Speak EV - Electric Car Forums banner
1 - 20 of 27 Posts

·
Registered
Skoda Enyaq iV60
Joined
·
137 Posts
Discussion Starter · #1 ·
Just saw this article on BBC


when things get too smart, there’s someone smarter to exploit it.
Maybe it’s better/safer to go for a less smart charger?

Nevertheless, make sure you keep it updated with latest firmware etc!
 

·
Registered
Joined
·
234 Posts
The biggest risk for any internet connected appliance is for it to act as a backdoor to the local home network. The EVSE in that news article was running using a Raspberry Pi - I would guess most likely would be running a full Linux kernel and IP stack. If something is poorly configured, it can be exploited. It is quite easy to leave a default password or leave a certain port open and make that device accessible remotely. I've ran a webserver in the past and see countless attempts to use exploits to attack that webserver and any other port that might be open. Most of these are automated, many originate in China, Russia, North Korea, India etc. Once a vulnerability is found, it will be exploited one day. It is not a case of if, but when.

Just have a quick google for CCTV vulnerabilities.... There are countless CCTV cameras out there either setup poorly, or have known, or intentional security vulnerabilities in them and the result is that CCTV camera is viewable to anyone online, if they know what to do / where to look. Whilst your back garden patio or driveway might not be that interesting, a CCTV camera installed in, say, a government building, might see and hear all sorts of hanky "Hancock" panky going on! Never mind about National Security...

I have a CCTV recorder box (Chinese built no-name thing) but its ethernet connection is on a different network alltogether only accessible via an SSH Tunnel bridge, only accessible to me when I want to check the cameras, so it cannot "phone home" or be seen remotely. Dons tin-foil hat
 

·
Registered
Joined
·
266 Posts
This is something I’ve been aware of form some time (I’ve worked with Ken a few times). It’s easy to make something smart but also easy to make it without security as that has a perceived cost increase (actually cheaper to make it secure at the beginning).

As others have said, it’s more about whether the charging point can be used as a vector into the home network, but also potentially a vector into the car itself.
 

·
Registered
Joined
·
234 Posts
Given the pilot signal between the EVSE and the car is just a varying voltage & square wave with a varying mark-space ratio, there is no way to actually communicate actual data with the car itself apart from telling it to start and stop charging and to vary the allowable charging current. Worst thing you could do here I suspect is rapidly toggle between Start and Stop charging, causing a contactor inside the car to chatter on and off, maybe causing early failure of that contactor, or to set a permissable charging current to 32A when the installation was originally restricted in software to say 16A due to limited supply capacity, thus potentially popping a fuse or melting a cable.

The other issue from a compromised EVSE would be to switch on banks of them during peak energy usage, say 6PM when everyone is cooking dinner or directly at the end of a major football event when the national grid is already trying to cope with our national obsession for tea to drown our sorrows at yet another loss.
 

·
Registered
Joined
·
345 Posts
The best bit in that article was "You could stop them from charging their own vehicles, and provide free charging to an attacker's vehicle". So when I get home to find a Trabant EV on my drive I will know that the Russian hackers have struck.

PS Yes, there is a Trabant EV
 

·
Registered
2014, Vauxhall Ampera
Joined
·
80 Posts
Total and utter FUD, what real-world benefit would someone using the exploit get?

BBC Click should really make sure their "journalists" have a minimum of 0.0001% understanding of what they report.
 

·
Registered
Joined
·
234 Posts
The physical attack of the EVSE on the driveway, replacing the industrial Raspberry Pi compute module with another one? That is incredibly unlikely and unless you are a high profile individual, why would someone target you like that? So yes, that risk is on the million to one scale of probability.

A network vulnerability meaning someone could remotely use that EVSE device to access anything on your home network? Far more probable and quite possible to happen if they don't need to be sat on your driveway to carry it out! You might call it FUD just because it's negative news within the EV arena, but network security of "Internet of Things" / connected devices is a real issue and one that needs more publicity to force manufacturers to do the right thing.
 

·
Registered
Kia e-Niro 4 MY20, Zoe Z.E.50 GT Line
Joined
·
2,121 Posts
This is standard for any internet of shit device. The just enough to function firmware will possibly never be updated. If it is, maybe once or twice, it’s highly unlikely to still be actively developed beyond a couple of years. Anything you plug into a network that isn’t a current OS that you are getting updates has to be assumed to have known vulnerabilities that are potentially under active exploit.
 

·
Registered
Joined
·
1,961 Posts
Another reason why it's just plain bad engineering to use a full-on linux platform like Raspberry Pi in a device that just needs very basic connectivity, which could easily be done with much simpler, cheaper and more reliable hardware like an ESP32 microcontroller.

At least that one used the compute module, unlike the Hypervolt, which uses a standard RasPi board, so has the additional potential failure point of using a microSD card.

