Speak EV - Electric Car Forums banner
1 - 18 of 18 Posts

·
Registered
Nissan LEAF30
Joined
·
7,197 Posts
As usual the headline is misleading, although there's an element of truth. PenTest partners are both excellent at finding weaknesses in IT systems and in self-publicity. :devilish: As the owner of a Project EV (Growatt) charger I'm unsurprised with the issues listed as the App and the firmware in the unit are thrown together with poor/non-existent security.
 

·
Registered
Renault Zoe 50
Joined
·
22,596 Posts
In other news, garden taps have zero security and are wide open to a DDOS attack.

Russian agents could pop over and turn them all on, causing mayhem and denying use of our water network.

Press release to follow.
 

·
Registered
Joined
·
1,992 Posts
This is part of a much wider problem with the EVSE industry.

Some do things properly (including wider compliance with standards, not just cyber) and others just release trash products. Gives those of us doing things properly an unfair disadvantage.

I'm hoping regulators and consumers pick up on this and back brands doing things properly.

Sent from my SM-N976B using Tapatalk
 

·
Registered
Joined
·
4,494 Posts
I wholeheartedly agree with Mike's comments above. My limited experience, involving looking in depth at a handful of different makes of charge points, supports the view that some are indeed pretty poor, with some fairly obvious non-compliances with their hardware. Getting the hardware robust and compliant is probably slightly easier than getting the software robust. If a manufacturer cannot comply with some pretty basic stuff, then I wouldn't have much confidence that they will have robust software/firmware. I'm not convinced that one of two "manufacturers" of charge points being sold in the UK have anything much to do with the design, manufacture and compliance testing of the products they sell, either.

I'm tempted to try and get one or two to let me see their paperwork showing compliance with the LV Directive and the EMC Directive, for example. For those that include RCD protection, I'd like to see evidence of compliance with IEC61009-1/ IEC63423. Tracing back to how they obtained their apparent certification, and whether it is actually valid, might be a bit time consuming, but it would also address some of the niggles I have that suggest non-compliant, and hence potentially unsafe, products are being openly sold and installed here.
 

·
Registered
Joined
·
1,992 Posts
I wholeheartedly agree with Mike's comments above. My limited experience, involving looking in depth at a handful of different makes of charge points, supports the view that some are indeed pretty poor, with some fairly obvious non-compliances with their hardware. Getting the hardware robust and compliant is probably slightly easier than getting the software robust. If a manufacturer cannot comply with some pretty basic stuff, then I wouldn't have much confidence that they will have robust software/firmware. I'm not convinced that one of two "manufacturers" of charge points being sold in the UK have anything much to do with the design, manufacture and compliance testing of the products they sell, either.

I'm tempted to try and get one or two to let me see their paperwork showing compliance with the LV Directive and the EMC Directive, for example. For those that include RCD protection, I'd like to see evidence of compliance with IEC61009-1/ IEC63423. Tracing back to how they obtained their apparent certification, and whether it is actually valid, might be a bit time consuming, but it would also address some of the niggles I have that suggest non-compliant, and hence potentially unsafe, products are being openly sold and installed here.
Jeremy, happy to show you through how we do things if you'd like!?

Sent from my SM-N976B using Tapatalk
 

·
Registered
2014, Vauxhall Ampera
Joined
·
35 Posts
FUD

This is from the BBC Click people, whose only purpose in life is to rehash the latest publicity release from anyone remotely tech-related.

BBC Click should be ignored and left to wallow in the obscurity it so richly deserves
 

·
Registered
Joined
·
4,494 Posts
Is one of the concerns that someone could obtain access to a normally fairly secure home LAN , via the smart charger's lack of security?

If so, then that would seem to be potentially more serious than the trivial stuff, like being able to control the charge point, or take over the owner's credentials to log into their charge point server. I don't pretend to know much about this stuff, but it seems that gaining access to other devices on the LAN could present a potential security risk, given that there seems to be a higher level of trust between devices on a LAN than there would be for devices on the WAN.
 

·
Registered
Joined
·
4,494 Posts
Jeremy, happy to show you through how we do things if you'd like!?

Sent from my SM-N976B using Tapatalk
Thanks for the offer, Mike, but your company is one of a small handful of UK companies that I would 100% trust (FWIW the others are Viridian and MyEnergi) when it comes to having valid certificates of conformity for their products. There are certainly others that are probably every bit as trustworthy, but not having looked in detail at how they have done things I'd not be confident to say for sure.
 

·
Registered
Nissan LEAF30
Joined
·
7,197 Posts
I wholeheartedly agree with Mike's comments above. My limited experience, involving looking in depth at a handful of different makes of charge points, supports the view that some are indeed pretty poor, with some fairly obvious non-compliances with their hardware. Getting the hardware robust and compliant is probably slightly easier than getting the software robust. If a manufacturer cannot comply with some pretty basic stuff, then I wouldn't have much confidence that they will have robust software/firmware. I'm not convinced that one of two "manufacturers" of charge points being sold in the UK have anything much to do with the design, manufacture and compliance testing of the products they sell, either.

