Exploiting Vulns in EV Charging Comms

One Modem to Brick Them All: Exploiting Vulnerabilities in EV Charging Communications

Speakers: Jan Berens, Marcell Szakály, Sebastian Köhler Conference: DEF CON 33 YouTube: https://www.youtube.com/watch?v=kQVszh5ER1M Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Marcell%20Szakaly%20Jan%20Berens%20Sebastian%20Kohler%20-%20One%20Modem%20to%20Brick%20Them%20All%20Exploiting%20Vulnerabilities%20in%20the%20EV%20Charging%20Communication.pdf

Overview

Electric vehicle charging infrastructure runs on a stack of aging, largely unpatched hardware. The data link that negotiates charging sessions between a car and a DC fast charger uses Power Line Communication (PLC) — a technology from the home networking world, relying on chips that trace their firmware back to 2013. At DEF CON 33, researchers Jan Berens, Marcell Szakály, and Sebastian Köhler presented an extensive study of these systems, revealing a chain of vulnerabilities that allows an attacker to persistently deny service to any charger or vehicle, intercept and hijack the encrypted charging session, and — through firmware reverse engineering — achieve code execution on the PLC modem chip itself.

The talk, titled "One Modem to Brick Them All," builds directly on prior work by Köhler ("Broken Wire," presented at the DEF CON Car Hacking Village in 2023) and extends it with new attack primitives, a real-world measurement study across hundreds of deployed charging stations in four countries, and the first public demonstration of code execution on the QCA7000 modem — proven by running a highly optimized build of Doom on the chip.

Background

▶ Watch: Target identified: QCA7000 HomePlug modem dominates EV charging ecosystem (6:44)

EV Charging Standards and the PLC Stack

The dominant charging protocols in the US and Europe are CCS (Combined Charging System) — in both CCS1 (North America) and CCS2 (European) connector variants — and NACS, Tesla's standard now adopted as the North American industry default. Both are defined under the ISO 15118 standard family, which specifies how an electric vehicle and a charger communicate over the cable.

The physical communication layer beneath ISO 15118 is HomePlug Green PHY, a power-line communication standard derived from HomePlug AV — the same technology used in home powerline network adapters. The choice of PLC was made for cost and simplicity: existing cable infrastructure, no additional wiring, and interoperability with home charging equipment.

The chip that implements HomePlug Green PHY in virtually every CCS and NACS-compatible device is the Qualcomm QCA7000 (or its near-identical sibling, the QCA7005). This single chip is the communication backbone for the majority of EV charging sessions worldwide.

The Problem with a Single Modem Dominating the Ecosystem

The QCA7000 was designed in the early 2010s. Its reference firmware dates to 2013. The researchers' measurement study of 397 deployed CCS chargers found that over 60% of chargers carry firmware more than ten years old, with no firmware updates deployed after Qualcomm released fixes in response to Köhler's 2022 "Broken Wire" disclosures. Some late-model vehicles were found carrying firmware from 2015 despite the car rolling off the line several years later.

This is not purely a vendor negligence story. The QCA7000 firmware update path requires physical access or a specific update mode that is rarely enabled in production deployments. The systemic failure spans chip vendor, charger manufacturer, vehicle OEM, and fleet operator.

Key Findings

▶ Watch: Attack demo: writing attacker PIB to victim charging modem via Ethernet (15:23)

The research produced three categories of findings:

1. PIB (Parameter Information Block) read/write access — a configuration structure accessible remotely via Ethernet frames, with no authentication by default, allowing persistent denial of service and identity manipulation
2. Remote attack vectors — signal injection via inductive coupling or the electrical ground, enabling attacks from outside the cable without physical connection
3. Firmware reverse engineering and code execution — full analysis of the QCA7000 boot chain, leading to arbitrary code execution demonstrated with a Doom port

A complementary measurement study of real-world deployments quantified the scope:

• 397 CCS plugs surveyed across the UK, Switzerland, Hungary, and Croatia
• 26 unique manufacturers represented
• Hardware from 2013 to 2023 in active deployment
• A California subset of 69 chargers: 41 had PIBs fully readable and writable by any connected device

Technical Deep Dive

▶ Watch: Remote attack vectors: signal injection via inductive coupling and ground path (24:48)

The PLC Session and the SLAC Handshake

When an EV is plugged into a DC fast charger, the connection process starts with basic power signaling over the pilot wire, then transitions to PLC. The SLAC (Signal Level Attenuation Characterization) handshake is how the car and charger discover each other on the powerline network. During SLAC, the Network Membership Key (NMK) — the equivalent of a Wi-Fi pre-shared key for the HomePlug network — is transmitted in plaintext.

