Post #3979433

@syphist@zoner.work @vogelchr@chaos.social @faheus@chaos.social I don't work in automotive but I can tell you how it happened because its the same pattern in any OT industry.(Anyone in the automotive industry feel free to correct where I am wrong) A standards org designed the protocol, and chose TCP/IP over power line on purpose because it is free of licensing concerns, ubiquitous and real world tested. In the standard somewhere is probably some small note about limiting the services on this interface to only what the standard defines and not adding things like SSH (or they might mention that anything outside the standard is out of scope) An overworked engineer at a supplier of a supplier (so 2-3 subcontractor agreements away from any company you've ever heard of before) is tasked with making sure their board can talk this protocol properly. Their payment is tied to milestones on compatibility and reliability. So the engineer opens up an sshd over all interfaces to make debugging and dev easier for dev. They got a deadline to reach! They may or may not have something in the fine print telling the company that will integrate this to disable SSH or change a password or something. The integrator will not read that. When the integrator does their threat model or pen test they will pick the cheapest supplier and tightly control the scope of hardware and software under test. (Security is a cost center. Just need to show they did due diligence. ) They'll fix whatever small things the own handcuffed testers were able to find and call it good. Then it gets rolled out across the country slowly. Customers complain when things break or are not compatible, so new updates gets pushed out. Maybe a service tech even finds the SSH service and it saves them some time and money debugging in the field. "Wow that was convenient" they think. That's how this goes for years. Once enough are rolled out some curious hacker gets a little TOO curious and takes a serious look at the things in the field. They find the obvious integration holes, and submit a con talk out of it (after hopefully doing CVD where the manufacture will either do the smart thing and say 'mea culpa' then fix it before the talk .... Or do the dumb thing and try to sweep it under the rug) EV charging is already at the end of that process. Look at any new industrial technology and you'll see this play out. For example a simple google found me a new comms standard being made for Hydrogen cars last year. Its in that first part of the process. Give it a decade or two and $100 says there's similar gaps in the security of deployed pumps. https://www.sae.org/standards/j2799_202406-hydrogen-surface-vehicle-station-communications-hardware-software