"The EV charging industry has well-established security standards. OCPP (Open Charge Point Protocol) provides clear guidelines for securing the communication channel between EV Chargers and the Charging Station Management System (CSMS): use VPNs or Private APNs, implement OCPP Security Profile 2 or higher, enforce TLS mutual authentication etc. When properly configured, these measures make it significantly harder for threat actors to compromise the management channel.
But what about the other side of the charger?
While the industry has focused on securing the backend communication, the attack surface exposed through the CCS2 charging plug remains largely untested.
Every time an EV connects to a charger, it establishes an IP network over Power Line Communication (PLC). This network was designed for V2G protocols. But we also discovered other EV charger operating system services listening on these network interfaces.
From a traditional IT security perspective, think of this attack vector as analogous to an attacker having a port in the corporate LAN. The scenario is identical, except the port isn't an RJ45 jack in the office, it's a CCS2 connector in a parking lot.
This has profound implications: compromised EV chargers can serve as a foothold into CPO (Charge Point Operator) private networks. Since chargers often connect to backend systems via VPN or Private APN infrastructure, an attacker with access to a charger could potentially pivot to back-office systems, billing platforms, or other critical infrastructure."
https://www.saiflow.com/blog/the-hidden-ccs2-attack-surface-on-ev-chargers
#CyberSecurity #OCPP #EVs #CCS2
