Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons / EV Charging and Grid Security: When Mobility Becomes Infrastructure

Transcript

EV Charging and Grid Security: When Mobility Becomes Infrastructure · Cybersecurity Under Pressure. Real Attacks, Real Lessons

• 0:47
  Buenos Dias to our friends in Mexico.
• 0:48
  Welcome to cyber security under pressure, real attacks, real
• 0:52
  lessons. Today is Wednesday, July 1st,
• 0:55
  2026. And it is quite the Wednesday.
• 0:58
  We've got a lot to get through today.
• 1:00
  What happens when the technical detail meets the boardroom
• 1:02
  reality? This story answers that as we
• 1:05
  dive into ransomware and industrial control systems,
• 1:09
  specifically the vulnerabilities in EV charging systems.
• 1:12
  Yeah. It's honestly it's a topic that
• 1:14
  keeps me up at night. I mean, I've got my coffee.
• 1:16
  Here it is the middle of the week and we are basically
• 1:19
  looking down the barrel of a massive impending crisis and
• 1:23
  frankly, most of the world doesn't even realize it's
• 1:25
  happening right in their local supermarket parking lot.
• 1:27
  Exactly. I mean, if you drove to work
• 1:29
  today, you probably passed, what, three or four of these
• 1:31
  machines? Oh, easily.
• 1:32
  And you probably think of them as, you know, nothing more than
• 1:35
  futuristic gas pumps. Just a place to plug in.
• 1:39
  But we are digging into a stack of intelligence today that
• 1:43
  paints a very different, very dark picture.
• 1:46
  Yeah, a much more complicated picture for sure.
• 1:49
  Right, we've got threat landscape reports from Vicone,
• 1:52
  The absolute bombshell findings from Pune to Own Automotive
• 1:56
  2026, research from the NICs lab on anomaly detection, and a
• 2:01
  really deep critical look into the IEC and ISO compliance
• 2:05
  standards. Right, the standards that are
• 2:08
  supposedly keeping all this safe.
• 2:10
  Exactly. So our mission today is to
• 2:12
  understand why the electric vehicle charging network, this
• 2:15
  entire foundation we are building our future mobility on,
• 2:19
  is essentially a massive unprotected attack surface.
• 2:22
  It really is the ultimate midweek reality check.
• 2:24
  Yeah, I mean, you look at an EV charger out in the parking lot
• 2:27
  and you just see a sophisticated extension cord.
• 2:29
  Yeah, a box with a cable. That's it.
• 2:31
  Right. But when you start peeling back
• 2:33
  the layers of the architecture, you realize it is a deeply
• 2:36
  complex computing node. And it's know that we are
• 2:39
  deploying with a terrifying lack of centralized security
• 2:42
  governance. So let's start right there,
• 2:43
  because I think the fundamental illusion we need to shatter for
• 2:45
  you today is exactly that, the idea that an EV charger is just
• 2:48
  an electrical outlet. It's really not.
• 2:50
  Not even close. According to the Vicone
• 2:52
  intelligence reports, an EV charger actually sits at a
• 2:56
  highly complex, completely unique three-way intersection.
• 3:00
  You have cloud software on one side, operational technology or
• 3:04
  OT on the other, and then the automotive systems themselves.
• 3:08
  Intersection is precisely where the danger lies, honestly,
• 3:11
  because you have 3 entirely different engineering
• 3:14
  philosophies basically colliding in a single piece of hardware.
• 3:17
  Which sounds like a recipe for disaster.
• 3:20
  Oh, it is. Let me break that down for you.
• 3:21
  You have the IT domain which is your cloud software, your
• 3:25
  payment gateways, your mobile apps.
• 3:27
  Right, the stuff we interact with on our phones.
• 3:29
  Exactly. Then you have the OT domain, the
• 3:31
  operational technology. This is the heavy physical
• 3:34
  stuff. We're talking high voltage power
• 3:36
  electronics, the internal cooling systems, the physical
• 3:39
  grid interfaces, the. Stuff that actually moves the
• 3:41
  electricity, yeah. And finally, you have the
• 3:44
  automotive domain, the vehicle itself, which is essentially
• 3:47
  just a rolling data center communicating via internal
• 3:50
  canvases. But the engineers who designed
• 3:52
  those three systems, they don't really talk to each other, do
• 3:54
  they? No, and that is the core
• 3:56
  vulnerability. Each of those domains has its
• 3:59
  own legacy, its own specialized tooling, and, most dangerously,
• 4:04
  its own dedicated team of professionals who are all
• 4:07
  silently assuming that someone, someone else is handling the
• 4:09
  broader security risk. Oh wow, so they're all just
• 4:12
  passing the buck without realizing it Pretty much.
• 4:14
  The IT team is securing the web back end.
• 4:16
  Assuming the physical cabinet is tamper proof.
• 4:19
  The OT engineers are entirely focused on, you know, preventing
• 4:23
  physical fires and ensuring power up time.
• 4:25
  They assume the software is locked down.
• 4:27
  And the automotive manufacturer is heavily focused on the
• 4:29
  security of the vehicle itself, often treating the charger as
• 4:33
  just some external third party edge case.
• 4:35
  Right. And that gap, that operational
• 4:37
  blind spot where the 3 domains overlap without a unified
• 4:41
  security architect, is exactly where adversaries are setting up
• 4:44
  camp. OK, let's unpack this.
• 4:46
  It sounds like we are building the world's most complex digital
• 4:48
  bank vault, but placing it in an unlit parking lot where the IT
• 4:52
  guy, the security guard and the bank manager are all pointing
• 4:55
  fingers at each other about who locked the door.
• 4:58
  That is the perfect way to put it.
