San Antonio, Texas – Engineers at the Southwest Research Institute (SwRI) have discovered cybersecurity susceptibility with electric vehicles and fast-charging systems. High-voltage EV technology relies on power line communication (PLC) technology to transmit smart-grid data between vehicles and charging equipment.
The engineers, through penetration testing, found that the PLC layer “was so poorly secured and lacked encryption between the vehicle and the chargers,” said Katherine Kozan, an engineer who led the investigative project. The team was able to gain access to network keys and digital addresses for both chargers and vehicles, potentially allowing unauthorized parties to access the EV chargers and EV systems.
The research is part of SwRI’s ongoing efforts to help the mobility sector and government improve automotive cybersecurity spanning embedded automotive computers and smart-grid infrastructure. It builds on a 2020 project where SwRI hacked a J1772 charger, disrupting the charging process with a lab-built spoofing device.
In the latest project, SwRI explored vehicle-to-grid (V2G) charging technologies governed by ISO 15118 specifications for communications between EVs and electric vehicle supply equipment (EVSE) to support electric power transfer.
“As the grid evolves to take on more EVs, we need to defend our critical grid infrastructure against cyberattacks while also securing payments to charge EVs,” said Vic Murray, assistant director of SwRI’s High-Reliability Systems Department. “Our research found room for improvements.”
The SwRI team has also developed an adversary-in-the-middle or AitM device software–a type of cybersecurity threat where an attacker intercepts and potentially alters communications between two parties without their knowledge–which allowed SwRI testers to eavesdrop on traffic between EVs and electric vehicle supply equipment. The team was able to identify the network membership key that allows devices to join networks and monitor traffic.
“Adding encryption to the network membership key would be an important first step in securing the vehicle-to-grid charging process,” said FJ Olugbodi, a SwRI engineer who contributed to the project. “With network access granted by insecure direct access keys, the nonvolatile memory regions on PLC-enabled devices could be easily retrieved and reprogrammed. This opens the door to destructive attacks such as firmware corruption.”
The SwRI added in its press release that encrypting embedded vehicle systems can pose challenges that could even become safety hazards. A failure to authenticate or decrypt could interrupt a vehicle’s functionality or performance.
“Automotive cybersecurity poses many layers of complexity, but we are excited about these new techniques to identify and address vulnerabilities,” said Cameron Mott, a SwRI manager leading the SwRI automotive cybersecurity research team.
