arXiv subjects

Sebastian Köhler

Publications and source records attributed to Sebastian Köhler.

15 recordsLinked to original sources

arXiv2026

DCeption: Real-world Wireless Man-in-the-Middle Attacks Against CCS EV Charging

The adoption of Electric Vehicles (EVs) is happening at a rapid pace. To ensure fast and safe charging, complex communication is required between the vehicle and the charging station. In the globally used Combined Charging System (CCS), this communication is carried over the HomePlug Green PHY (HPGP) physical layer. However, HPGP is known to suffer from wireless leakage, which may expose this data link to nearby attackers. In this paper, we examine active wireless attacks against CCS, and study the impact they can have. We present the first real-time Software-Defined Radio (SDR) implementation of HPGP, granting unprecedented access to the communications within the charging cables. We analyze the characteristics of 2,750 real-world charging sessions to understand the timing constraints for hijacking. Using novel techniques to increase the attacks' reliability, we design a robust wireless Man-in-the-Middle evaluation framework for CCS. We demonstrate full control over TLS usage and CCS protocol version negotiation, including TLS stripping attacks. We investigate how real devices respond to safety-critical MitM attacks, which modify power delivery information, and found target vehicles to be highly permissive. First, we caused a vehicle to display charging power exceeding 900 kW on the dashboard, while receiving only 40 kW. Second, we remotely overcharged a vehicle, at twice the requested current for 17 seconds before the vehicle triggered the emergency shutdown. Finally, we propose a backwards-compatible, downgrade-proof protocol extension to mitigate the underlying vulnerabilities.

cs.CR↗

arXiv2025

DSNS: The Deep Space Network Simulator

Simulation tools are commonly used in the development and testing of new protocols or new networks. However, as satellite networks start to grow to encompass thousands of nodes, and as companies and space agencies begin to realize the interplanetary internet, existing satellite and network simulation tools have become impractical for use in this context. We therefore present the Deep Space Network Simulator (DSNS): a new network simulator with a focus on large-scale satellite networks. We demonstrate its improved capabilities compared to existing offerings, showcase its flexibility and extensibility through an implementation of existing protocols and the DTN simulation reference scenarios recommended by CCSDS, and evaluate its scalability, showing that it exceeds existing tools while providing better fidelity. DSNS provides concrete usefulness to both standards bodies and satellite operators, enabling fast iteration on protocol development and testing of parameters under highly realistic conditions. By removing roadblocks to research and innovation, we can accelerate the development of upcoming satellite networks and ensure that their communication is both fast and secure.

cs.NI↗

arXiv2025

SATversary: Adversarial Attacks and Defenses for Satellite Fingerprinting

Due to the increasing threat of attacks on satellite systems, novel countermeasures have been developed to provide additional security. Among these, there has been a particular interest in transmitter fingerprinting, which authenticates transmitters by looking at characteristics expressed in the physical layer signal. These systems rely heavily upon statistical methods and machine learning, and are therefore vulnerable to a range of attacks. The severity of this threat in a fingerprinting context is currently not well understood. In this paper we evaluate a range of attacks against satellite fingerprinting, building on previous works by looking at attacks optimized to target the fingerprinting system for maximal impact. We design optimized jamming, dataset poisoning, and spoofing attacks, evaluating them in the real world against the SatIQ fingerprinting system designed to authenticate Iridium transmitters, and using a wireless channel emulator to achieve realistic channel conditions. We show that an optimized jamming signal can cause a 50% error rate with attacker-to-victim ratios as low as -30dB (far less power than traditional jamming techniques), and demonstrate successful spoofing attacks, with an attacker successfully removing their own transmitter's fingerprint from messages. We also present a viable dataset poisoning attack, enabling persistent message spoofing by altering stored data to include the fingerprint of the attacker's transmitter. Finally, we show that a model trained to optimize spoofing attacks can also be used to detect spoofing and replay attacks, even when it has never seen the attacker's transmitter before. This technique works even when the training dataset includes only a single transmitter, enabling fingerprinting to be used to protect small constellations and even individual satellites, providing additional protection where it is needed the most.

cs.CR↗

arXiv2025

Current Affairs: A Security Measurement Study of CCS EV Charging Deployments

Since its introduction in 2012, the Combined Charging System (CCS) has emerged as the leading technology for EV fast charging in Europe, North America and parts of Asia. The charging communication of CCS is defined by the ISO 15118 standards, which have been improved over the years. Most notably, in 2014, important security features such as Transport Layer Security (TLS) and usability enhancements such as Plug and Charge were introduced. In this paper, we conduct the first measurement study of publicly deployed CCS DC charging stations to capture the state of deployment for different protocol versions and to better understand the attack surface of the EV charging infrastructure. In our evaluation, we examine 325 chargers manufactured between April 2013 and June 2023, and installed as late as May 2024 by 26 manufacturers across 4 European countries. We find that only 12% of the charging stations we analyzed implement TLS at all, leaving all others vulnerable to attacks that have already been demonstrated many years ago. We observe an increasing trend in support for ISO 15118-2 over the years, reaching 70% of chargers manufactured in 2023. We further notice that most chargers use a decade-old firmware for their HomePlug modems, which could contain vulnerabilities that have been patched since. Finally, we discuss design flaws with the Public Key Infrastructure system used in EV charging, and propose changes to improve the adoption and availability of TLS.

