Home car chargers at risk from hackers

Even local electricity blackouts could be on the cards for determined hackers, it seems. A far cry from rolling up at the local filling station for a few minutes.
– – –
Security researchers have discovered failings in two home electric car chargers, reports BBC Click.

The researchers were able to make the chargers switch on or off, remove the owner’s access, and show how a hacker could get into a user’s home network.

Most of the faults have now been fixed but owners are being told to update their apps and chargers, to be safe.

It comes as proposed new legislation on cyber-security for appliances – including chargers – is published.

Two home chargers, Wallbox and Project EV – both approved for sale in the UK by the Department for Transport – were found to be lacking adequate security when used with an accompanying app for smartphones.

Cyber-security researcher at Pen Test Partners, Vangelis Stykas, discovered the vulnerabilities.

“On Wallbox you could take full control of the charger, you could gain full access and remove the usual owner’s access on the charger. You could stop them from charging their own vehicles, and provide free charging to an attacker’s vehicle.

“Project EV had a really bad implementation on their back end. Their authentication where it existed was pretty primitive, so an attacker could easily escalate themselves to being an administrator and change the firmware of all the chargers.”

Mr Stykas says changing the firmware – the programming that is built in to the hardware – would allow an attacker to permanently disable the charger, or use it to attack other chargers or servers.
. . .
Home Network Access

Researchers also found it would be possible in cases where the chargers were connected by wi-fi to the home network, for hackers to also gain access.

Pen Test Partner’s Ken Munro says: “Once you’re on to someone’s home network, if you haven’t changed that router admin password, you can send all the traffic to the hacker.

“That means they can do things like set up sites that look like the real deal but steal your passwords and then your real bank account for example has been compromised. There’s all sorts of things you can do .. so everything you do online is potentially exposed.”

In its report into the security failures, Pen Test Partners adds that multiple chargers could be controlled at the same time using some of the vulnerabilities it found, which could potentially be used by an attacker to overload the electricity grid in some areas and cause blackouts.

Full report here.