Researchers have warned that many electric vehicle charging management systems are vulnerable to attack, which could allow hackers to cause disruption, steal energy, or access driver information. The security flaws were discovered by SaiFlow, an Israel-based company that specializes in protecting EV charging infrastructure and distributed energy resources. The vulnerabilities are related to the Open Charge Port Protocol, which is used for communication between the charging system management service and the EV charge point. The protocol is unable to handle multiple connections at once, which can be exploited by attackers. Additionally, SaiFlow has identified a Weak OCPP authentication and chargers identities policy, which can be used to charge vehicles without paying. The CSMS platforms are publicly accessible, meaning attackers can hijack the connection remotely without needing credentials or access. According to SaiFlow, an inexperienced hacker with limited resources could carry out an attack. To do so, they must first obtain a charger's identity, which typically has a standard structure, and then find out which CSMS platform the charger is connected to. SaiFlow has published a blog post with more information on the vulnerabilities and attack scenarios, as well as recommendations for how to mitigate them. The company has also offered its solutions team to help vendors patch the vulnerabilities as quickly as possible.
This Cyber News was published on www.securityweek.com. Publication date: Thu, 02 Feb 2023 12:17:02 +0000