I'm tempted to try and get one or two to let me see their paperwork showing compliance with the LV Directive and the EMC Directive, for example. For those that include RCD protection, I'd like to see evidence of compliance with IEC61009-1/ IEC63423. Tracing back to how they obtained their apparent certification, and whether it is actually valid, might be a bit time consuming, but it would also address some of the niggles I have that suggest non-compliant, and hence potentially unsafe, products are being openly sold and installed here.
This is my gripe with the Civil Service and Local Government - the politicians (who we know to be largely incompetent and often corrupt) set the policy and the Government officers fail to deliver it accurately. In this case we have OZEV (neé OLEV) having a list of approved charge points which small business installers not unreasonably offer to innocent and naïve members of the public. Like cladding for buildings it appears that the Government officers failed to check that the standards were sufficient and rigorously applied. So yet again the public get shafted and the relationship between the customer and the small independent installer gets soured. I think that large suppliers who are tied to a supplier or can afford their own expert advice (with associated brown envelopes) are different.
With charge points I look at units having poorly specified and made components, others with non-functional software and firmware, let alone issues with internet security. Unlike the purchase of property where the buyer has to employ professional advisors to independently check the compliance of the item, I don't think that it's unreasonable for the purchaser of a charge point to assume that one approved by the Government is going to be safe and reliable.
Clearly I'm wrong and it's just homeowners professional advisors that deserve indemnifying from the costs of rectification where the public in general are expected to pick up the bill. Also I feel for the legitimate suppliers who both lose business to the cowboys and suffer the lack of trust that the industry acquires.
 

·
Registered
VW ID.3 Life Pro Performance, MY22 (software v2.3)
Joined
·
149 Posts
Is one of the concerns that someone could obtain access to a normally fairly secure home LAN , via the smart charger's lack of security?

If so, then that would seem to be potentially more serious than the trivial stuff, like being able to control the charge point, or take over the owner's credentials to log into their charge point server. I don't pretend to know much about this stuff, but it seems that gaining access to other devices on the LAN could present a potential security risk, given that there seems to be a higher level of trust between devices on a LAN than there would be for devices on the WAN.
Yes, that would be my bigger concern: that it’s not an end in itself but a means to gain leverage on something else.

EDIT: that said, there are plenty of undesirable things someone could do if they had root access to a Linux system - tightening up the firewalling around it (or any device you can’t be certain is fully patched) - both inbound and outbound - is generally a Good Thing…
 

·
Registered
Joined
·
4,494 Posts
This is my gripe with the Civil Service and Local Government - the politicians (who we know to be largely incompetent and often corrupt) set the policy and the Government officers fail to deliver it accurately. In this case we have OZEV (neé OLEV) having a list of approved charge points which small business installers not unreasonably offer to innocent and naïve members of the public. Like cladding for buildings it appears that the Government officers failed to check that the standards were sufficient and rigorously applied. So yet again the public get shafted and the relationship between the customer and the small independent installer gets soured. I think that large suppliers who are tied to a supplier or can afford their own expert advice (with associated brown envelopes) are different.
With charge points I look at units having poorly specified and made components, others with non-functional software and firmware, let alone issues with internet security. Unlike the purchase of property where the buyer has to employ professional advisors to independently check the compliance of the item, I don't think that it's unreasonable for the purchaser of a charge point to assume that one approved by the Government is going to be safe and reliable.
Clearly I'm wrong and it's just homeowners professional advisors that deserve indemnifying from the costs of rectification where the public in general are expected to pick up the bill. Also I feel for the legitimate suppliers who both lose business to the cowboys and suffer the lack of trust that the industry acquires.

Never let facts get in the way of a really good rant . . .

Can I suggest looking at where all the standards come from, and how the UK only had 1/28th say in any of them? The UK could not refuse to allow the sale of any item that carries a CE mark, even if there may be a very strong suspicion that it's fake. I was head of type approval for all UK maritime radio, radar, nav aids and electronic equipment used on all UK registered ships for a time, on behalf of the maritime and coastguard agency (used to be a DoT role).

During the two years doing that job in the late 1990's I saw much of the compliance testing going to the lowest bidder, often with the suspicion that companies from certain countries were literally buying approval, without the required testing. None of those countries were within the EU, but they were taking advantage of the non-existent checking within the compliance process.

I should stress this was not primarily an EU issue, it was simply that the (fairly sensible) decision was made by all member states to ensure that the process of approval could not be member state controlled, but had to be run by commercial entities. It was unlawful for any member state to refuse to allow any product that carries the required marking to sold within their border. It was also unlawful for any member state to refuse to accept compliance certification produced by any commercial entity that had been accepted as being competent.

In my case, I spent two years embroiled in the politics of the LV and EMC Directives. Never again do I want to go through that ordeal. I sincerely hope that the new national processes that are being adopted as a part of UKCA will be somewhat tighter, and include provision for the UK government to question, or independently test and validate, any imported product that seems dubious, instead of being forced to accept that correctly marked goods "must" be OK.
 

