Low Energy to High Energy: Hacking Nearby EV-Chargers Over Bluetooth

Low Energy to High Energy: Hacking Nearby EV-Chargers Over Bluetooth

Speakers: Khaled Nassar, Thijs Alkemade (Security Researchers, Computest Security)

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=8gNhfR1YZGA

Overview

In an increasingly electrified world, Electric Vehicle (EV) charging infrastructure is rapidly expanding, bringing with it a new frontier for cybersecurity research. This talk, "Low Energy to High Energy: Hacking Nearby EV-Chargers Over Bluetooth," presented by Khaled Nassar and Thijs Alkemade of Computest Security's Sector 7 research center, unveils critical vulnerabilities discovered in popular Level 2 home EV chargers. The researchers demonstrated a generic three-step process: achieve Bluetooth or Wi-Fi range, uncover vulnerabilities, and execute arbitrary code on the charger – a feat they accomplished on three different devices.

The significance of this research cannot be overstated. As EV chargers become ubiquitous, their security directly impacts consumer safety, grid stability, and the integrity of personal data. Vulnerabilities allowing arbitrary code execution could lead to unauthorized charging, denial of service, manipulation of charging schedules, or even serve as an entry point into home networks. This presentation highlights the urgent need for robust security practices in the design and deployment of connected infrastructure, particularly in the rapidly evolving EV ecosystem.

Background

▶ Watch: Introduction: Hacking EV chargers in 3 steps (0:00)

The genesis of this research stemmed from the inaugural Pwn2Own Automotive competition held in January of this year in Tokyo. The scope of this prestigious hacking contest included various categories, with Computest Security's team, comprising Khaled Nassar, Thijs Alkemade, and their colleague Dan Keper, focusing primarily on Level 2 EV chargers. These chargers, while faster and more powerful than Level 1 models, are predominantly targeted at the home market, requiring more significant power and setup.

Level 2 chargers typically feature a standard set of functionalities crucial for their operation and user interaction. They invariably possess some form of connectivity, usually Wi-Fi or Ethernet, to communicate with vendor cloud services for management and updates. Crucially for this research, many also leverage Bluetooth or Bluetooth Low Energy (BLE) for initial provisioning, enabling users to connect the charger to their home Wi-Fi access point. A companion mobile application is also common, offering features like charging scheduling, power monitoring, and usage statistics.

The team's initial challenge was reconnaissance due to the relatively nascent nature of this target category for vulnerability research. They had to assess the attack surface of various chargers to prioritize targets for Pwn2Own. One particularly interesting candidate was the Juice Box 40. While its brochure detailed BLE for provisioning and Wi-Fi for network-facing operations, the researchers found a wealth of publicly available information online. This included release notes from the vendor mentioning specific software versions and a real-time operating system (RTOS), as well as iFixit articles detailing hardware platforms across different models. A critical discovery came from Reddit posts where users discussed troubleshooting. One user notably described connecting to an unauthenticated Telnet command-line interface (CLI) over Wi-Fi on port 2000, which provided a long list of commands and even linked to documentation for the underlying operating system. This revelation hinted at a significant attack surface beyond the advertised features.

Another target, the Autel Maxi Charger, presented a more luxurious feature set, including Wi-Fi, Bluetooth, a 4G module with a SIM card, Ethernet, RFID for charging cards, an LCD touchscreen, and an RS485 port for inter-charger communication and load balancing. A notable feature was "home charger sharing," allowing owners to make their charger public for reimbursement. The Autel Maxi Charger was found to run a FreeRTOS-based operating system. For the Autel, acquiring the firmware proved to be the most challenging aspect of their research.

The team eventually traced the underlying technology for some of these devices to Zentri, an earlier company that developed a turnkey IoT solution encompassing hardware, software, and OTA device management. Zentri was later acquired by Silicon Labs and rebranded as Gecko. They learned that the Juice Box likely utilized a WGM 160p module (a Wi-Fi module with an ARM processor) running Gecko OS. Critically, Gecko OS was already at its end-of-life (EOL) at the time of their research. Fortunately, Zentri also offered a device management platform (DMS). By registering a test account and creating test products, the researchers were able to download firmware blobs, including the base operating system kernel and plugins for various Gecko OS versions, allowing them to begin static analysis even before receiving the physical devices.