• 4:59
  And what's fascinating here is this isn't a simulation.
• 5:03
  It's not an academic exercise. Right, this is happening right
• 5:05
  now. Yes, these are real devices
• 5:07
  deployed out in the real world world today.
• 5:09
  And what makes that dynamic so terrifying is the sheer scale of
• 5:13
  the deployment. We aren't talking about some
• 5:15
  niche pilot program anymore. This is critical national
• 5:18
  infrastructure. Yeah, the numbers in these
• 5:20
  reports are staggering. Just looking at the United
• 5:23
  States, we are deploying these chargers at an unprecedented
• 5:26
  scale. There are 192,000 public ports
• 5:31
  active today, and there's a federal mandate to hit 500,000
• 5:35
  by 2030. Think about.
• 5:36
  That for a second-half a million.
• 5:38
  Right half a million of these three-way intersections
• 5:41
  scattered across mall parking lots, along isolated highways in
• 5:45
  residential complexes and then against that backdrop of a
• 5:48
  massive hurried roll out, you have what happened in Tokyo this
• 5:51
  past January. PB own Automotive 2026.
• 5:55
  Oh man, that event was a watershed moment.
• 5:57
  It fundamentally changed the conversation in the industry.
• 6:00
  For anyone who isn't steeped in the cybersecurity world, Pun to
• 6:03
  own is this massive hacking competition where the best
• 6:07
  security researchers on the planet that gather to
• 6:09
  demonstrate 0 day vulnerabilities.
• 6:11
  Right. And just to clarify, a zero day
• 6:13
  is a flaw that the manufacturer has absolutely no idea exists,
• 6:17
  meaning there's zero time to patch it.
• 6:19
  The door is just wide open. And Tokyo was an absolute
• 6:22
  bloodbath for EV chargers. Over three days, researchers
• 6:26
  discovered 76 unique zero day vulnerabilities across the
• 6:30
  entire automotive spectrum. The organizers awarded over $1
• 6:34
  million in prize money. It was wild to watch.
• 6:37
  But the statistic that should really make your blood run cold
• 6:40
  is that more than 55% of all the PN 2 own automotive exploits
• 6:43
  targeted EV chargers. We are talking about successful
• 6:47
  complete system takeovers across nine major brands.
• 6:51
  And you have to understand the methodology here because the
• 6:53
  researchers proved that the attacker doesn't need to, you
• 6:57
  know, hack the car in the classic Hollywood sense anymore.
• 7:00
  Like breaking into the car's internal computer system
• 7:02
  directly. Right.
• 7:03
  You don't need to break into the vehicle's internal network
• 7:06
  directly, which is actually quite difficult these days
• 7:09
  because auto manufacturers have spent the last decade really
• 7:12
  hardening those systems. You just need to target the
• 7:15
  charger management interface. Because the charger isn't just
• 7:18
  delivering electricity, I mean it's establishing a high speed
• 7:21
  data connection with the car the second you plug it in.
• 7:24
  Exactly. The charger is a node in an
• 7:26
  ecosystem. It talks to the car to negotiate
• 7:29
  battery charging rates. It talks to your driver's mobile
• 7:32
  app to authorize a session. Right, it's handling the
• 7:34
  financial side too. Yes, it communicates with the
• 7:37
  banking network to process those payments, and it communicates
• 7:40
  with the national power grid to manage load.
• 7:44
  Because it touches all those things, a vulnerability in the
• 7:47
  charger becomes the ultimate pivot point.
• 7:50
  So if I can compromise the charger, I can potentially
• 7:52
  manipulate the charging signal being sent to the vehicle to
• 7:55
  cause like physical battery degradation.
• 7:58
  Or you can scrape the payment data of every single user who
• 8:02
  plugs in after you. Or honestly, worst of all, you
• 8:06
  can use the Chargers trusted connection to send spoofed
• 8:09
  commands back up into the cloud management system of the
• 8:12
  charging network operator. Wow.
• 8:15
  So we've designed the Charger to be trusted by every other system
• 8:18
  it touches, making it the perfect Trojan horse.
• 8:20
  Exactly. The trust is the vulnerability.
• 8:22
  So we have this massive macro scale problem of 500,000 ports,
• 8:26
  but let's zoom in. I want to talk about the actual
• 8:29
  physical box sitting in the rain in a parking lot.
• 8:32
  How are these attackers actually getting in?
• 8:34
  Yeah, let's look at the actual attacks.
• 8:36
  Because when you think of a cyber attack, you usually
• 8:39
  picture a guy in a hoodie in a basement in Eastern Europe
• 8:42
  bypassing firewalls over the Internet.
• 8:44
  But the V cone intelligence outlines attack vectors that are
• 8:48
  aggressively physical and local. It is the dark irony of
• 8:52
  convenience. We have designed these systems
• 8:54
  to be as frictionless as possible for you, the consumer.
• 8:57
  We want you to be able to just drive up, tap your phone and
• 9:00
  walk away. Which is great when it works.
• 9:02
  Sure, but in creating that seamless experience, we've
• 9:05
  basically handed attackers their entry vectors on a silver
• 9:09
  platter. Take Near Field Communication or
• 9:11
  NFC for example. Right, the tap to pay feature.
• 9:13
  We use it constantly. You tap your phone to buy
• 9:16
  coffee, to get on the subway, and now to authorize a charging
• 9:20
  session. Well, at Pune to own, the
• 9:22
  Synactive team demonstrated a completely novel attack against
• 9:26
  the Autel Massey charger. Using exactly that interface.
