HotWire: Real-World Impersonation and Discharge Attacks on Electric Vehicle Charging...
summary
Shows a concrete end-to-end exploit: a $180 hardware toolkit (Raspberry Pi + modified HomePlug modem) captures and replays a six-byte EVCCID to replay EVCCID for free charging on seven commercial networks, repeatedly obtaining full sessions worth about $35–45; it also injects protocol-compliant voltage claims to inject fake voltage to force discharge, draining up to ~1.25 kWh in 30 minutes and ~2.1% of a vehicle’s battery in longer runs. Four production vehicles are tested (three vulnerable, Tesla resists), and open-source testbed and mitigations are released.
AI-written summary · about
chapters (11)
- 0:00EV charging security intro
- 1:13DIN 70121 & ISO 15118 overview
- 3:40DIN 70121 vulnerabilities
- 6:09Auto charge security flaws
- 7:52Attack surface analysis
- 8:34Hardware-in-the-loop setup
- 9:37Attacks on production vehicles
- 10:20Unauthorized auto charge demo
- 12:08Battery discharge attack
- 14:35Security countermeasures
- 15:58Vulnerability disclosure
related talks
31mProtecting the Attack Surface and Data Silos of an EV Charging Network
11mShort: Breaking the Charge: Exploiting State Manipulation in EV Charging
16mCAUTION: HIGH VOLTAGE, LOW SECURITY – A Familiar Tale of...
13mDrainDead: Emptying Batteries of Parked Electric Vehicles
14mCharge It to My Neighbor: A Relay Attack on ISO 15118 Plug and Charge Payment
29mX-in-the-Middle: Attacking Fast Charging Piles and Electric Vehicles
10mShort: PIBuster: Exploiting a Common Misconfiguration in CCS EV Chargers
37mAutomatic Automotive Hacking