comical administrative
21:11
incompetence of some operators in this space.
21:14
It's hard to believe until you actually read the incident
21:16
reports. Let's talk about those absurd
21:18
incidents. I mean, Human 2 owned 2024.
21:21
The researchers are analyzing a charging station from a
21:23
legitimate vendor, a real company with hardware deployed
21:26
in actual cities, and they discovered that the software
21:28
engineers had embedded a private AWS access key, Amazon Web
21:32
Services, directly inside the static firmware of the charger.
21:36
It's just monumental negligence. To put this in perspective for
21:39
you, AWS is the cloud infrastructure that houses
21:42
entire databases, billing servers, customer profiles.
21:46
Embedding an admin access key into the uncompiled code of a
21:50
physical device sitting on the street is well, it's the digital
21:53
equivalent of spending millions to build the world's most secure
21:56
bank vault with retina scanners, laser sensors and armed guards,
22:01
and then deciding to take the physical master key under the
22:03
welcome mat at the front door. And just assuming nobody's going
22:07
to look under the mat, anyone who plugs in a laptop, extracts
22:10
that firmware, and runs a simple text search tool has the keys to
22:14
the entire corporate cloud Kingdom of that that energy
22:17
company. And it is not an isolated case
22:19
of stupidity, either. Consider the 2023 incident with
22:22
the Electrify America network, which was widely documented.
22:25
Researchers found that public charging stations out on the
22:28
streets were running active Teamviewer sessions.
22:30
Wait, Teamviewer? Like the free remote desktop
22:34
software with the blue icon that I used to log into my
22:37
grandmother's laptop to fix her printer.
22:39
That exact one. And it wasn't just installed.
22:42
The sessions were exposed to the network and in many cases not
22:45
properly authenticated. And here we are back at the root
22:48
of the cybersecurity maturity problem.
22:51
This happens because they are treating complex cyberkinetic
22:54
industrial machinery like it's an HR computer in an air
22:58
conditioned office. It's just pure operational
23:00
laziness. Totally.
23:01
The infrastructure managers think, hey, sending a certified
23:05
technician in a truck every time a touch screen freezes on a
23:08
charger in the middle of nowhere is really expensive.
23:10
Let's just install a standard remote desktop tool so the tier
23:14
one support team at our call center can reboot the machine
23:17
with a click. The intention is cost savings
23:20
and efficiency. But by doing that without
23:23
segmenting the network, without using strict virtual private
23:26
networks or VPNs, without multi factor or biometric access
23:31
controls. They basically left an
23:32
administrative backdoor with full operating system
23:35
privileges. Why open to the public Internet?
23:37
Just waiting for any automated port scanner to find it and walk
23:40
right in. And that frankly drags us into
23:43
the third major issue of our deep dive today, the blast
23:47
radius. Because once we understand the
23:49
attackers already know how to get in through the cable, and we
23:52
know that sometimes the companies literally just leave
23:54
the Teamviewer backdoor open for them, the pressing question is
23:58
what happens when the attacker actually decides to turn the
24:00
key? Let's talk about the impacts.
24:03
And we need to start local before we get to the end of the
24:05
world stuff. We are just talking about
24:07
teenage hackers stealing free electricity to avoid paying a
24:10
bill. Although they absolutely could
24:11
do that and theft of service is going to be a multi $1,000,000
24:15
problem on its own. But stealing electricity is
24:18
anecdotal compared to the value of the data.
24:21
Look at November 2024 reports detailed a massive silent data
24:25
breach of a central database belonging to a charging
24:28
operator. It compromised huge logs of
24:31
personally identifiable information PII of users across
24:34
multiple vendor networks. And PII in this context isn't
24:37
just your name and e-mail, right?
24:39
Oh, it's so much richer. They have your name, your
24:41
banking info tied to the RFID charging account, the unique
24:45
identifier of your very expensive vehicle, and the most
24:48
alarming part, the transactional logs that reveal your precise
24:51
geolocations with time stamps. So they know exactly what time
24:55
of night, what days of the week you leave your car parked and
24:58
immobilized at a specific remote charger.