• 9:29
  They used a simple NFC tap to exploit the charger via a stack
• 9:34
  based buffer overflow. Wait, wait, so an attacker can
• 9:37
  literally walk up, tap their phone like they're buying a cup
• 9:40
  of coffee, and rewrite the firmware because someone left a
• 9:43
  buffer overflow in the payment parser?
• 9:45
  Yes. Yeah, that is exactly what
• 9:47
  happened. It's that simple.
• 9:48
  That's terrifying. It really is, and to understand
• 9:51
  why that's so devastating, you need to understand what buffer
• 9:53
  overflow actually is. When you tap your phone, it
• 9:56
  sends a packet of data to the charger, things like your
• 9:59
  payment token or user ID, right? The charger software allocates a
• 10:02
  specific fixed amount of memory, a buffer to hold that incoming
• 10:06
  data while it reads it. So for anyone trying to
• 10:09
  visualize this, it's like pouring a glass of water into a
• 10:12
  shot glass. The shot glass is the memory
• 10:15
  buffer designed for a tiny standard NFC payment token.
• 10:18
  Precisely, And if the software doesn't check the size of the
• 10:21
  data before accepting it, which is by the way a classic flaw in
• 10:25
  CNC plus plus programming languages often used in these
• 10:28
  embedded systems, the attacker can send a massive oversized
• 10:32
  packet of data. Right, so the water overflows
• 10:35
  the shot glass. Yes, it spills over into the
• 10:37
  adjacent memory space, Yeah, but in a computer, that adjacent
• 10:41
  memory space contains the actual executing code of the operating
• 10:45
  system. So the attacker overflights the
• 10:48
  buffer, overwrites the legitimate instructions with
• 10:50
  their own malicious code, and suddenly the charger is
• 10:53
  following the attacker's commands instead of the
• 10:55
  manufacturers. Yes, exactly.
• 10:57
  And Trend AI Zero Day Initiative noted this was a massive first
• 11:00
  for public demonstrations. They triggered full code
• 11:03
  execution that fundamentally altered the charger's output
• 11:06
  behavior just by tapping A modified phone against the
• 11:08
  plastic. NFC was designed strictly as a
• 11:11
  consumer convenience feature. It was never intended to be, and
• 11:14
  obviously wasn't treated as a hardened security boundary.
• 11:18
  The system just implicitly trusted whatever data format
• 11:21
  came from the NFC reader. That is deeply unsettling.
• 11:24
  It requires absolutely zero network access.
• 11:28
  Someone could literally be walking their dog past the
• 11:30
  charger, tack a custom built device disguised as a phone
• 11:33
  against the reader and keep walking, leaving a completely
• 11:37
  compromised malicious node behind them to infect the next
• 11:40
  car that plugs in. It's the ultimate drive by,
• 11:42
  attack or walk by. Attack, I guess, right?
• 11:45
  But the VACUUM report shows that wasn't even the only local
• 11:48
  attack. Team 299 went after the Grizzly
• 11:51
  Smart 40 amp charger and they didn't even need to bother with
• 11:54
  writing a complex buffer overflow, they just used hard
• 11:56
  coded credentials. Yes, CWE 798 for those tracking
• 12:01
  the technical classifications in the on my reframe work, the use
• 12:04
  of hard coded credentials. It is a persistent,
• 12:07
  embarrassing, industry wide plague in embedded systems.
• 12:10
  So what exactly are they doing there?
• 12:12
  Well, manufacturers will build a device and leave a default
• 12:15
  username and password hard coded directly into the firmware
• 12:18
  source code. Like the classic admin and
• 12:21
  password 123 buried in the code. Why do they even do that?
• 12:24
  They do it to make maintenance or initial provisioning easier
• 12:28
  for their own technicians. They think you know if a PEC is
• 12:31
  standing in front of the box in the freezing rain.
• 12:33
  We want them to be able to log in easily without calling a help
• 12:36
  desk to authenticate. So they bake a universal
• 12:39
  backdoor into the device out of sheer laziness.
• 12:41
  Basically so team 299 extracted the firmware, found these
• 12:45
  credentials and use them to bypass the chargers
• 12:48
  authentication completely. But they didn't stop there,
• 12:50
  right? No they didn't.
• 12:52
  They chained that access with another vulnerability classified
• 12:54
  as CW 494, which is the downloading of code without an
• 12:59
  integrity check. OK, let me break that down for
• 13:01
  you. Listening normally, if a device
• 13:03
  downloads a software update, it uses cryptography to verify that
• 13:07
  the update actually came from the manufacturer.
• 13:09
  It checks the digital signature. Right, but the Grizzly didn't do
• 13:13
  that. So Team 299 used the hard coded
• 13:16
  password to get admin access and then simply told the charger to
• 13:19
  download and run a malicious firmware file.
• 13:21
  And the charger just did it. The charger just blindly
• 13:24
  accepted it and ran it without ever verifying if the code was
• 13:27
  mathematically signed by the manufacturer.
• 13:28
  Wow. And the Vicone analysis points
• 13:31
  out the terrifying reality of this.
• 13:34
  If you find a hard coded credential on one charger, you
• 13:37
  haven't just compromised that single unit, you've compromised
• 13:41
  the entire global fleet. Because it's the exact same code
• 13:45
  on every box. Exactly.
• 13:46
  The manufacturer flashes the exact same firmware image with
• 13:50
  the exact same hard coded password onto thousands of
• 13:53
  devices rolling off the assembly line.
• 13:56
  It is the definition of a highly scalable attack.
• 13:59
  These pans aren't deep, complex cryptographic breaks that take
• 14:03
  super for computers to crack. They are legitimate, intentional
• 14:06
  design choices, convenience features for consumers, and
• 14:10
  maintenance backdoors for technicians that become highly
• 14:12
  viable attack paths because they are trusted too broadly without
• 14:15
  any secondary validation. I want to pivot slightly because
• 14:18
  we also have to mention the purely user facing vectors.