Using the open-source homeplug-pyon Python library, an attacker can extract the NMK from SLAC packets and join the EV's HomePlug network. Once on the network, the attacker can spoof the charger's MAC address to intercept IPv6 traffic, effectively becoming a man-in-the-middle for the ISO 15118 session.

PIB: The Root Configuration Structure

The PIB (Parameter Information Block) is a ~10 KB binary blob stored in the QCA7000's SPI flash. It contains the modem's MAC address, manufacturer strings, and critically, the Network Membership Key. The PIB is readable and writable remotely via standard Ethernet frames sent to the modem using tools from the openplc-utils toolkit — no authentication is required by default.

A security bit at PIB offset 0x1F8C is supposed to restrict access (0 = open, 1 = locked). However:

• Most development and production boards ship with the security bit cleared
• Even when the security bit is set, a reset command sent via PLC forces the modem to revert to factory default PIB, bypassing the restriction entirely

Consequences of unrestricted PIB access include:

• MAC address forgery — impersonate any device on the network
• NMK extraction — join the encrypted HomePlug session
• Persistent denial of service — modify the PIB to disable host communication or PLC communication, leaving the charger unable to complete any charging session until physically serviced

The researchers disclosed these vulnerabilities to Qualcomm in February 2025. Qualcomm acknowledged the report. As of the DEF CON 33 presentation, no patch had been released.

Remote Attack Vectors: Induction and the Ground Path

HomePlug operates at 1–30 MHz (with gaps for standard radio frequencies). At these frequencies, the signal is not fully contained within the charging cable — it radiates and can be inductively coupled.

The researchers demonstrated three physical attack configurations:

• Commercial CCS coupler (Vector, approximately €4,000): A purpose-built inductive listener for CCS signals, designed for automotive testing
• DIY coil (~€280 in components): A simple wire coil wrapped around the charging cable achieves effective signal coupling
• Bare wire near cable: Passive signal pickup at close range without any special construction

More significant is the electrical ground path attack. The protective earth (PE) ground conductor in European electrical installations is connected to the charger's housing and, through the charging cable, to the car's chassis. This ground conductor is shared between the charging circuit and the building's ground system. An attacker can inject HomePlug signals onto the building ground with sufficient power to reach any charger connected to that ground — potentially all chargers in a parking structure or commercial charging park simultaneously. Because the ground conductor passes through standard electrical switchgear without attenuating PLC signals, this attack is amplifiable to essentially unlimited range without triggering circuit breakers.

The researchers successfully verified the ground-path attack in controlled testing. An implanted device placed near a charging park could sustain a persistent denial-of-service attack on all connected chargers indefinitely.

Denial of Service via SLAC Flooding

Even without PIB write access, an attacker on the HomePlug network can flood the SLAC handshake exchange with a sliding window of packets, preventing new charging sessions from being established. This blocks the initial association step that every EV charging session requires, effectively denying service to any new vehicle that connects.

Firmware Reverse Engineering

The QCA7000 stores firmware in SPI flash (2 MB total). The researchers used openplc-utils to dump the flash over the network, then analyzed the structure:

• Soft loader: A minimal bootloader responsible for loading the main firmware
• Firmware chain: Compressed with LZMA (default settings, no encryption, no digital signatures)
• Init module slots: Reserved slots for initialization code that execute before the main firmware
• PIB and firmware backup: Stored at predictable offsets

Critically, no signature verification exists on the init module slots. The researchers loaded custom code into an init module slot, instrumented the SPI flash read operations using a clip-on SOIC chip adapter to extract the bootloader, and fully reverse engineered the boot chain. The bootloader runs on an ARMv5 core, is written in C++ (with recoverable virtual dispatch tables), and includes SPI flash drivers, an Ethernet driver, and LZMA decompression.