25:01
They know when you charge at home, when you are at work, when
25:04
you are traveling. It's literally a real time map
25:07
of your life. It is a stalker's wet dream and
25:10
an absolute goldmine for identity theft rings or in
25:13
corporate and government scenarios, for intelligence on
25:15
personnel movements. The security research from
25:18
Sandia National Lab also highlights how this data
25:21
harvesting is facilitated by the absurd exposure of Bluetooth Low
25:24
energy traffic BLE. A lot of chargers use Bluetooth
25:28
to talk to the apps on your phone to initiate a session, and
25:31
Sandhya found that often this BLE communication is completely
25:34
unencrypted. A criminal can just sit in a car
25:37
30 feet away with a simple packet sniffer and capture your
25:39
login credentials as you walk up to the charger.
25:42
OK, privacy and identity theft are terrible.
25:44
But where this topic made me stop reading, where the dark
25:47
humor I used to cope with technological terror almost
25:51
failed me completely, is when the reports pivot to the
25:53
physical threats. I want to go back to a term.
25:56
The Sandia report used the potential compromise of EBSC
26:00
life safety systems. So stop right there and break
26:03
that down. What does life safety systems
26:05
mean when we are talking about an appliance that charges a car?
26:08
It sounds like hospital equipment.
26:10
It sounds dramatic, but it is the correct technical term.
26:14
You have to visualize the physical forces we are playing
26:16
with here in DC. Fast charging direct current.
26:20
We're not talking about the wall outlet that powers your toaster.
26:22
We're talking about industrial levels of power.
26:25
We are funneling up to 800 volts of tension and three to 400 amps
26:29
of direct current through cables into a highly volatile chemical
26:33
battery. It's an insane amount of energy
26:35
flowing inches from your hand. It is lethal energy if that
26:38
transfer is not managed with absolute math medical precision.
26:41
That amount of current will melt copper, it will fuse plastics,
26:45
it will cause electrical arcs that can start unstoppable
26:48
lithium fires or just straight up electrocute a human being
26:51
instantly and fatally. The life safety systems are the
26:54
critical hardware and firmware components.
26:57
The physical contactor relays, the thermal sensors in the plug
27:00
handle, the logic software loops.
27:02
Their only job is to monitor everything millisecond by
27:05
millisecond, and if the cable gets 1° above the limit, or if
27:09
they detect a resistance anomaly, they brutally stop the
27:12
current, cutting the circuit. But yes, like you said earlier,
27:14
a remote attacker manages to exploit one of those
27:17
vulnerabilities, injects multis code and gets remote execution
27:20
on the logic microcontroller governing that station.
27:23
The attacker now has the ability to rewrite the rules of that
27:26
physics. They can theoretically override
27:29
those built in safety limits. They could send a command to the
27:32
charger that says ignore the thermal sensor alert, ignore the
27:36
maximum voltage limit the car is requesting, keep pumping the
27:39
maximum current the grid can supply no matter what, and do
27:43
not open the relays to cut the flow.
27:45
You were talking about causing intentional physical harm
27:47
through a computer. It's a pure cyber kinetic
27:50
scenario, using a digital attack vector to manifest thermal and
27:54
kinetic destruction in the real physical world.
27:56
They can overcharge the vehicles battery cells, damaging them
28:00
irreparably and turning the car into instant scrap metal.
28:03
Or worse, induced thermal runaway in the lithium battery,
28:07
creating an explosive fire hazard in the middle of a gas
28:09
station or in the victim's home garage.
28:12
That just freezes your blood. You are literally transforming a
28:15
piece of green public utility infrastructure into a remote
28:18
controlled incendiary weapon. And that is so hard to process.
28:22
But what is even more more credible about this research is
28:25
that localized physical damage to a single vehicle isn't even
28:28
the ultimate nightmare scenario here.
28:30
We have to pull the camera back and take this conversation to
28:33
the macro level into large scale dystopian territory.
28:36
And this brings us to BI Directional integration and the
28:38
magic acronyms VDG Vehicle to grid and V2 X Vehicle to
28:42
everything. Explain the concept because this
28:45
is the green utopia everyone is selling.
28:47
And it is a brilliant utopia on paper.
28:49
The vision for the next decade of electrification isn't just
28:52
that the grid powers the cars. The idea is that electric
28:55
vehicles act as this immense distributed battery system on
28:57
wheels. With V2G interfaces.
28:59
Vehicles don't just consume energy, they store it, they hold
29:02
it. And most importantly, they can
29:04
push it back into the public power grid.