• 14:22
  The ingenuity of cyber criminals when it comes to simple low tech
• 14:27
  fraud is always astounding. The intelligence reports detail
• 14:31
  a massive rise in a technique called Cushing.
• 14:34
  Cushing is brilliant in its absolute simplicity.
• 14:38
  It's phishing but utilizing fake QR codes.
• 14:41
  Think about your own experience. You pull up to a charger.
• 14:45
  Maybe the digital screen is broken, or the interface is
• 14:48
  confusing, or there's just a giant sticker right next to the
• 14:51
  screen that says scan here to pay quickly.
• 14:53
  And someone has simply printed out a highly realistic looking
• 14:56
  sticker with a malicious QR code and slapped it right over the
• 15:00
  legitimate 1. Right, You scan it with your
• 15:02
  phone, and your browser opens a website that looks exactly Pixel
• 15:05
  for Pixel, like the charging operator's official payment
• 15:07
  portal. You punch in your credit card
• 15:09
  details, maybe your billing address, and hit submit.
• 15:12
  The attacker harvests all that data instantly.
• 15:14
  They might even seamlessly forward you to the real payment
• 15:17
  page afterwards so you never suspect a thing.
• 15:19
  It requires 0 technical hacking of the chargers internal
• 15:22
  hardware. The attacker doesn't need to
• 15:24
  know C++ or understand buffer overflows.
• 15:27
  They just need 20 bucks for a label maker.
• 15:30
  Yet it completely destroys consumer trust in the
• 15:32
  infrastructure and alongside that you have crude physical
• 15:36
  tampering. Like prying open the box.
• 15:38
  Yeah, many of these charging cabinets have exposed USB,
• 15:42
  serial or debug interfaces located right behind a thin,
• 15:45
  cheap plastic panel. If a manufacturing technician
• 15:49
  leaves a debug port enabled in the production firmware, it
• 15:52
  happens constantly because they just forget to turn it off
• 15:55
  before shipping. An attacker can literally just
• 15:57
  pry the panel open with a screwdriver.
• 15:59
  Stop it right off. Exactly.
• 16:00
  They plug in a laptop and they own the internal file system of
• 16:04
  the device. So if the hardware is
• 16:06
  fundamentally this flawed, if a guy can just print a sticker or
• 16:09
  tap his phone or Bry, open a plastic door and plug into an
• 16:12
  exposed USB port, how on earth are these devices legally
• 16:17
  allowed to be installed on city streets?
• 16:19
  That's the $1,000,000 question. Because whenever you talk to the
• 16:22
  manufacturers about this, they immediately point to the rule
• 16:25
  book. They throw their hands up and
• 16:26
  say, look at our documentation. We have ISO 1/5 and 118
• 16:30
  certification. We have IC 62543 compliance.
• 16:35
  We are secure. That is the mantra of the entire
• 16:38
  energy and mobility sector right now.
• 16:40
  We passed the audit, therefore we are invulnerable.
• 16:43
  But the data from P2 own proves that paper compliance is
• 16:46
  definitively not operational security.
• 16:49
  Not even close. Between 2024 and 2026,
• 16:53
  researchers found 96 critical zero day vulnerabilities on
• 16:56
  certified, fully compliant products.
• 16:59
  A 96? That's insane.
• 17:01
  Yeah, these were devices that had all the right stamps of
• 17:03
  approval from international auditing bodies.
• 17:05
  They've passed all the lab tests, and they were still
• 17:08
  ripped to shreds by security researchers in a matter of
• 17:11
  minutes on a Convention Center stage.
• 17:13
  Let's really look closely at ISO 14118 because that standard is
• 17:16
  the absolute backbone of the entire plug and charge
• 17:19
  ecosystem. For you listening, the idea of
• 17:21
  Plug and charge is this beautiful, seamless future.
• 17:23
  It's a great concept in theory. Right, you just plug your car
• 17:26
  into the charger. The car and the charger
• 17:28
  automatically authenticate each other, your billing is handled
• 17:31
  invisibly in the background, and the power flows.
• 17:34
  No apps, no credit cards, no QR codes To make that work
• 17:37
  securely. ISO 15118 mandates heavy
• 17:41
  cryptography. Right, it requires TLS
• 17:44
  encryption and a public key infrastructure or PKI for the
• 17:48
  vehicle to grid the V2G communications.
• 17:51
  It looks completely ironclad on paper.
• 17:53
  It relies on a mathematical digital trust chain.
• 17:56
  The vehicle holds a cryptographic certificate issued
• 17:58
  by the manufacturer. The charging station holds a
• 18:01
  certificate issued by the network operator.
• 18:03
  When they connect, they perform a digital handshake, verifying
• 18:06
  each other's certificates through a trusted central
• 18:08
  authority. It sounds perfect, so where does
• 18:10
  it break down? Well, what Pinto and revealed
• 18:12
  was that the implementation of these standards by the hardware
• 18:15
  vendors is often disastrously flawed.
• 18:18
  The math of the cryptography is solid, but the way the engineers
• 18:20
  write the code to use that math is full of holes.
• 18:24
  So the theory is good, the execution is terrible.
• 18:26
  Exactly. Researchers were able to
• 18:28
  entirely intercept the VG communication channels.
• 18:32
  They successfully spoofed commands in transit, a
• 18:34
  vulnerability classified as CWE 345.
• 18:37
  Wait, if the channel is encrypted with TLS, how are they
• 18:40
  intercepting and spoofing commands?