The firmware itself, once decompressed from the LZMA blob, is a complete monolithic firmware image for the PLC subsystem. Full decompilation and PLC subsystem analysis was noted as ongoing future work.

Demo / PoC

▶ Watch: Ultimate demo: running Doom on an EV charging station modem (36:56)

To demonstrate arbitrary code execution on the QCA7000, the researchers ported Doom to the chip. The constraints are significant: 2 MB of flash, unknown but limited RAM, no operating system, a single-core ARMv5 microcontroller running without a floating-point unit. The implementation uses a highly optimized, low-resolution frame buffer, and offloads rendering to a host PC connected via UDP (the host PC handles user input and displays the frames). Despite these constraints, the port runs. Doom on a QCA7000 modem is as clear a proof of arbitrary code execution as any shellcode launcher.

Defensive Implications

▶ Watch: Disclosure and real-world deployment impact across 397 surveyed chargers (42:46)

The researchers are candid that many of these issues have no easy fix:

• Signal leakage through the ground path cannot be prevented with shielding or ferrite beads — the physical characteristic of the electrical system is the attack surface.
• Secure SLAC is defined in the HomePlug specification but is absent from all current deployments, and implementing it while maintaining backward compatibility with the installed base of unsecured devices would require a negotiation path that can itself be downgraded.

Realistic near-term mitigations:

• Set the PIB security bit on all deployed QCA7000 devices during manufacturing and prohibit factory PIB reset via the software reset command
• Deploy updated firmware — the Qualcomm 2022-era patches address the Broken Wire jamming issue; none have been deployed at meaningful scale
• Implement TLS for ISO 15118 sessions — only approximately 12% of European chargers support TLS, and essentially none of the pre-2022 deployments do
• Physically secure charger electronics against implant-style attacks
• Long-term: Migrate EV charging communications away from HomePlug PLC toward technologies with better security primitives, such as CAN bus or the emerging MCS/Ethernet standard. The researchers estimate this transition will take five to ten years.

Key Takeaways

1. The QCA7000 HomePlug modem is a single point of failure for DC fast-charging security across virtually the entire CCS and NACS ecosystem.
2. PIB read/write access via unauthenticated Ethernet frames enables persistent denial of service and identity spoofing, with no authentication required by default.
3. The electrical ground path provides a remote, amplifiable attack vector that can simultaneously affect all chargers in a building or charging park.
4. The NMK is transmitted in plaintext during the SLAC handshake, enabling anyone with physical or inductive proximity to the cable to join the charging session's HomePlug network.
5. Firmware on deployed chargers is routinely 10+ years old, and the 2022 Qualcomm patches have not been deployed at meaningful scale.
6. The QCA7000 firmware chain has no signature verification, enabling persistent arbitrary code execution on the modem itself.
7. Running Doom on a public EV charging modem is the least surprising part of this talk.

About the Speakers

Jan Berens is a red teamer at Alpatronic, one of Europe's largest EV charger manufacturers. His insider perspective on charger hardware and deployment practices contributed significantly to the practical attack scenarios in this research. He also volunteers as a goon (conference staff) at DEF CON and related events.

Marcell Szakály is a PhD student at the System Security Lab at the University of Oxford, pursuing his doctorate specifically on the security of EV charging infrastructure. His academic work is supported by ARMASUISSE (the Swiss Federal Department of Defence technology and procurement agency), which also provided equipment and technical expertise for the research. He is the lead academic contributor to this project and has direct continuity from Köhler's "Broken Wire" research.

Sebastian Köhler authored the foundational "Broken Wire" research — an earlier DEF CON Car Hacking Village talk and academic paper demonstrating that PLC communication in EV charging cables could be jammed from a distance using low-power signals. That disclosure led to the 2022 Qualcomm acknowledgment of vulnerabilities. The current work builds on the same modem platform, extending from denial-of-service through to code execution and widespread deployment impact.