cs.CR↗

arXiv2024

KeySpace: Enhancing Public Key Infrastructure for Interplanetary Networks

As the use of satellites continues to grow, new networking paradigms are emerging to support the scale and long distance communication inherent to these networks. In particular, interplanetary communication relays connect distant network segments together, but result in a sparsely connected network with long-distance links that are frequently interrupted. In this new context, traditional Public Key Infrastructure (PKI) becomes difficult to implement, due to the impossibility of low-latency queries to a central authority. This paper addresses the challenge of implementing PKI in these complex networks, identifying the essential goals and requirements. Using these requirements, we develop the KeySpace framework, comprising a set of standardized experiments and metrics for comparing PKI systems across various network topologies, evaluating their performance and security. This enables the testing of different protocols and configurations in a standard, repeatable manner, so that improvements can be more fairly tested and clearly demonstrated. We use KeySpace to test two standard PKI protocols in use in terrestrial networks (OCSP and CRLs), demonstrating for the first time that both can be effectively utilized even in interplanetary networks with high latency and frequent interruptions, provided authority is properly distributed throughout the network. Finally, we propose and evaluate a number of novel techniques extending standard OCSP to improve the overhead of connection establishment, reduce link congestion, and limit the reach of an attacker with a compromised key. Using KeySpace we validate these claims, demonstrating their improved performance over the state of the art.

cs.CR↗

arXiv2024

Sticky Fingers: Resilience of Satellite Fingerprinting against Jamming Attacks

In the wake of increasing numbers of attacks on radio communication systems, a range of techniques are being deployed to increase the security of these systems. One such technique is radio fingerprinting, in which the transmitter can be identified and authenticated by observing small hardware differences expressed in the signal. Fingerprinting has been explored in particular in the defense of satellite systems, many of which are insecure and cannot be retrofitted with cryptographic security. In this paper, we evaluate the effectiveness of radio fingerprinting techniques under interference and jamming attacks, usually intended to deny service. By taking a pre-trained fingerprinting model and gathering a new dataset in which different levels of Gaussian noise and tone jamming have been added to the legitimate signal, we assess the attacker power required in order to disrupt the transmitter fingerprint such that it can no longer be recognized. We compare this to Gaussian jamming on the data portion of the signal, obtaining the remarkable result that transmitter fingerprints are still recognizable even in the presence of moderate levels of noise. Through deeper analysis of the results, we conclude that it takes a similar amount of jamming power in order to disrupt the fingerprint as it does to jam the message contents itself, so it is safe to include a fingerprinting system to authenticate satellite communication without opening up the system to easier denial-of-service attacks.

cs.CR↗

arXiv2024

Brokenwire : Wireless Disruption of CCS Electric Vehicle Charging

We present a novel attack against the Combined Charging System, one of the most widely used DC rapid charging technologies for electric vehicles (EVs). Our attack, Brokenwire, interrupts necessary control communication between the vehicle and charger, causing charging sessions to abort. The attack requires only temporary physical proximity and can be conducted wirelessly from a distance, allowing individual vehicles or entire fleets to be disrupted stealthily and simultaneously. In addition, it can be mounted with off-the-shelf radio hardware and minimal technical knowledge. By exploiting CSMA/CA behavior, only a very weak signal needs to be induced into the victim to disrupt communication - exceeding the effectiveness of broadband noise jamming by three orders of magnitude. The exploited behavior is a required part of the HomePlug Green PHY, DIN 70121 & ISO 15118 standards and all known implementations exhibit it. We first study the attack in a controlled testbed and then demonstrate it against eight vehicles and 20 chargers in real deployments. We find the attack to be successful in the real world, at ranges up to 47 m, for a power budget of less than 1 W. We further show that the attack can work between the floors of a building (e.g., multi-story parking), through perimeter fences, and from `drive-by' attacks. We present a heuristic model to estimate the number of vehicles that can be attacked simultaneously for a given output power. Brokenwire has immediate implications for a substantial proportion of the around 12 million battery EVs on the roads worldwide - and profound effects on the new wave of electrification for vehicle fleets, both for private enterprise and crucial public services, as well as electric buses, trucks and small ships. As such, we conducted a disclosure to the industry and discussed a range of mitigation techniques that could be deployed to limit the impact.

