arXiv subjects

Marcell Szakály

Publications and source records attributed to Marcell Szakály.

3 recordsLinked to original sources

arXiv2026

DCeption: Real-world Wireless Man-in-the-Middle Attacks Against CCS EV Charging

The adoption of Electric Vehicles (EVs) is happening at a rapid pace. To ensure fast and safe charging, complex communication is required between the vehicle and the charging station. In the globally used Combined Charging System (CCS), this communication is carried over the HomePlug Green PHY (HPGP) physical layer. However, HPGP is known to suffer from wireless leakage, which may expose this data link to nearby attackers. In this paper, we examine active wireless attacks against CCS, and study the impact they can have. We present the first real-time Software-Defined Radio (SDR) implementation of HPGP, granting unprecedented access to the communications within the charging cables. We analyze the characteristics of 2,750 real-world charging sessions to understand the timing constraints for hijacking. Using novel techniques to increase the attacks' reliability, we design a robust wireless Man-in-the-Middle evaluation framework for CCS. We demonstrate full control over TLS usage and CCS protocol version negotiation, including TLS stripping attacks. We investigate how real devices respond to safety-critical MitM attacks, which modify power delivery information, and found target vehicles to be highly permissive. First, we caused a vehicle to display charging power exceeding 900 kW on the dashboard, while receiving only 40 kW. Second, we remotely overcharged a vehicle, at twice the requested current for 17 seconds before the vehicle triggered the emergency shutdown. Finally, we propose a backwards-compatible, downgrade-proof protocol extension to mitigate the underlying vulnerabilities.

cs.CR↗

arXiv2025

Current Affairs: A Security Measurement Study of CCS EV Charging Deployments

Since its introduction in 2012, the Combined Charging System (CCS) has emerged as the leading technology for EV fast charging in Europe, North America and parts of Asia. The charging communication of CCS is defined by the ISO 15118 standards, which have been improved over the years. Most notably, in 2014, important security features such as Transport Layer Security (TLS) and usability enhancements such as Plug and Charge were introduced. In this paper, we conduct the first measurement study of publicly deployed CCS DC charging stations to capture the state of deployment for different protocol versions and to better understand the attack surface of the EV charging infrastructure. In our evaluation, we examine 325 chargers manufactured between April 2013 and June 2023, and installed as late as May 2024 by 26 manufacturers across 4 European countries. We find that only 12% of the charging stations we analyzed implement TLS at all, leaving all others vulnerable to attacks that have already been demonstrated many years ago. We observe an increasing trend in support for ISO 15118-2 over the years, reaching 70% of chargers manufactured in 2023. We further notice that most chargers use a decade-old firmware for their HomePlug modems, which could contain vulnerabilities that have been patched since. Finally, we discuss design flaws with the Public Key Infrastructure system used in EV charging, and propose changes to improve the adoption and availability of TLS.

cs.CR↗

arXiv2023

Assault and Battery: Evaluating the Security of Power Conversion Systems Against Electromagnetic Injection Attacks

Many modern devices, including critical infrastructures, depend on the reliable operation of electrical power conversion systems. The small size and versatility of switched-mode power converters has resulted in their widespread adoption. Whereas transformer-based systems passively convert voltage, switched-mode converters feature an actively regulated feedback loop, which relies on accurate sensor measurements. Previous academic work has shown that many types of sensors are vulnerable to Intentional Electromagnetic Interference (IEMI) attacks, and it has been postulated that power converters, too, are affected. In this paper, we present the first detailed study on switched-mode power converters by targeting their voltage and current sensors through IEMI attacks. We present a theoretical framework for evaluating IEMI attacks against feedback-based power supplies in the general case. We experimentally validate our theoretical predictions by analyzing multiple AC-DC and DC-DC converters, automotive grade current sensors, and dedicated battery chargers, and demonstrate the systematic vulnerability of all examined categories under real-world conditions. Finally, we demonstrate that sensor attacks on power converters can cause permanent damage to Li-Ion batteries during the charging process.

cs.CR↗