29:06
During national demand peaks, your car becomes a node in a
29:08
massive virtual power plant. Which logistically sounds like
29:12
an efficiency miracle. I picture a sweltering Tuesday
29:15
in August. I get home from work at 6:00 PM.
29:18
Everyone in the city is turning on their AC units.
29:20
The grid is groaning under the pressure.
29:23
Instead of plugging my car in and draining the grid even more,
29:25
causing a blackout, my connected car recognizes the demand peak
29:30
and starts feeding power from its massive battery back into my
29:34
neighborhood grid, stabilizing it.
29:36
And then at 3:00 AM, when demand drops and wind power is cheap
29:39
and abundant, the car recharges itself.
29:42
It is a marvel of smart grid engineering, yes, but
29:44
architecturally, from the perspective of a military
29:47
cybersecurity analyst, it means you just enabled a high speed
29:51
two way communication conduit directly between millions of
29:54
vulnerable mobile batteries parked in garages and the
29:56
critical infrastructure Transformers of an entire
29:59
nation. V2G interfaces elevate the
30:02
status of a humble street corner charger.
30:04
They turn them instantly into ultra high value national
30:06
infrastructure targets. So I usually use my dark humor
30:10
trying to cope with the ridiculous fact that if I
30:13
misconfigure my car's app after a long day, I might accidentally
30:17
cause the lights in my house to flicker.
30:19
But what you are saying is that if these networks fall into the
30:22
hands of a real sophisticated attacker.
30:25
I think big picture if a criminal cell or a nation state
30:28
actor compromises just one major chargepoint operator ACPO and
30:34
gains remote administrative access to a database controlling
30:37
10s of thousands of distributed V2G chargers across a major
30:41
metropolitan region. They don't just attack one car,
30:43
they launch a synchronized attack like a swarm.
30:46
Exactly. They could use a vulnerability
30:49
in the OCPP protocol or a cloud back door to send a simultaneous
30:53
command to 30,000 high capacity vehicles.
30:56
Imagine telling those 30,000 vehicles to, at exactly 2.0 PM
31:00
on the hottest day of the summer, instantly switched from
31:02
resting to pulling the absolute violent maximum amount of power
31:05
possible from the grid simultaneously.
31:07
Or the reverse scenario, which I assume is just as bad.
31:11
They ordered those thousands of vehicles which were peacefully
31:14
feeding the grid to intermittently inject massive,
31:17
erratic, out of phase power spikes right back into the local
31:21
transmission lines. You are basically creating a
31:23
grid level frequency disturbance or a massive artificial demand
31:27
spike that the city's systems cannot predict or handle.
31:31
And that is exactly how you destabilize and collapse a
31:33
modern, fragile power grid. Those artificial demand spikes
31:38
or dirty frequency injections can blow out local substation
31:41
Transformers, cause the automated safety fail safes at
31:44
major power plants to trip out of precaution, and trigger a
31:47
catastrophic cascade of rolling blackouts.
31:49
You could literally blind an entire city.
31:51
We are taking the 21st century star ecological solution and
31:55
weaponizing it without even realizing it, turning it into
31:58
the ultimate cyber warfare attack vector hidden in plain
32:01
sight. OK, I need to take a sanity
32:02
pause here. Are we seeing this happen right
32:04
now? Are foreign military minutes
32:06
hacking charging stations at local gas stations today?
32:09
I need to know if the sky is actually falling or if we're
32:11
just seeing the cracks. No, the sky is not falling today
32:15
and it's crucial to clarify that so we don't just foster blind
32:18
panic. The intelligence community and
32:21
the researchers we read clearly state that there is no current
32:24
evidence of advanced persistent threats.
32:26
The famous nation state funded AP TS like groups tied to
32:30
Russia, North Korea or China carrying out large scale
32:33
destructive kinetic attacks against EVSE infrastructure.
32:36
Yet there are no blackouts caused by electric cars.
32:39
I feel a colossal butt hovering in the air right now.
32:43
The mountain sized butt, because what we do see actively in daily
32:46
in the network logs are ordinary cyber criminal bot Nets,
32:49
ransomware gangs and vulnerability research scanners
32:51
aggressively probing the ecosystem.
