Short: PIBuster: Exploiting a Common Misconfiguration in CCS EV Chargers
summary
Proof-of-concept shows Qualcomm HomePlug GreenPHY (QCA7000) modems accept remote PIB writes when a single configuration bit is unset; researchers build a lab testbed and an EV emulator to binary-search a 10KB PIB and pinpoint the security flag at offset 0x1F8C that gates read/write. They collect PIBs from real chargers, find 41 of 69 chargers allow downloads and many are writable, and demonstrate a persistent denial of service that requires hardware replacement.
AI-written summary · about
chapters (12)
- 0:00PIBuster and EV charging
- 0:32AC vs DC charging basics
- 1:53Power line communication focus
- 2:34Outdated firmware risks
- 3:18Qualcomm QCA7000 chips research
- 4:41PIBuster attack via MAC spoofing
- 5:46PIB manipulation impact
- 6:28PIB differences investigation
- 7:52Real-world charger testing
- 8:34Host-booted systems vulnerability
- 9:17Responsible disclosure and fixes
- 9:38Call to action
related talks
17mHotWire: Real-World Impersonation and Discharge Attacks on Electric Vehicle Charging...
16mCAUTION: HIGH VOLTAGE, LOW SECURITY – A Familiar Tale of...
31mProtecting the Attack Surface and Data Silos of an EV Charging Network
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
44mExposing Critical Threats In Millions Of Connected Devices
29mX-in-the-Middle: Attacking Fast Charging Piles and Electric Vehicles
14mCharge It to My Neighbor: A Relay Attack on ISO 15118 Plug and Charge Payment
45mExploiting Qualcomm WLAN and Modem Over The Air