• 18:42
  Because of poor key management, if an attacker can extract the
• 18:45
  private cryptographic key from the charger's memory, perhaps by
• 18:49
  using that exposed debug port or the hard coded credential we
• 18:52
  discussed earlier, they can impersonate the charger.
• 18:54
  Oh I see. They can decrypt the traffic,
• 18:56
  alter a command from the network operator, say changing a stop
• 19:00
  charging command to a deliver maximum voltage command, re
• 19:03
  encrypt it and send it to the car.
• 19:05
  And the car just takes it. The car accepts it because it
• 19:07
  was signed with the correct, albeit stolen, private key.
• 19:11
  So what does this all mean? If a piece of hardware has a
• 19:15
  multi $1,000,000 stamp of approval saying it meets
• 19:18
  international cybersecurity standards, but a single
• 19:21
  researcher can extract the private keys and spoof the
• 19:23
  entire command chain, what is the standard actually
• 19:26
  protecting? If we connect this to the bigger
• 19:28
  picture, the standards are protecting the theory of the
• 19:32
  system, not the messy physical reality of the deployment.
• 19:35
  Which is a huge problem. Huge.
• 19:37
  Let's look at IEC 62443, which is heavily pushed as the gold
• 19:42
  standard for industrial control system security.
• 19:45
  It strictly mandates firmware hardening, secure boot processes
• 19:49
  and robust authentication for all critical functions.
• 19:52
  OK, yet as we just discussed with the Grizzly charger in Team
• 19:55
  299, vendors are routinely shipping firmware with hard
• 19:59
  coded credentials and update mechanisms that require 0
• 20:02
  authentication. Let me push back on that because
• 20:05
  it kind of defies logic. If IEC 62443 strictly mandates
• 20:11
  secure authentication, how on earth is a box with admin and
• 20:15
  password 123 getting a compliance stamp?
• 20:17
  It's baffling, right? It sounds like these auditors
• 20:20
  are just checking off a paperwork matrix instead of
• 20:22
  actually pen testing the live firmware.
• 20:24
  You've hit the nail on the head. That is exactly what is
• 20:26
  happening. Compliance audits are largely
• 20:28
  point in time assessment based on design documentation, not
• 20:32
  adversarial penetration testing. So they aren't actually
• 20:34
  attacking the device to see if it holds up.
• 20:36
  Exactly. An auditor walks into a
• 20:39
  conference room, asks the engineering manager.
• 20:41
  Do you securely manage passwords?
• 20:44
  The manager hands them a 500 page design document that says
• 20:48
  yes, passwords are securely managed.
• 20:50
  And the auditor just checks a box and moves on, Yes.
• 20:53
  They're not pulling the firmware image off a production device,
• 20:56
  throwing it into a disassembler, and reverse engineering the
• 20:59
  binary code to look for hard coded text strings.
• 21:02
  And it gets worse when you look at the automotive side.
• 21:03
  The automotive industry has its own standard for cybersecurity.
• 21:07
  I so say 21434. It defines rigorous requirements
• 21:11
  for a vehicle cybersecurity management system.
• 21:14
  Yes, but historically it has frequently excluded the EV
• 21:17
  supply equipment, the actual chargers, from its scope
• 21:20
  entirely, the automakers argued. We build the car, we secure the
• 21:24
  car. The charger is infrastructure.
• 21:26
  So that's the energy sector's problem.
• 21:27
  So the car is heavily regulated by automotive standards, the
• 21:30
  power grid is regulated by energy sector standards, and the
• 21:33
  charger itself sits in this vast unregulated Gray area in the
• 21:36
  middle. Yep.
• 21:38
  The exact spot where all the data and power flows through.
• 21:40
  And the consequences of compromising that plug and
• 21:44
  charge trust chain in that Gray area are massive.
• 21:48
  One of the intelligence reports details that if the V2G PKI is
• 21:52
  compromised, you aren't just looking at someone getting a
• 21:54
  free charge for their Tesla. Right.
• 21:56
  It's way bigger than that. You are looking at widespread
• 21:58
  systemic availability. Loss attackers can steal the
• 22:02
  charging station certificates on mass.
• 22:04
  With those certificates, they can impersonate legitimate
• 22:07
  chargers across the network, intercepting payment
• 22:10
  authorizations and leading to massive systemic billing fraud
• 22:14
  that the operators wouldn't be able to distinguish from
• 22:17
  legitimate traffic. And the fundamental reason this
• 22:19
  keeps happening is that the industry is using the wrong
• 22:22
  mental model for defense. Most Chargepoint operators are
• 22:25
  relying on traditional IT security tools.
• 22:27
  Like what? What are they using?
• 22:29
  They are buying standard firewalls, VPNs, and SIM alert,
• 22:33
  security information and event management systems.
• 22:35
  Those tools are great for protecting cloud infrastructure
• 22:38
  and corporate e-mail, but an IT firewall cannot identify an
• 22:42
  embedded firmware risk. Right, it doesn't speak that
• 22:44
  language. No, it cannot inspect the
• 22:47
  payload of a specialized OCPP protocol message to see if it
• 22:51
  contains A maliciously crafted voltage command.
• 22:54
  We are treating a complex cyber physical system exactly like a
• 22:58
  standard corporate network and it is failing catastrophically.
• 23:01
  So we have a scenario where the standards fail and the hardware
• 23:04
  is basically wide open. If I'm an advanced attacker,
• 23:07
  stealing a single credit card via QR code or getting a free
• 23:11
  charge is small time. The real money and the real
• 23:14
  terror for an energy executive or a government official comes
• 23:18
  when you weaponize that access at scale.
• 23:21
  And that's where things get really bleak.
