Researchers from SaiFlow have discovered two security vulnerabilities in certain electric vehicle charging systems that could be used to remotely shut down charging stations and even steal data and energy. The issues were found in version 1.6J of the Open Charge Point Protocol (OCPP) standard, which uses WebSockets for communication between EV charging stations and the Charging Station Management System (CSMS) providers. The current version of OCPP is 2.0.1. The researchers found that the OCPP standard does not provide clear instructions for multiple active connections, which can be exploited by attackers to disrupt and hijack the connection between the charge point and the CSMS. This could lead to information theft, as the attacker could access the driver's personal data, credit card details, and CSMS credentials. The weak authentication policy of OCPP 2.0.1 can be remedied by requiring charging point credentials, which would close the loophole. To prevent multiple connections from a single charging point, the CSMS should validate the connections by sending a ping or a heartbeat request. If one of the connections is not responsive, the CSMS should eliminate it. If both connections are responsive, the operator should be able to eliminate the malicious connection directly or via a CSMS-integrated cybersecurity module.
This Cyber News was published on thehackernews.com. Publication date: Sat, 04 Feb 2023 05:06:03 +0000