cs.CR↗

arXiv2023

Watch This Space: Securing Satellite Communication through Resilient Transmitter Fingerprinting

Due to an increase in the availability of cheap off-the-shelf radio hardware, spoofing and replay attacks on satellite ground systems have become more accessible than ever. This is particularly a problem for legacy systems, many of which do not offer cryptographic security and cannot be patched to support novel security measures. In this paper we explore radio transmitter fingerprinting in satellite systems. We introduce the SatIQ system, proposing novel techniques for authenticating transmissions using characteristics of transmitter hardware expressed as impairments on the downlinked signal. We look in particular at high sample rate fingerprinting, making fingerprints difficult to forge without similarly high sample rate transmitting hardware, thus raising the budget for attacks. We also examine the difficulty of this approach with high levels of atmospheric noise and multipath scattering, and analyze potential solutions to this problem. We focus on the Iridium satellite constellation, for which we collected 1705202 messages at a sample rate of 25 MS/s. We use this data to train a fingerprinting model consisting of an autoencoder combined with a Siamese neural network, enabling the model to learn an efficient encoding of message headers that preserves identifying information. We demonstrate the system's robustness under attack by replaying messages using a Software-Defined Radio, achieving an Equal Error Rate of 0.120, and ROC AUC of 0.946. Finally, we analyze its stability over time by introducing a time gap between training and testing data, and its extensibility by introducing new transmitters which have not been seen before. We conclude that our techniques are useful for building systems that are stable over time, can be used immediately with new transmitters without retraining, and provide robustness against spoofing and replay by raising the required budget for attacks.

cs.CR↗

arXiv2023

Assault and Battery: Evaluating the Security of Power Conversion Systems Against Electromagnetic Injection Attacks

Many modern devices, including critical infrastructures, depend on the reliable operation of electrical power conversion systems. The small size and versatility of switched-mode power converters has resulted in their widespread adoption. Whereas transformer-based systems passively convert voltage, switched-mode converters feature an actively regulated feedback loop, which relies on accurate sensor measurements. Previous academic work has shown that many types of sensors are vulnerable to Intentional Electromagnetic Interference (IEMI) attacks, and it has been postulated that power converters, too, are affected. In this paper, we present the first detailed study on switched-mode power converters by targeting their voltage and current sensors through IEMI attacks. We present a theoretical framework for evaluating IEMI attacks against feedback-based power supplies in the general case. We experimentally validate our theoretical predictions by analyzing multiple AC-DC and DC-DC converters, automotive grade current sensors, and dedicated battery chargers, and demonstrate the systematic vulnerability of all examined categories under real-world conditions. Finally, we demonstrate that sensor attacks on power converters can cause permanent damage to Li-Ion batteries during the charging process.

cs.CR↗

arXiv2023

Dishing Out DoS: How to Disable and Secure the Starlink User Terminal

Satellite user terminals are a promising target for adversaries seeking to target satellite communication networks. Despite this, many protections commonly found in terrestrial routers are not present in some user terminals. As a case study we audit the attack surface presented by the Starlink router's admin interface, using fuzzing to uncover a denial of service attack on the Starlink user terminal. We explore the attack's impact, particularly in the cases of drive-by attackers, and attackers that are able to maintain a continuous presence on the network. Finally, we discuss wider implications, looking at lessons learned in terrestrial router security, and how to properly implement them in this new context.

cs.CR↗

arXiv2021

Signal Injection Attacks against CCD Image Sensors

Since cameras have become a crucial part in many safety-critical systems and applications, such as autonomous vehicles and surveillance, a large body of academic and non-academic work has shown attacks against their main component - the image sensor. However, these attacks are limited to coarse-grained and often suspicious injections because light is used as an attack vector. Furthermore, due to the nature of optical attacks, they require the line-of-sight between the adversary and the target camera. In this paper, we present a novel post-transducer signal injection attack against CCD image sensors, as they are used in professional, scientific, and even military settings. We show how electromagnetic emanation can be used to manipulate the image information captured by a CCD image sensor with the granularity down to the brightness of individual pixels. We study the feasibility of our attack and then demonstrate its effects in the scenario of automatic barcode scanning. Our results indicate that the injected distortion can disrupt automated vision-based intelligent systems.

cs.CR↗

arXiv2021

They See Me Rollin': Inherent Vulnerability of the Rolling Shutter in CMOS Image Sensors