32:53
They are mapping the network topologies, they are testing the
32:56
API defenses, looking for misconfigured OCPP servers and
32:59
scraping databases. All the deep tactical
33:02
reconnaissance work is happening right now.
33:04
They're drawing the treasure map.
33:05
They're outlining the entire attack surface.
33:08
And the golden rule of cybersecurity is this.
33:11
If a financially motivated mid level cyber criminal can get
33:14
into a network by bypassing a weak authentication check to
33:18
mine cryptocurrency or steal credit cards, rest assured that
33:21
a nation state threat actor with unlimited resources can also get
33:25
in. And what states do isn't steel.
33:28
They hide, they infiltrate, they establish persistence deep
33:32
inside the infrastructure's firmware, and they wait
33:34
patiently for years until geopolitical tensions flare up
33:37
and they need to push a button to cause civil chaos.
33:40
The incalculable strategic value is already there.
33:43
Which relentlessly drags us toward the next pit of despair.
33:46
In our analysis of the sources. Metro grid is at imminent risk,
33:49
our personal privacy and PII is exposed, automotive computers
33:53
can be remote controlled and cars might end up the smoking
33:55
$80,000 paperweights with melted batteries.
33:58
So the $1,000,000 follow up question, who on earth do we
34:01
blame when the music stops? Let's wade into the absolute
34:04
abyss that is the legal and regulatory landscape of the EV
34:07
ecosystem. It is the governance nightmare
34:09
that the upstream reports highlighted in bright red.
34:12
I would call it the nightmare of fragmented liability.
34:15
To understand the panic in corporate boardrooms right now,
34:18
you have to understand the brutal paradigm shift the
34:21
automotive industry is going through.
34:23
For over 100 years, the security of a car ended physically and
34:27
logically at the sheet metal of the hood and the door lock.
34:30
If the engine was sealed tight, you were safe.
34:33
And even as cars filled up with computers over the last decade,
34:36
the ultimate defensive perimeter was the ECU, the electronic
34:39
control unit of the vehicle. The car was essentially a
34:43
self-contained digital castle surrounded by a massive Moat.
34:47
Right. And what are the strategy
34:48
documents we read? I think from Cone literally had
34:51
this blunt heading that said automotive cybersecurity cannot
34:54
stop at the ECU anymore. Because the castle is no longer
34:57
isolated, you can no longer just build high walls on your car and
35:00
call it a day, because that castle now lowers a massive
35:03
drawbridge of copper and fiber optics to connect to a strange
35:07
village, which is the public charging station, several times
35:10
a week. And the problem is, from a
35:13
cybersecurity perspective, that village is constantly on fire.
35:17
A modern attacker doesn't need to spend millions of dollars
35:20
trying to hack the car directly anymore, trying to penetrate the
35:23
complex cellular firewall that a BMW or Tesla engineer built.
35:28
It would be a waste of effort to attack the strongest point.
35:30
Exactly. Instead, they take the path of
35:32
least resistance. They just make a lateral move
35:34
through the adjacent infrastructure.
35:36
They exploit an old unpatched router on a poorly segmented
35:40
charging network at a delivery van depot, or they infiltrate
35:43
the free Wi-Fi at a car dealership, or they hack the
35:45
outdated software on a public charger in a mall basement.
35:48
Once they are inside the village they just cross the drawbridge
35:51
into the car the exact moment it plugs in.
35:53
OK, let me pose a legal dilemma to you that I distilled from the
35:57
liability reports. The situation that in my notes
35:59
I've called the pasted text dilemma.
36:02
This is the ultimate hypothetical scenario and I want
36:04
you to walk me through the legal carnage.
36:07
Let's say I empty my savings to buy a brand new luxury electric
36:11
vehicle. The automakers factory assembled
36:13
it to absolute perfection. It passes every test.
36:16
It rolls off the production line in Detroit, Oregon, Stuttgart as
36:19
an impenetrable digital fortress.
36:22
It's got real time software validation, secure boot,
36:24
military grade encryption on the ECU.
36:26
Everything is beautiful. I drive this hyper secure tank
36:29
for a week, then I run low on battery and I pull up to a high
36:33
speed public charger operated by a third party franchise network
36:36
in the middle of the highway. Turns out that public charger
36:39
was previously compromised by a ransomware gang, maybe through
36:42
one of those OCPP flaws we talked about.