As regards severity of security issues on hardware like this, imagine a significant number of EVSEs being commanded to turn on or off simultaneously - the power distribution network is not designed to handle very sudden simultaneous load changes, so more serious effects like area over/undervoltage or trip-outs happenning are at least plausible.
 

·
Registered
Kia E Niro 4
Joined
·
1,100 Posts
If this vulnerability is such an issue then perhaps just a simple charger that provides a charge when you plug it in. Most EV's have a schedule so you can take advantage of off peaks rates. Do I really need to know what the rate of charge is, has it started, has it finished etc through an app, for me NO
 

·
Registered
Joined
·
12,683 Posts
If this vulnerability is such an issue then perhaps just a simple charger that provides a charge when you plug it in. Most EV's have a schedule so you can take advantage of off peaks rates. Do I really need to know what the rate of charge is, has it started, has it finished etc through an app, for me NO

A long time ago I decided I was going to keep our charge points as simple as possible, with no connectivity and no smart features. My one concession to added features has been to fit time switches in both, and a switch so they can be easily switched from charge immediately mode to off-peak only mode. My reason for adding time switches to the charge points was that two of the EVs I've owned (BMW i3 and Tesla Model 3) had hopeless charge timing, neither could be set to have a defined start time and a defined stop time.

In practice both our charge points are left switched to off-peak pretty much all the time. I can't remember the last time we switched either to charge immediately, and I only included that as an option as I thought it might be useful if we needed an "emergency charge" at peak rates.
 

·
Premium Member
Joined
·
7,512 Posts
BBC's Click program has just featured 'Wallbox' (which contains a 2015 RPi!) and Project EV's security issues.
The Wallbox can be hacked and your charge stopped, but the Project EV is even riskier because hackers can change the firmware and even 'brick' it. The security flaws also exposes your home (or business) network to hackers.
 

·
Registered
Joined
·
12,683 Posts
The security flaws also exposes your home (or business) network to hackers.
That's the thing that concerned me, that this might be a possibility. Given that home networks may have a higher trust level than the wider internet, it seems possible that gaining access to them could create some significant security risks to any connected device.
 

·
Registered
2014, Vauxhall Ampera
Joined
·
80 Posts
BBC's Click program has just featured 'Wallbox' (which contains a 2015 RPi!) and Project EV's security issues.
The Wallbox can be hacked and your charge stopped, but the Project EV is even riskier because hackers can change the firmware and even 'brick' it. The security flaws also expose your home (or business) network to hackers.
I do wish people would be sensible about this, what benefit will the bad guys get by screwing up your charging? Yes, it may be inconvenient to the device owner, but do the benefits make it worth it?
There is a risk to the rest of your network but that is easily mitigated by sensibly configuring it.
 

·
Registered
Joined
·
302 Posts
I do wish people would be sensible about this, what benefit will the bad guys get by screwing up your charging? Yes, it may be inconvenient to the device owner, but do the benefits make it worth it?
There is a risk to the rest of your network but that is easily mitigated by sensibly configuring it.
That's true but how many users do that? I mean there was another story a few months ago about how people should change the default password settings on their router. Apparently most ppl just keep the original settings on the box :unsure:
 

·
Registered
Joined
·
12,683 Posts
That's true but how many users do that? I mean there was another story a few months ago about how people should change the default password settings on their router. Apparently most ppl just keep the original settings on the box :unsure:

A quick look at local WiFi SSIDs around here suggests that no one has changed any of their settings. I can see about 5 or 6 other networks using vistumbler, and all seem to be using default SSIDs, and that suggests they may well also be using default passwords, as if someone's gone into the settings to change the password, the chances are they may well change the SSID as well (both our WiFi networks include "GCHQ" in the SSID, just for a laugh).

Some default passwords may be strong, but my guess is that some may well not be. Either way, it supports the view that some really don't do anything to make their home network secure. There's an HP wireless printer that sometimes pops up as a weak signal on vistumbler that doesn't even have any security at all - it's running as an open device, accessible to anyone. I've been tempted to find where it is, point a cantenna at it to get a good enough signal, then send a warning note to the owner, but the chances are just doing that may be unlawful.
 

·
Premium Member
Joined
·
7,512 Posts
I do wish people would be sensible about this, what benefit will the bad guys get by screwing up your charging? Yes, it may be inconvenient to the device owner, but do the benefits make it worth it?
There is a risk to the rest of your network but that is easily mitigated by sensibly configuring it.
Its serious enough for new legislation regarding EV charger security being introduced in the autumn.

Maybe it's the case that few EV owners have had their Project EV box bricked or their off peak Wallbox charge stopped but it's no fun & potentially costly if you were one of the unlucky ones.

It's of no consequence to me as my charger is dumb and I have no need of a smart charger.

If you think hackers only get up to their mischief for gain, you are mistaken. For many it is the challenge that gives them a buzz.
 
1 - 20 of 27 Posts
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top