• 23:23
  Which brings us to the boardroom, because when you
• 23:25
  explain buffer overflows to ACEO, their eyes glaze over, but
• 23:29
  they sit straight up when you talk about ransomware, and they
• 23:32
  break into a cold sweat when you talk about the national power
• 23:35
  grid. Oh yeah, you mentioned the grid
• 23:36
  and suddenly everyone is paying attention.
• 23:38
  Let's elevate the stakes here. If the devices are inherently
• 23:41
  vulnerable, what is the worst case scenario?
• 23:44
  The worst case scenario is that we are inadvertently rapidly
• 23:48
  building the infrastructure for nationwide blackouts.
• 23:51
  Let the math sink in for a minute.
• 23:53
  By 20-30, we expect to have 30 million electric vehicles on the
• 23:56
  road. 30 million, yes. The charging infrastructure is
• 23:59
  rapidly evolving from a niche convenience service into a
• 24:02
  critical load bearing layer of the energy grid itself.
• 24:06
  So let's start with the immediate financial threat to
• 24:08
  the operators. First, ransomware.
• 24:10
  We are used to seeing ransomware hit hospitals or oil pipelines,
• 24:15
  but station ransomware is becoming a very real, very
• 24:18
  profitable attack model. It's highly lucrative.
• 24:22
  An adversary doesn't just walk up to lock a single charger.
• 24:24
  They use a localized vulnerability to gain an initial
• 24:27
  foothold. And then they exploit a flaw in
• 24:29
  the Open Chargepoint protocol OCPP.
• 24:32
  What does that do exactly? OCPP is the communication
• 24:35
  protocol used between the charging station and the Central
• 24:37
  Cloud Management System. It's essentially the language
• 24:40
  the network uses to say start charging, stop charging, or
• 24:43
  update your software. So the attacker rides the OCPP
• 24:46
  connection backward, pivoting from the physical charger in the
• 24:49
  parking lot up into the Chargepoint operator's central
• 24:53
  cloud system. Exactly.
• 24:55
  Once they compromise the central management system, they have the
• 24:58
  keys to the Kingdom. They can push a malicious
• 25:01
  firmware update to every single charger in the operator's fleet
• 25:05
  simultaneously. So basically holding the whole
• 25:07
  network hostage at once? Yes.
• 25:09
  Suddenly on a Tuesday morning, 10,000 chargers across the
• 25:13
  country freeze. The digital screens all change
• 25:17
  to display a Bitcoin wallet address.
• 25:19
  Until the ransom is paid, fleet operations are crippled.
• 25:22
  Delivery trucks can't charge, commuters are stranded, and the
• 25:26
  operator is bleeding millions of dollars a day in lost revenue,
• 25:29
  not to mention the catastrophic reputational damage.
• 25:31
  Exactly, but honestly even that is the scariest part.
• 25:34
  Right, because it's one thing to have your credit card skimmed.
• 25:37
  It's an entirely different Wednesday when a hacker turns 30
• 25:40
  million cars into a synchronized weapon to take down the national
• 25:43
  power grid. And that is not hyperbole.
• 25:46
  We have to look at the research coming out of the NICs lab.
• 25:49
  They detail the profound grid impacts of compromised vehicle
• 25:52
  to grid sessions. B2G is a technology that allows
• 25:56
  cars to not just take power from the grid, but to push power
• 25:59
  stored in their massive batteries back into it.
• 26:01
  So it acts like a giant decentralized battery.
• 26:04
  Right. It's designed to be a buffer,
• 26:06
  helping to balance the grid during peak demand times by
• 26:09
  using millions of cars as a distributed power plant.
• 26:12
  But by doing that, it creates a bi directional coupling between
• 26:15
  millions of automotive batteries and the fragile legacy, the
• 26:19
  national energy infrastructure, which means the flow of energy
• 26:23
  can be weaponized. Precisely to understand the
• 26:25
  threat, you need to understand how the power grid works.
• 26:28
  The grid operates on a very delicate balance of supply and
• 26:30
  demand to maintain frequency stability.
• 26:32
  It has to stay balanced at all times.
• 26:34
  Right. Yes.
• 26:35
  In North America, the grid must operate at exactly 60 Hertz.
• 26:38
  If demand suddenly outstrips supply, the frequency drops.
• 26:41
  If supply outstrips demand, it spikes.
• 26:44
  Large charging operators remotely control hundreds of
• 26:47
  thousands of charging notes. Attacker gains control of that
• 26:50
  central system. They could remotely switch a
• 26:53
  massive percentage of those chargers on and off
• 26:56
  simultaneously. Like flipping a giant national
• 26:58
  light switch, thousands of megawatts of power instantly
• 27:02
  pulling from the grid, then instantly stopping.
• 27:05
  And the grid's physical infrastructure, the massive
• 27:07
  spinning turbines and power plants, have physical inertia.
• 27:11
  They cannot react to instantaneous massive
• 27:14
  fluctuations. So what happens if they try?
• 27:16
  If you suddenly drop gigawatts of demand and then instantly
• 27:19
  spike it back up, you create severe frequency oscillations.
• 27:22
  If those imbalances are large enough, they can overwhelm local
• 27:25
  substations, cause Transformers to literally overheat and melt,
• 27:29
  and trigger protective relays to trip, leading to cascading
• 27:32
  nationwide blackouts. The NICs library search even
• 27:35
  outlines specific localized physical attacks that don't even
• 27:39
  require hacking the network. They detail something and called
• 27:41
  the broken wire attack. Broken wire is mechanically
• 27:44
  fascinating and terrifying. Researchers prove they could use
• 27:48
  targeted electromagnetic interference EMI to wirelessly
• 27:51
  disrupt the communication between the vehicle and a rapid
• 27:54
  DC fast charger. How does that even work?
