Cyber Threats to EV Charging Infrastructure: Risks and Protection through Penetration Testing

Threats to EV Charging Infrastructure

Let’s explore the most pressing threats to EV charging infrastructure and the potential consequences they carry for users and operators alike.

1. Infrastructure Outage
A targeted attack on availability can lead to long queues, stranded vehicles, revenue losses, and significant damage to the operator’s reputation. Reliable charging infrastructure is crucial for EV drivers. Such outages can undermine public trust in the technology and hinder progress toward sustainable mobility.

2. Manipulation of Consumption Data
Tampered data can lead to billing problems and violations of legal regulations, such as the Measurement and Verification Act. Billing and roaming with partner networks may be disrupted, potentially causing significant financial losses for operators.

3. Duplication of Charging Cards and Authentication Bypass
Attacks on card-based authentication systems can harm customers and cause revenue losses for operators. This underscores the importance of robust and thoroughly tested authentication mechanisms.

4. Attacks on Backend and Cloud Systems
An attack on backend systems—such as those processing consumption data, authenticating users, and managing billing—or cloud portals used by customers can result in massive data breaches. This allows attackers to manipulate charging sessions or alter the configuration of charging stations. Vulnerabilities in backend systems often serve as entry points for more extensive attacks within the infrastructure.

5. Defacement and Phishing (Quishing)
Inappropriate content displayed on charging station screens or fraudulent QR codes can mislead customers, redirect them to fake billing sites, and damage the operator’s image. "Quishing" attacks via QR codes pose a significant risk to end-users.

6. Ransomware
Ransomware attacks on operators can lock down all charging stations until a ransom is paid. These attacks not only cause financial losses but also undermine trust in the operator and the critical charging infrastructure.

7. Attacks on the Power Grid
Attackers may exploit simultaneous manipulation of multiple charging stations to destabilize the grid through load peaks or drops, potentially causing a blackout.

Attack Vectors on Charging Infrastructure

1. Physical Access
Charging stations, often installed in public areas, are susceptible to physical attacks. Simple tools like screwdrivers or lock-picking can grant unauthorized access. Security measures such as tamper contacts, video surveillance, or integration into a Security Operations Center (SOC) are often lacking. Once accessed, attackers can manipulate firmware, deploy hardware implants, or extract and alter credentials (e.g., for Wi-Fi, VPNs, and backends). Connected Ethernet cables and embedded SIM cards may also be exploited for advanced network attacks.

2. Network Access
Although most charging stations are not directly accessible via the internet, thousands of publicly available stations can still be found on platforms like Shodan or Censys due to misconfigurations. For charging stations within internal networks, attackers may resort to physical access to a station to infiltrate the network and access other devices. Vulnerabilities in cloud portals, operator backends, or remote support interfaces also provide potential attack pathways (see “Attacks on Backend and Cloud Systems”). Compromised backend systems are often used by attackers to gain initial access (MITRE ATT&CK „Initial Access“) and then move laterally within the operator’s or manufacturer’s infrastructure (MITRE ATT&CK „Lateral Movement“, „Privilege Escalation“).