Key Findings

▶ Watch: Understanding Level 2 EV charger features and attack surface (2:00)

The Computest Security team successfully identified and exploited critical vulnerabilities across three distinct Level 2 EV chargers, achieving arbitrary code execution in each instance. Their findings underscore a pervasive lack of robust security practices within the EV charging ecosystem, particularly concerning third-party components and maintenance interfaces.

For the Juice Box 40, their initial reconnaissance revealed a critical misconfiguration: an unauthenticated Telnet command-line interface (CLI) exposed over Wi-Fi on port 2000. This CLI, providing access to a wide array of system commands, effectively offered an open door to the device's internal workings without any authentication. This discovery, while not a complex exploit itself, represented a severe security oversight, providing an immediate and high-privilege access vector. Beyond this, their firmware analysis of the Juice Box 40, which runs Gecko OS, led to a more sophisticated vulnerability. They discovered a memory corruption vulnerability within the Gecko OS message logging facility. This system allowed users to modify message templates via a set variable command, available through the Telnet CLI. While messages were limited to 32 characters (including a null byte terminator, effectively 31 characters of data), formatting tags like @T (for timestamp replacement) could dynamically expand beyond this buffer, leading to a buffer overflow. This vulnerability formed the basis of their successful Pwn2Own Automotive entry.

The Autel Maxi Charger, despite its advanced feature set and FreeRTOS-based operating system, also succumbed to exploitation. Although the specific technical details of the Autel exploit were not as deeply elaborated as the Gecko OS vulnerability, the researchers confirmed they achieved arbitrary code execution, highlighting that even feature-rich devices are not immune to fundamental security flaws. The challenge here was primarily firmware acquisition, which they eventually overcame. The "home charger sharing" feature, in particular, was noted as having significant impact implications if compromised.

Finally, the Charge Point Home Flex charger presented a different class of vulnerability related to its remote management capabilities. The device utilized a reverse SSH tunnel to what the vendor internally referred to as the "mothership." This tunnel, established by a script early in the device's boot process, used a pre-configured SSH key to create a port forward to a remote server. While the SSH connection itself was restricted, preventing direct login shells, the researchers discovered that this tunnel was designed to forward the local Telnet login shell of the charger to a specific port on the remote server. By understanding and interacting with this forwarded Telnet interface, they were able to bypass the SSH restrictions and gain unauthorized access to the charger's command line. This demonstrated a critical weakness in how remote maintenance and diagnostics were implemented, effectively creating a backdoor.

Collectively, these findings reveal a landscape where fundamental security principles are often overlooked. Issues ranged from basic network misconfigurations (unauthenticated Telnet), to deep-seated memory safety bugs in third-party operating systems (Gecko OS buffer overflow), and insecure remote access mechanisms (reverse SSH tunnel exploitation). The researchers also noted a general observation that while network-facing attack surfaces often received attention, provisioning processes and bad state transitions were frequently neglected, alongside issues like developers misunderstanding SSL library parameters (e.g., cURLOPT_SSL_VERIFYHOST being incorrectly set to true instead of 2, effectively disabling certificate validation).

Technical Deep Dive

▶ Watch: Autel Maxi Charger introduction and extensive feature set (5:16)

The core of the Computest Security team's success lay in their meticulous analysis and exploitation of specific technical weaknesses across the target EV chargers. The most detailed technical finding was the buffer overflow vulnerability in Gecko OS, which was confirmed to run on the Juice Box 40.

The Juice Box 40, leveraging a WGM 160p Wi-Fi module with an ARM processor, ran the Gecko OS real-time operating system. The initial foothold was often through the discovery of an unauthenticated Telnet CLI on port 2000 over Wi-Fi. This CLI provided a direct interactive interface to the device, allowing command execution. Within this environment, a critical vulnerability resided in the message logging facility of Gecko OS. This facility allowed for custom message templates to be defined using the set variable command. Each message buffer was allocated to a fixed size of 32 bytes, which meant it could hold 31 characters plus a null byte terminator.

The vulnerability arose from the dynamic replacement of formatting tags within these templates. Specifically, the @T tag, intended to be replaced by a timestamp, could expand beyond the allocated 31 characters. When a timestamp of sufficient length was inserted into a template, it would overflow the fixed-size buffer. Given that this was an ARM-based RTOS, a successful buffer overflow could lead to overwriting adjacent memory regions, including the return address on the stack or critical data structures on the heap, depending on the exact memory layout. By carefully crafting the malicious template string, the researchers could inject arbitrary code (shellcode) into memory and redirect program execution to it. This allowed them to achieve arbitrary code execution on the Juice Box 40, gaining full control over the device. The fact that Gecko OS was already end-of-life exacerbated this issue, as official patches for such vulnerabilities were unlikely.