• 27:56
  The charger in the car communicate over the charging
• 27:59
  cable using a specific signaling protocol, often a pulse width
• 28:03
  modulation signal. The researchers built a radio
• 28:06
  frequency emitter that broadcasts A malicious
• 28:08
  overpowering electromagnetic signal nearby.
• 28:11
  Like a jammer. Sort of, yes.
• 28:14
  The interference corrupts the signal on the wire.
• 28:17
  The charger safety systems interpret the corrupted signal
• 28:20
  as a critical physical fault, like a severed cable, and it
• 28:24
  immediately forces a high voltage charging session to
• 28:26
  abort to prevent a fire. They don't even need to touch
• 28:29
  the charger. So you could have an attacker in
• 28:31
  a van driving slowly through a busy city center, silently
• 28:34
  broadcasting this RF signal, shutting down every EV charging
• 28:38
  session they pass, completely paralyzing municipal fleets or
• 28:42
  electric buses. Exactly.
• 28:43
  And the NICs Lab also models the ultimate doomsday scenario, the
• 28:47
  threat of an EV botnet. Imagine a scenario where a
• 28:50
  malware infection slowly spreads through a specific brand of
• 28:53
  charger or a popular third party charging app over months.
• 28:57
  So it's just sitting there waiting.
• 28:58
  Yes, it doesn't do anything malicious.
• 29:01
  At first. The botnet remains dormant,
• 29:03
  waiting for a specific trigger. It waits for a moment of peak
• 29:07
  grid stress, say the hottest afternoon in late August, with
• 29:10
  every air conditioner in the region is maxed out and the grid
• 29:13
  is operating at 99% capacity. And then the botnet
• 29:17
  simultaneously commands every single infected vehicle to
• 29:20
  instantly draw maximum voltage. It's a massive coordinated
• 29:25
  denial of service attack, not against the website, but against
• 29:28
  the physical power grid itself. The sudden spike in demand would
• 29:31
  instantly crash the local grid. And this isn't just hypothetical
• 29:34
  anymore. The ENISA Threat Landscape
• 29:35
  reports are already flagging energy and transportation as the
• 29:39
  two most critical targets for state sponsored cybercrime.
• 29:42
  And with EV infrastructure, we are merging those two sectors
• 29:45
  electronically for the first time in human history.
• 29:48
  I really want you, the listener, to think about the cascading
• 29:51
  societal risk here. Mobility is the absolute
• 29:54
  lifeblood of the modern economy. It impacts literally everything,
• 29:57
  yes. If the charging infrastructure
• 30:00
  goes offline or is destroyed by a grid surge, food doesn't get
• 30:04
  delivered to supermarkets. Emergency medical personnel
• 30:08
  might not be able to deploy their vehicles.
• 30:10
  The economic damage of these attacks isn't just the cost of
• 30:13
  replacing a ruined charger, it's the total paralysis of a city.
• 30:17
  So if the grid is at risk and the vulnerabilities are this
• 30:21
  severe, who is actually supposed to be guarding this?
• 30:24
  We have the threats, we know the high stakes, we know the
• 30:27
  international technical standards are riddled with
• 30:30
  loopholes. So who is legally and
• 30:32
  operationally responsible for fixing it?
• 30:35
  That is the ultimate governance problem defining the entire
• 30:38
  industry right now. We have to fundamentally stop
• 30:40
  viewing the EV charger. It's just a piece of dumb
• 30:42
  infrastructure for mobility. It is conceptually and
• 30:45
  technically a trust boundary. And right now, no, absolutely no
• 30:48
  one wants to own that boundary. Because owning it means
• 30:51
  accepting liability. Think about the convoluted chain
• 30:53
  of custody for a single everyday charging session.
• 30:56
  You have the vehicle manufactured by an OEM like
• 30:59
  Ford, Tesla or Volkswagen. OK, that's one.
• 31:01
  You have the physical charger hardware built by a manufacturer
• 31:04
  like Ottel, ABB or Chargepoint. You have the Chargepoint
• 31:08
  operator managing the physical site and setting the pricing.
• 31:11
  You have a massive cloud provider like AWS or Azure
• 31:15
  hosting the back end databases, and you might have a commercial
• 31:18
  fleet operator managing the specific vehicles.
• 31:20
  So when a vulnerability is found, say the one we discussed,
• 31:24
  where a spoofed signal manipulation translates from the
• 31:27
  charger into the vehicle's internal battery management
• 31:30
  system, causing physical damage, who owns the risk?
• 31:33
  Who pays the insurance claim? It is a jurisdictional
• 31:36
  nightmare. The OEM will point to their logs
• 31:38
  and say our car's internal firewall is secure.
• 31:41
  The external charger sent a malicious voltage spike.
• 31:44
  Blame them. And the charger manufacturer?
• 31:46
  The charger manufacturer will say the hardware functioned
• 31:49
  exactly as designed but the cloud back end was broached,
• 31:52
  sending us a bad command, and the cloud provider will point at
• 31:54
  the OCPP communication protocol and blame the network operator.
• 31:58
  It's like buying a high end security system for your house
• 32:01
  but leaving the garage door open because the garage come Wait,
• 32:04
  no, because the power company. See what I mean?
• 32:06
  The jurisdiction is a complete mess.
• 32:09
  It is, and while the corporations point fingers at
• 32:11
  each other, the uncomfortable truth is that the end customer
• 32:15
  does not care about internal vendor disputes or complex
• 32:18
  supply chains. They will not separate the blame
• 32:21
  cleanly. No, of course not.
• 32:23
  Put yourself in the driver's shoes if you plug your brand new
• 32:27
  $80,000 luxury EV into a public charger and your car's dashboard
• 32:31
  goes blank black and the vehicle is completely bricked because of
• 32:35
  a ransomware payload delivered through the charger.