In this paper, we describe how the electronic rolling shutter in CMOS image sensors can be exploited using a bright, modulated light source (e.g., an inexpensive, off-the-shelf laser), to inject fine-grained image disruptions. We demonstrate the attack on seven different CMOS cameras, ranging from cheap IoT to semi-professional surveillance cameras, to highlight the wide applicability of the rolling shutter attack. We model the fundamental factors affecting a rolling shutter attack in an uncontrolled setting. We then perform an exhaustive evaluation of the attack's effect on the task of object detection, investigating the effect of attack parameters. We validate our model against empirical data collected on two separate cameras, showing that by simply using information from the camera's datasheet the adversary can accurately predict the injected distortion size and optimize their attack accordingly. We find that an adversary can hide up to 75% of objects perceived by state-of-the-art detectors by selecting appropriate attack parameters. We also investigate the stealthiness of the attack in comparison to a naïve camera blinding attack, showing that common image distortion metrics can not detect the attack presence. Therefore, we present a new, accurate and lightweight enhancement to the backbone network of an object detector to recognize rolling shutter attacks. Overall, our results indicate that rolling shutter attacks can substantially reduce the performance and reliability of vision-based intelligent systems.

cs.CV↗

arXiv2018

Evidence for electronically-driven ferroelectricity in the family of strongly correlated dimerized BEDT-TTF molecular conductors

By applying measurements of the dielectric constants and relative length changes to the dimerized molecular conductor $κ$-(BEDT-TTF)$_2$Hg(SCN)$_2$Cl, we provide evidence for order-disorder type electronic ferroelectricity which is driven by charge order within the (BEDT-TTF)$_2$ dimers and stabilized by a coupling to the anions. According to our density functional theory calculations, this material is characterized by a moderate strength of dimerization. This system thus bridges the gap between strongly dimerized materials, often approximated as dimer-Mott systems at 1/2 filling, and non- or weakly dimerized systems at 1/4 filling exhibiting charge order. Our results indicate that intra-dimer charge degrees of freedom are of particular importance in correlated $κ$-(BEDT-TTF)$_2$X salts and can create novel states, such as electronically-driven multiferroicity or charge-order-induced quasi-1D spin liquids.

cond-mat.str-el↗

arXiv2018

Intentions of Vulnerable Road Users - Detection and Forecasting by Means of Machine Learning

Avoiding collisions with vulnerable road users (VRUs) using sensor-based early recognition of critical situations is one of the manifold opportunities provided by the current development in the field of intelligent vehicles. As especially pedestrians and cyclists are very agile and have a variety of movement options, modeling their behavior in traffic scenes is a challenging task. In this article we propose movement models based on machine learning methods, in particular artificial neural networks, in order to classify the current motion state and to predict the future trajectory of VRUs. Both model types are also combined to enable the application of specifically trained motion predictors based on a continuously updated pseudo probabilistic state classification. Furthermore, the architecture is used to evaluate motion-specific physical models for starting and stopping and video-based pedestrian motion classification. A comprehensive dataset consisting of 1068 pedestrian and 494 cyclist scenes acquired at an urban intersection is used for optimization, training, and evaluation of the different models. The results show substantial higher classification rates and the ability to earlier recognize motion state changes with the machine learning approaches compared to interacting multiple model (IMM) Kalman Filtering. The trajectory prediction quality is also improved for all kinds of test scenes, especially when starting and stopping motions are included. Here, 37\% and 41\% lower position errors were achieved on average, respectively.

cs.CV↗

arXiv2018

Effects of Disorder on the Pressure-Induced Mott Transition in $κ$-BEDT-TTF)$_2$Cu[N(CN)$_2$]Cl

We present a study of the influence of disorder on the Mott metal-insulator transition for the organic charge-transfer salt $κ$-(BEDT-TTF)$_2$Cu[N(CN)$_2$]Cl. To this end, disorder was introduced into the system in a controlled way by exposing the single crystals to x-ray irradiation. The crystals were then fine-tuned across the Mott transition by the application of continuously controllable He-gas pressure at low temperatures. Measurements of the thermal expansion and resistance show that the first-order character of the Mott transition prevails for low irradiation doses achieved by irradiation times up to 100 h. For these crystals with a moderate degree of disorder, we find a first-order transition line which ends in a second-order critical endpoint, akin to the pristine crystals. Compared to the latter, however, we observe a significant reduction of both, the critical pressure $p_c$ and the critical temperature $T_c$. This result is consistent with the theoretically-predicted formation of a soft Coulomb gap in the presence of strong correlations and small disorder. Furthermore, we demonstrate, similar to the observation for the pristine sample, that the Mott transition after 50 h of irradiation is accompanied by sizable lattice effects, the critical behavior of which can be well described by mean-field theory. Our results demonstrate that the character of the Mott transition remains essentially unchanged at a low disorder level. However, after an irradiation time of 150 h, no clear signatures of a discontinuous metal-insulator transition could be revealed anymore. These results suggest that, above a certain disorder level, the metal-insulator transition becomes a smeared first-order transition with some residual hysteresis.

cond-mat.str-el↗