Is My Battery Charging? State Switching Attack on EV Charging

Electric Vehicle (EV) has become one of the promising solutions to the ever-evolving environmental and energy crisis. The key to the wide adoption of EV is a pervasive charging infrastructure, composed of both the private/home chargers and the public/commercial charging stations. The security of EV charging, however, has not been thoroughly investigated. In this paper, we propose a new class of attacks, ChargeX, which aims to manipulate the charging states or charging rates of EV chargers with the goal of disrupting the charging schedules, causing denial of service (DoS), or degrading the battery performance. ChargeX comprises two types of attacks: (i) Intentional Electromagnetic Interference (IEMI)-based attack leverages the effects of inductive coupling to influence the current readings along the power line, and (ii) cable tampering attack inserts a hardware attack circuit to strategically modify the charging control signals. We design and implement multiple attack systems, and evaluate the attacks on a public charging station and two home chargers using a simulated vehicle load in the lab environment. We further validate the attacks on a Tesla vehicle to showcase the disruptive impacts of ChargeX. If deployed, ChargeX may significantly demolish people's trust in the EV charging infrastructure.

device

ChargeX Attack Demonstration

Automation Attacks

Attack the Public Charger (B to C)

Attack the Public Charger (C to F) in the Lab

Parallel Attachment Attacks

Attack the Home Charger (B to C)

Attack the Home Charger (B to F)

Attack the Home Charger (C to F)

Serial Insertion Attacks

Attack the Home Charger (C to F)

Attack Public Charger (C to F)

IEMI-based Attacks in the Lab

Duty Cycle Attacks

Attack the Duty Cycle of the Home Charger

Result Comparison

The charging rate is determined by the duty cycle of the PWM signal. We design two different attack circuits to change the charging rate: a TLC555-based attack and a fake load-based attack. The attack results are illustrated below, along with a comparison to the benign duty cycle in state C.