• 32:38
  Man, people would lose their minds.
• 32:40
  Right. And you aren't going to blame an
• 32:42
  obscure cloud provider or a middleware protocol.
• 32:46
  You were going to blame the logo on the steering wheel.
• 32:48
  You were going to tell everyone you know my car got hacked?
• 32:52
  Which means the strategic error the automotive industry has been
• 32:55
  making for the last five years is treating charger security as
• 32:59
  a separate, isolated work stream.
• 33:01
  They're acting like it's the energy company's problem, but
• 33:04
  it's not. They are the exact same problem.
• 33:08
  Security validation must extend beyond the physical boundary of
• 33:11
  the vehicle. Precisely.
• 33:13
  Automakers and Tier 1 suppliers have to absorb the entire
• 33:16
  charging network into their core threat model.
• 33:19
  They cannot just trust the plug. They be doing.
• 33:21
  They need to be demanding audits of the firmware pipelines of
• 33:25
  their charging partners. They need to be actively
• 33:27
  penetration testing the OCPP implementations and securing the
• 33:31
  mobile apps as if they were internal mission critical
• 33:34
  vehicle components. But the research also points to
• 33:37
  solutions emerging right We aren't just sitting here waiting
• 33:40
  for the grid to collapse. The NICs Lab Intelligence
• 33:43
  highlights new advanced approaches, specifically
• 33:46
  detailing the CAD 4 CS model. Yes, the Collaborative Anomaly
• 33:50
  Detection System for charging stations.
• 33:52
  This represents A crucial necessary shift in our defense
• 33:55
  strategy. Historically we've relied on
• 33:58
  signature based detection. Like an antivirus looking for a
• 34:00
  known bad file. Right.
• 34:02
  We look for the fingerprint of known malware, but as pinned to
• 34:06
  improved adversaries are using zero days attacks that have no
• 34:09
  known signature. 4C has abandoned signatures entirely.
• 34:13
  Instead, it uses advanced machine learning to monitor the
• 34:16
  actual physical thermodynamic behavior of the station.
• 34:20
  Explain how that works in practice.
• 34:21
  What is it actually looking at? It looks for deviations in power
• 34:24
  consumption and timing. A normal charging session
• 34:27
  follows a very specific mathematical curve of power draw
• 34:31
  as the battery fills up. The machine learning model
• 34:33
  learns this curve perfectly. OK, I'm following.
• 34:36
  If an attacker compromises the charger software and tries to
• 34:39
  execute a payload that silently manipulates the voltage or tries
• 34:43
  to launch a botnet attack, the physical power draw of the
• 34:46
  internal components will spike erratically.
• 34:49
  So even if the attacker has completely compromised the
• 34:51
  software logs, even if they've rewritten the code to say
• 34:54
  everything is perfectly fine here, the cats foresee the
• 34:56
  system flags, the physical power spike.
• 34:59
  You can lie in the software, but you can't lie about the physics.
• 35:02
  Exactly. It's bridging the critical gap
• 35:04
  between IT security and OT security.
• 35:07
  It relies on Collaborate Intelligence, meaning charging
• 35:10
  stations securely share this anonymized physical anomaly data
• 35:14
  across the entire network. So they can see the big picture.
• 35:17
  Yes, if three chargers in a city suddenly show identical abnormal
• 35:22
  power curves, the central system can instantly isolate them
• 35:25
  before a grid scale attack can cascade.
• 35:28
  It is true infrastructure level thinking.
• 35:30
  This raises an important question, what are we doing
• 35:32
  tomorrow? If you are a network operator, a
• 35:35
  government regulator, or an automotive executive listening
• 35:37
  to this, how do you actually start fixing this today before
• 35:40
  the 500,000 ports are fully deployed?
• 35:43
  Well, first they have to start by enforcing strict physical and
• 35:46
  logical network segmentation and EV charger should never ever
• 35:50
  have a direct unmonitored pathway into the core corporate
• 35:53
  network of the operator. If the charger falls, it needs
• 35:56
  to be an isolated island. Second, they need to implement
• 36:00
  rigorous certificate life cycle governance.
• 36:03
  If a charger is physically tampered with, its cryptographic
• 36:06
  certificate must be instantly globally revoked to protect the
• 36:10
  plug and charge trust chain. And most importantly, the entire
• 36:13
  industry needs to stop relying entirely on point in time
• 36:17
  compliance audits. ISO and IEC certifications are a
• 36:21
  baseline, not a finish line. It's just the starting point.
• 36:24
  Right. They must institute continuous,
• 36:26
  aggressive, adversarial penetration testing across the
• 36:29
  entire stack, hardware, firmware and cloud, just like they do at
• 36:33
  Punto Own, but every single day. Think about this.
• 36:36
  If our vehicles are rapidly becoming massive mobile
• 36:38
  batteries directly hardwired into a fragile legacy power
• 36:42
  grid, does securing that grid eventually mean we'll have to
• 36:45
  fundamentally restrict how much software we legally allow inside
• 36:48
  the car itself? It is definitely a terrifying
• 36:50
  thought to leave everyone with. That's all for this episode of
• 36:53
  Cybersecurity Under Pressure. Real attacks, real lessons.
• 36:56
  It's been a great deep dive, thanks for having me.
• 36:58
  The technical detail matters, the board perspective matters,
• 37:01
  but what matters most is what you do with both tomorrow,
• 37:04
  especially when considering the security of EV charging systems
• 37:08
  and their impact on industrial control systems.
• 37:11
  Safe, secure, everyone. See.
• 37:12
  You in the next chapter.