While the specific exploit chain for the Autel Maxi Charger was not detailed to the same extent, the researchers confirmed they found and exploited memory corruption vulnerabilities within its FreeRTOS-based operating system. Their primary challenge here was acquiring the firmware, which they eventually achieved by leveraging the Zentri DMS platform, suggesting potential shared components or similar vulnerabilities to the Gecko OS ecosystem. The Autel's diverse connectivity options (Wi-Fi, Bluetooth, 4G) and features like RFID and RS485 also indicate a broader attack surface for future research, even if the primary Pwn2Own entry focused on an internal memory corruption bug.

For the Charge Point Home Flex, the technical exploit leveraged an insecurely implemented remote access mechanism. The device established a reverse SSH tunnel from the charger back to a "mothership" server maintained by Charge Point. This tunnel was initiated by a script during startup, using a hardcoded SSH key for authentication. The SSH configuration was designed to restrict direct login shells, allowing only port forwarding. However, the researchers discovered that the purpose of this reverse tunnel was to forward the local Telnet login shell running on the charger itself to a specific port on the remote server. By understanding this design and the specific port forwarding configuration, they could connect to the forwarded Telnet session on the remote server, effectively gaining an unauthenticated shell on the Charge Point Home Flex. This bypass allowed them to circumvent the intended security restrictions of the SSH tunnel and gain interactive command-line access. The implication is that anyone with access to the "mothership" server (or who could intercept/redirect the SSH connection) could potentially gain full control of these deployed chargers.

These technical deep dives illustrate that the vulnerabilities were not merely theoretical but practical, allowing for direct and impactful compromise of the devices. The combination of insecure defaults, EOL software, and flawed remote management implementations provided multiple avenues for attackers to transition from "low energy" Bluetooth/Wi-Fi range to "high energy" control over EV chargers.

Demo / Proof of Concept

▶ Watch: Autel's "home charger sharing" feature explained (6:20)

The culmination of Computest Security's extensive research was their successful participation in the Pwn2Own Automotive 2023 competition in Tokyo. This competition served as the ultimate proof of concept for their findings. The team demonstrated their ability to achieve arbitrary code execution on three different Level 2 EV chargers, validating the practical exploitability of the vulnerabilities they discovered.

Specifically, the buffer overflow vulnerability in Gecko OS (as found on the Juice Box 40) formed the basis of their Pwn2Own attempt. While the full, step-by-step demonstration of each exploit was not explicitly detailed in the talk, the confirmation of arbitrary code execution across multiple devices, including the Autel Maxi Charger and the Charge Point Home Flex, signifies a complete compromise. For the Juice Box, the exploit would have involved sending a specially crafted command via the Telnet CLI (likely accessed over Wi-Fi after initial provisioning) that leveraged the @T timestamp formatting tag to trigger the buffer overflow and execute their injected shellcode. For the Charge Point Home Flex, the proof of concept would have involved interacting with the forwarded Telnet session via the reverse SSH tunnel, demonstrating how they could gain a shell despite the SSH restrictions.

The success at Pwn2Own underscores the severity of these vulnerabilities. It moved the findings from theoretical possibilities to demonstrated realities, showing that attackers within Bluetooth or Wi-Fi range could gain full control over these devices. The ability to execute arbitrary code means an attacker could manipulate charging parameters, disable the charger, potentially extract sensitive user data, or even use the charger as a pivot point for further attacks on the home network, highlighting the significant real-world impact of these compromises.

Defensive Implications

▶ Watch: Beginning firmware investigation for memory corruption vulnerabilities (8:00)

The findings presented by Computest Security carry profound defensive implications for EV charger manufacturers, users, and the broader IoT security landscape. Addressing these vulnerabilities requires a multi-faceted approach, focusing on secure design, robust implementation, and ongoing maintenance.