36:44
I follow you. The charger is compromised and
36:46
let's say the moment I plug my perfect tank in the chargers
36:50
infected firmware attacks the physical Southwest can
36:53
interface, injects A payload that exploits A microscopic flaw
36:57
in how my car reads voltage and the result is that the vehicle's
37:00
main computer permanently bricks the main battery as a poorly
37:03
executed fail safe mechanism. My car is paralyzed, dead and
37:08
simultaneously my bank data tied to the cars A is extracted and
37:12
sold. My question to you, looking at
37:14
the current structure of the industry is whose fault is it?
37:18
Who owns that financial monstrous risk?
37:20
Whose lawyers do I sue to get my $80,000 back?
37:24
Wow, well I wish you the best of luck trying to figure out which
37:26
office to even serve that lawsuit to, because your
37:28
question is exactly the bottomless pit that is keeping
37:31
corporate risk mitigation lawyers awake and sweating cold
37:33
all over the world right now. You have just described an
37:35
unbearably tangled web of fragmented liability where
37:39
multiple entities control the ecosystem, but nobody actually
37:41
owns the complete life cycle of the session.
37:43
Break this down for me, who is on my list of legal targets.
37:47
Well, you have a lineup of defendants and they are all
37:50
pointing fingers at each other. First, as a consumer you go to
37:53
the original equipment manufacturer, the OEM, meaning
37:57
the car brand that sold you the vehicle.
37:59
Their lawyers look at you and say our car was structurally
38:03
perfect and met every ISO regulation.
38:06
The problem was the malware injected by the third party
38:09
station you chose to plug into Sue the station.
38:12
Fine, so I go to the company that built the metal post.
38:15
You go to the chargers hardware manufacturer, they will respond.
38:18
Look, we just bent the metal and assembled the circuits.
38:20
The hardware was fine. The software was compromised the
38:22
exclusive responsibility of the Chargepoint operator, the CPO
38:26
who manages the remote management system.
38:28
So you escalate and go to the corporate offices of the CPO.
38:32
Surely they have to take the blame.
38:33
They run the network. The CPO will tell you.
38:36
Listen, we were passive victims of a sophisticated 0 day
38:40
vulnerability attack on the cloud server release which
38:43
should have been protected by our cloud provider.
38:45
Blame AWS or Azure for not filtering the traffic.
38:49
And if you somehow get to the cloud provider, they'll say the
38:52
regional energy network partner was the one who failed on their
38:56
API authentication protocols in the 1st place, leaving the
38:58
session open. It is the worst, most expensive
39:02
game of musical chairs in corporate history, and nobody in
39:05
the entire supply chain wants to sit down and take the blame.
39:08
When the destructive music stops, they all just wash their
39:11
hands of it. The liability just evaporates
39:14
into the cloud. But reading Upstream Security,
39:16
they made it very clear this has a time limit.
39:17
They brought up some immensely serious regulatory implications
39:20
here. Because let's be real, federal
39:22
governments and trade commissions are not going to
39:25
just let this new national ecosystem burn to the ground
39:28
without intervening, legislating, or issuing
39:30
crippling fines to somebody. Absolutely not.
39:33
And government. Patience is wearing incredibly
39:35
thin. This is where federal and
39:37
European regulators are going to use legislative brute force.
39:40
Upstream was prophetically clear about this.
39:43
The compliance landscape is shifting beneath their feet as
39:46
sovereign data protection laws tighten with real teeth all over
39:50
the world. I mean, think about the
39:51
destructive weight of GDPR in the European Union, or the
39:55
growing ramifications of consumer privacy laws in
39:57
California like CCPA. The patience for incompetence is
40:00
0. Continuous leaks of personally
40:03
identifiable information through porous, unencrypted charging
40:06
networks are not going to be forgiven or viewed as just the
40:09
growing pains of a new industry. The regulatory agencies are
40:12
going to start. Issuing fines, they are going to
40:14
issue financial. Death sentences agencies could
40:16
invite massive monetary penalties for every single
40:19
incident. And what people don't understand
40:21
about the EV charging business is that right now a lot of these
40:25
Chargepoint operators, the CP OS, they operate on incredibly
40:29
thin, almost microscopic profit margins.