·
Registered
Nissan LEAF30
Joined
·
7,197 Posts
So as long as some faceless third party paid for by the manufacturer signs it off then all's well. :unsure:Why do we bother approving some and providing an implicit guarantee? Much like emissions testing which no large manufacturer, particularly tutonic rule abiding ones, would ever break.
 

·
Registered
Joined
·
1,992 Posts
FWIW the OLEV approval process for an EVSE involves us sending over their form (literally a tickbox for cyber) and the CE declaration of conformity for the product (one or two sides of a4 listing the standards we are compliant with).

None of the actual test evidence is shared nor is there any third party validation of our compliance.

We have been lobbying quite hard to change this but as @Jeremy Harris says, if it has a CE mark they can't block it being sold. Hopefully better enforcement of conformance to perfectly reasonable and appropriate product standards will be a long lasting benefit from Brexit.

Sent from my SM-N976B using Tapatalk
 

·
Registered
Joined
·
1,992 Posts
So as long as some faceless third party paid for by the manufacturer signs it off then all's well. :unsure:Why do we bother approving some and providing an implicit guarantee? Much like emissions testing which no large manufacturer, particularly tutonic rule abiding ones, would ever break.
Not even that - CE is self certify. It is normal for companies to sign off their own products but typically third parties to provide evidence of individual tests which the company then compiles within the product technical construction file. Some will run some/all of this testing in house, others outsource entirely.

e.g. we send our units off to a
third party to be sprayed with a hose for the IP testing requirement but do our own di-electric testing as we have the kit and expertise to do it..

Sent from my SM-N976B using Tapatalk
 

·
Registered
Joined
·
4,494 Posts
To put this into the context of the way it used to be, one of the facilities I ran (DERA Fraser) had been the centre of excellence for testing all UK maritime electronic equipment since 1947. It was set up by the MoD to ensure that electronic systems on warships were all safe, performed to the required standards and did not interfere with each other. As electronic equipment was adopted by the merchant marine, the Board of Trade asked the MoD to approve all equipment used on UK registered merchant ships. This included everything from radar, radio and nav equipment, to EPIRBS and load and stability measuring equipment.

By around 1999 it was becoming impossible to retain this work within the UK. We were being forced to accept that any appropriately marked bit of kit was safe, worked as designed and didn't interfere with anything else. The final straw for me was when we were asked to give expert witness evidence at a Fatal Accident Enquiry (in Scotland). This concerned an EPIRB (electronic position indicating radio beacon) that had been recovered from a beam trawler, that sunk with the loss of all souls onboard. The equipment had been made in the far east, and approved there, and given a CE mark. We tested it, and it failed to meet the required specification.

One contributory factor in the deaths of all onboard was that the EPIRB signal wasn't detected by the MRCC (maritime rescue coordination centre) until around one and half hours after the ship sank, so the Nimrod was not despatched until well over two hours after it sank. A frequency error in the EPIRB transmitter meant that it failed to reliably connect to SARSAT. There was a chance that, had the beacon been manufactured to the correct specification, then rescue assets may have been able to reach the site soon enough to save the lives of some of those onboard.

My personal view (which is heavily coloured by the above experience) is that we need to radically overhaul safety and performance certification. Years ago, we established the British Standards Institute, to create safe standards and to test equipment and appliances to ensure they were safe and performed correctly. Approval was indicated by the "kite mark", a symbol that was not only trusted here in the UK, but in many other countries too. We agreed to dilute the standing of that mark, and accept self-certification just as has happened in the building industry. I'm not sure quite what we need to do to get the message across that this is just not ever going to work. Not even Grenfell seems to have convinced the government that allowing poachers to be gamekeepers is a really stupid idea.
 

·
Registered
Nissan LEAF30
Joined
·
7,197 Posts
Another layer to the problem comes when manufacturers produce two versions of a product, one to pass the test and another for sale. We appear to need some form of random testing with serious sanctions for offenders, but that's accepted as fair by other countries.
 

·
Registered
Joined
·
16 Posts
Is one of the concerns that someone could obtain access to a normally fairly secure home LAN , via the smart charger's lack of security?

If so, then that would seem to be potentially more serious than the trivial stuff, like being able to control the charge point, or take over the owner's credentials to log into their charge point server. I don't pretend to know much about this stuff, but it seems that gaining access to other devices on the LAN could present a potential security risk, given that there seems to be a higher level of trust between devices on a LAN than there would be for devices on the WAN.
Correct, that's the problem. The original report is pretty well written and damning of the lack of security on these products, you'll need a bit of an IT background to interpret everything within it:


Does anyoe have a collated list of what 'powers' the different home chargers? Cusom/Raspberry Pi/Pi Zero/Beagebone/etc?

I'm going to be getting (my second) home charger in a few months and I actively want to avoid anything using off the shelf Raspberry Pi hardware as it makes it far too easy to attack. For those that are using off the shelf SoCs boards, I would be very interested in hearing how the firmware and the contents of the local filesystem is protected. Is it encrypted? Is anything in place to prevent the private key for the encryption getting read? Are firmware updates required to be signed?
 
1 - 18 of 18 Posts
Top