For EV Charger Manufacturers:

1. Secure Software Development Lifecycle (SSDLC): Integrate security from the design phase. This includes comprehensive threat modeling, secure coding practices, and regular security audits of all software components, especially third-party libraries and operating systems.
2. Input Validation and Memory Safety: Strictly validate all user inputs to prevent vulnerabilities like buffer overflows. Implement modern memory-safe programming practices, particularly when dealing with dynamic string formatting and buffer handling.
3. Third-Party Component Security: Exercise extreme caution when integrating third-party software and hardware (e.g., Gecko OS modules). Prioritize components with active support, robust security track records, and timely patch releases. Avoid using end-of-life (EOL) software or ensure that EOL components are thoroughly hardened and isolated if their use is unavoidable.
4. Authentication and Authorization: Implement strong, mandatory authentication for all interfaces, including local command-line interfaces (Telnet, SSH) and remote access. Default configurations should never expose unauthenticated services. Enforce least privilege principles for all user accounts and services.
5. Secure Provisioning Processes: The Bluetooth/BLE provisioning stage is a critical attack surface. Ensure strong cryptographic pairing, authentication, and encryption during initial setup and reprovisioning. Validate state transitions rigorously to prevent bypasses.
6. Secure Remote Management: Re-evaluate and harden remote maintenance and diagnostic mechanisms (e.g., reverse SSH tunnels). These should be temporary, strongly authenticated, and meticulously logged. Access should be granted only on an as-needed basis and should not expose unauthenticated local services.
7. Patch Management and OTA Updates: Establish a reliable and secure over-the-air (OTA) update mechanism to deliver patches promptly. Inform users about critical updates and simplify the update process to encourage adoption.
8. SSL/TLS Configuration: Correctly configure SSL/TLS parameters. As highlighted in the talk, common errors like setting cURLOPT_SSL_VERIFYHOST to true instead of 2 can silently disable certificate validation, leaving communications vulnerable to man-in-the-middle attacks.

For EV Charger Users:

1. Keep Firmware Updated: Always ensure your EV charger's firmware is up to date. Manufacturers release patches for discovered vulnerabilities, and applying them is crucial for maintaining security.
2. Secure Your Home Network: Use strong, unique passwords for your Wi-Fi network. Consider creating a separate VLAN or guest network for IoT devices like EV chargers to segment them from your primary home network, limiting potential lateral movement in case of a compromise.
3. Understand Features: Be aware of features like "home charger sharing" on devices like the Autel Maxi Charger. Understand the security implications and risks associated with exposing your charger to public use.
4. Monitor Charger Behavior: While not always feasible for the average user, unusual charging patterns, unexpected disconnections, or unexplained network activity from the charger could indicate a compromise.

Broader IoT Security Implications:

The research underscores a recurring theme in IoT security: the neglect of fundamental security principles in favor of rapid feature development and time-to-market. The reliance on legacy or EOL components, coupled with insecure defaults and poorly implemented remote access, creates a fertile ground for attackers. This calls for increased regulatory oversight, industry-wide security standards, and a greater emphasis on supply chain security for all connected devices.

Key Takeaways

• Pervasive Vulnerabilities: Level 2 home EV chargers, despite their critical role, exhibit significant security vulnerabilities ranging from basic misconfigurations to deep memory corruption flaws.
• Multiple Attack Vectors: Attackers can compromise chargers via various interfaces, including Bluetooth/BLE for provisioning, Wi-Fi for network access, and even leveraging insecure remote maintenance tunnels.
• Third-Party and EOL Software Risks: The reliance on third-party components like Gecko OS (especially when end-of-life) introduces substantial risks, as demonstrated by the buffer overflow vulnerability.
• Insecure Remote Access: Maintenance backdoors, such as reverse SSH tunnels forwarding unauthenticated Telnet sessions, represent critical weaknesses that can be exploited for unauthorized access and control.
• Impact of Compromise: Successful exploitation can lead to arbitrary code execution, enabling free charging, denial of service, data manipulation, and potential pivot points into broader home networks.
• Urgent Need for Secure Development: Manufacturers must adopt robust SSDLC practices, including stringent input validation, secure defaults, proper SSL/TLS configuration, and continuous security auditing of their entire software supply chain.

About the Speaker(s)

Khaled Nassar and Thijs Alkemade are dedicated security researchers working for Computest Security, an IT security consulting firm based in the Netherlands. They are integral members of Computest Security's specialized research center, Sector 7. This center was established with the overarching goal of enhancing the state of software security globally, primarily through undertaking in-depth vulnerability research projects. Their work often involves participation in prestigious hacking competitions, notably their successful participation in the inaugural Pwn2Own Automotive 2023 in Tokyo, where they demonstrated their expertise in uncovering and exploiting critical vulnerabilities in modern automotive and charging infrastructure. Their colleague, Dan Keper, also contributed to the research but was not present for the talk.