40:32
They're burning capital trying to expand their physical
40:34
infrastructure footprint, installing capital intensive
40:37
hardware everywhere before mass EV adoption actually makes them
40:40
profitable. A massive regulatory fine for
40:43
GDPR non compliance or for cyber security negligence that results
40:47
in a massive bank data breach that could literally wipe out
40:49
their entire annual profit margin entirely or push them
40:52
straight into insolvency. If the CP, OS and OEMs don't sit
40:56
down together and radically figure out holistic security at
40:59
the software level, data breach fines will bankrupt them long
41:01
before they can install the next batch of charges on the highway,
41:04
which pushes us inexorably. To our last point of analysis,
41:07
because we cannot leave our audience wallowing in this
41:10
absolute despair, we have to address how you cope with this
41:13
reality. We've navigated the dark pit,
41:16
the power grid threatened by V2G spikes, personal info, stolen
41:20
car batteries turned into fire bombs, and the impenetrable
41:23
legal maze you just described. So, facing this mountain of grim
41:27
evidence, the question is how on earth is the industry responding
41:31
to get ahead of this threat? What is the counterweight to all
41:34
this chaos? Well, there is light at the.
41:36
End of this very dark tunnel, thankfully, and it comes from a
41:39
long overdue maturation toward an offensive security mindset
41:43
rather than a defensive one. Think back to the original
41:46
catalyst for this entire conversation today.
41:48
Everything we're discussing was triggered and documented by the
41:51
brutally honest findings of controlled white hat hacking
41:54
competitions. Right the Puno and Tuona van in.
41:57
Tokyo Exactly. The mobility.
41:59
Industry is finally starting to adopt proactive measures by
42:02
intense, intentionally and structurally exposing themselves
42:05
to these lethal attacks and test environments instead of waiting
42:08
for cyber criminals to discover them on the street.
42:11
It's a fundamental shift. Look at the track record of the
42:14
research led by companies like Vicone and their involvement in
42:17
the zero day initiative, the ZDI, which the reports detail.
42:20
Yeah, the efficiency numbers they revealed.
42:22
There seemed honestly like a beacon of hope to me.
42:24
They reported the discovery, verification and responsible
42:27
disclosure of 174 unique zero day vulnerabilities in the
42:32
connected infrastructure and the statistical.
42:35
Context of that number is what's truly staggering.
42:38
Those 174 flaws represented 73% of all known critical market
42:44
vulnerabilities in that specific industrial sector at the time.
42:47
By aggressively funding and buying these flaws, which are
42:50
often abstract and deeply hidden from brilliant independent
42:54
researchers, before criminal cartels can use them to build
42:56
exploitation tools, initiatives like ZDI achieved this
43:00
invaluable tactical advantage. They can analyze the flaw,
43:03
develop intrusion signatures, and provide active mitigation
43:07
intelligence to their infrastructure clients an
43:09
average of 102 days before the original hardware vendor
43:12
manages, if they ever do, to publish an official software
43:15
patch. A full 100.
43:17
And two days of early protection, That is more than
43:19
1/3 of a year. When you talk about the speed at
43:22
which modern digital threats move, that time window isn't
43:25
just a statistical luxury. That 102 day window is literally
43:28
the difference between having a boring routine Tuesday morning
43:31
in your network operation center and waking up on the front page
43:34
of the Evening News globally as Ground Zero for a data leak and
43:38
a National Grid collapse. It's a vital.
43:41
It is the difference between survival and cororate
43:43
extinction. The overwhelming conclusion, the
43:46
urgent recommendation echoing through every one of these
43:49
technical documents and policies is that the entire automotive
43:52
electrical supply industry has to completely and permanently
43:56
abandoned this complacent mindset of treating charger
43:59
cyber risk as a purely theoretical problem or hiding
44:03
behind the foolish assumption of oh, we're too small to be
44:05
targeted. They have to start adopting
44:08
military grade critical infrastructure thinking from day
44:11
one of design. And according to the analysts,
44:13
this isn't. Just about using better.
44:15
No, this requires deep. Architectural engineering.
44:18
It means implementing ultra strict network segmentation,
44:22
ensuring that if one charger falls, it does not drag the
44:25
entire central database down with it.
