EV Charging Infrastructure Discovery to Contextualize Its Deployment Security

• 全文链接
• 请求原文

作   者：

Khaled Sarieddine;  Mohammad Ali Sayed;  Ribal Atallah;  Sadegh Torabi;  Joseph Khoury;  Morteza Safaei Pour;  Elias Bou-Harb;  Chadi Assi; 

作者机构：

R&D Department;  San Diego State University;  VA;  USA;  Hydro-Quebec Research Institute;  System Resilience;  Concordia University;  San Diego;  TX;  Fairfax;  Canada;  Center for Secure Information Systems;  Security Research Centre;  Department of Management Information Systems;  Montreal;  San Antonio;  Cyber Center for Security and Analytics;  George Mason University;  Concordia Institute for Information Systems Engineering;  CA;  The University of Texas at San Antonio; 

关键词：

Protocols;  Ecosystems;  Charging stations;  Malware;  Power grids;  Security;  Microprogramming; 

期刊名称：

IEEE transactions on network and service management

i s s n：

1932-4537

年卷期：

2024 年 21 卷 1 期

页   码：

1287-1301

页   码：

摘   要：

Electric Vehicle Charging Stations (EVCSs) have been shown to be susceptible to remote exploitation due to manufacturer-induced vulnerabilities, demonstrated by recent attacks on this ecosystem. What is more alarming is that compromising these high-wattage IoT systems can be leveraged to perform coordinated oscillatory load attacks against the power grid which could lead to the instability of this critical infrastructure. In this paper, we investigate a previously sidelined aspect of EVCS security. We analyze the deployment security of EVCSs and highlight operator-induced vulnerabilities rendering the ecosystem exposed to remote intrusions. We create an advanced discovery technique that leverages Web interface artifacts to dynamically discover new charging station vendors. As a result, we uncover 33,320 charging station management systems in the wild. Consequently, we study the deployment security of the charging stations and identify that 28,046 EVCSs were found to be vulnerable to eavesdropping, and around 24% of the studied EVCSs are deployed with default configurations exposing the ecosystem to a Mirai-like attack vector. Aligned with this finding, we discover that the EVCS ecosystem has been targeted by nefarious IoT malware such as Mirai and its variants. This demonstrates that further security measures should be implemented by vendors and operators to ensure the security of this vital ecosystem. Consequently, we provide a comprehensive recommendation for securing the deployment of EVCSs.