X-in-the-Middle: Attacking Fast Charging Piles and Electric Vehicles
summary
A custom MITM device called X charger sits between DC piles and vehicles, relays and fuzzes CAN/GB/T frames, and captures protocol fields that include VINs; tests hit a rented Tesla Model 3 and five other cars and public stations, revealing a VIN-based plug-and-charge flaw that allows free charging after reading a windshield VIN. Device design protects against high voltage hazards (715 V / 120 A), Teslas use a private format so full decoding needs BMS/supercharger firmware, and findings are reported to vendors.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:16Charging tech overview
- 3:20Market growth and risks
- 5:57Attack surface analysis
- 8:06X-charger tool design
- 10:27Testing challenges
- 13:04Implementation details
- 15:20Tesla testing results
- 17:17Plug and charge risks
- 19:11GBT standard analysis
- 22:53Vulnerabilities exploited
- 25:38Fix and mitigation
- 26:45Future standards and Q&A
related talks
11mShort: Breaking the Charge: Exploiting State Manipulation in EV Charging
17mHotWire: Real-World Impersonation and Discharge Attacks on Electric Vehicle Charging...
43mElectric vehicle CAN man-in-the-middling
31mProtecting the Attack Surface and Data Silos of an EV Charging Network
13mDrainDead: Emptying Batteries of Parked Electric Vehicles
16mCAUTION: HIGH VOLTAGE, LOW SECURITY – A Familiar Tale of...
14mCharge It to My Neighbor: A Relay Attack on ISO 15118 Plug and Charge Payment
19mSecurity Analysis of LTE Connectivity in Connected Cars: A Case Study of Tesla