44:27
It means wholeheartedly adopting a zero trust architecture where
44:30
absolutely no system component, not the cloud, not the car, not
44:33
the charging cable, automatically assumes that
44:36
another component is friendly or safe just because they are
44:38
physically connected. Every single interaction has to
44:41
be cryptographically verified and it demands constant ruthless
44:44
hostile cell penetration testing at the deep hardware level and
44:47
on low level protocols like the Canvas, not just running generic
44:50
IT vulnerability scans that look for open web ports.
44:53
You know, as we unpacked. This massive, terrifying
44:56
infrastructure, it inevitably makes me reflect on something
44:59
much more philosophical. It makes me think about how the
45:02
nature and the burden of social trust in our daily lives has
45:05
just radically changed. Think about how we lived just a
45:08
few decades ago, in the last century.
45:10
As citizens, we implicitly and blindly trusted the physical
45:14
public infrastructure of our cities.
45:16
It was an unwritten social contract.
45:18
Nobody, absolutely nobody, went to bed worrying that the humble
45:22
street light in their alley or the gas pump at the neighborhood
45:24
station had a hidden malicious agenda or was secretly being
45:28
operated from the shadows by an international extortionate
45:31
ransomware consortium. Because back then, public
45:34
infrastructure. Was just that, physical.
45:36
It was cast iron, cement, mechanical valves, raw gasoline,
45:39
and rudimentary electrical relays.
45:41
The infrastructure was inert. It was passive.
45:43
A gas pump couldn't have ulterior motives exactly, and
45:47
yet look at where. We are now every piece of public
45:50
utility we trivially interact with is actually a hyper
45:52
connected Internet of Things device.
45:54
Every new smart gas pump, every digital parking meter that reads
45:57
cards, and definitely every massive 4 or 800 Volt fast
46:01
charging block that we tether our cars.
46:04
They are no longer passive tools.
46:06
They are dynamic computing nodes in an immensely contested global
46:09
network under constant attack. And we are sleepwalking through
46:12
a world where gigantic integral infrastructures for society are,
46:16
in many staggering cases, operating with essentially the
46:18
same broken, neglected cybersecurity maturity that a
46:22
cheap home Internet router had 15 years ago.
46:24
And the tragic irony. Is that we blindly, almost
46:28
without thinking about the consequences of that place fate,
46:31
plug into those flawed, exposed notes the very same massive,
46:35
expensive machines that we rely on to transport our families and
46:38
ourselves each and every single day.
46:41
It is an astoundingly complex puzzle of risks.
46:44
We have surrounded and wrapped ourselves in layers of amazing
46:47
technological convenience, but it is becoming increasingly
46:51
obvious that this apparent convenience is precariously tied
46:53
to an incredibly fragile digital rope that is starting to fray
46:57
right down the middle. It is totally wild.
46:59
It's an epical. Shift.
47:00
Think about our past. Over the last two decades, we've
47:03
conditioned ourselves and our employees to worry about
47:05
ethereal threats on screens. We worried about not sticking
47:09
strange, malicious USD drives we mysteriously found lying on the
47:12
parking lot asphalt into our work computer ports.
47:15
Or we anxiously trained our parents not to click on tempting
47:19
links inside poorly written emails.
47:20
Foreign Princess promising fortunes.
47:22
Those were the peaks of our collective digital terrors.
47:25
They seem like infinitely simpler.
47:27
Quaint times in retrospect, so much simpler.
47:30
Because Fast forward deep into this decade and seeing the
47:33
overwhelming direction these vulnerability reports point to,
47:36
the most dangerous, consequential, and physically
47:39
destructive digital connection you're going to make in your
47:42
daily life will no longer even require a keyboard or a mouse
47:46
click. The most dangerous digital
47:48
connection of all might simply be that thick heavy black cable
47:52
that without hesitation you pull from a harmless looking metal
47:55
post and plug into the side of your family car in the middle of
47:57
the night in the cold rain, desperate to get the kilowatts
48:00
of energy needed to just safely made it home.
48:03
It leaves us with an error defining question that we should
48:06
start asking ourselves very seriously.
48:08
What happens to us as a modern hyper connected society when the
48:11
physical, inescapable infrastructure that we literally
48:14
and absolutely depend on for our mobility, our survival and our
48:17
energy is corrupted from the inside out, becoming the
48:20
ultimate, most perfect Trojan horse ever conceived?
48:24
That is all for this episode of cybersecurity under pressure,
48:27
real attacks, real lessons. Until the next chapter.