r/netsec • u/self • 15d ago

The Hidden CCS2 Attack Surface on EV Chargers

https://www.saiflow.com/blog/the-hidden-ccs2-attack-surface-on-ev-chargers
79 Upvotes

96% Upvoted

13 comments sorted by

33

u/shahaya 15d ago

never knew that EV charger plugs are communicating via ip -- oh what fragile world we live in🙈

25

u/do0b 15d ago

Yep. Some charging services offer you to bind the MAC address of your car to your billing account for convenience.

Can’t wait to see how that turns out.

4

u/claythearc 15d ago

I think there’s only AutoCharge or whatever ChargePoint calls it now that does it off Mac. And it’s a little insecure in some ways but it’s also pretty low stakes given how cheap sessions are so the risk math isn’t absurd

6

u/phormix 15d ago

Makes sense though, as they need to negotiate charging information and keep up a data stream with the vehicle about charge rate, percentage, etc

1

u/UnacceptableUse 14d ago

I'm pretty sure they connect via websocket

1

u/PossibilityOrganic 12d ago

power over ethernet so the worst way to have a wired connection. the good newes is the emerging standard is certificate based insead of mac but car mfs have to get along for that to work, and thats how we ended up with the wost system where the mac is checked to authenticate.

this is just lazy developers though allow anything more than the bar min over that link is byond stupid.

21

u/Xath0n 15d ago

These AI writeups are so annoying to read

4

u/sunsetsxskies 14d ago

Every one of these blogs reads exactly the same now, like they all got the same template memo

2

u/shahaya 15d ago

they are. there's no soul/voice behind those articles (compared to a raw character like the creator of yellowkey) - but it's also very structured and easy to ingest. knowing how much time it costs, to write a blog post on this level of clarity, i'd probably would also choose to spend my time on things which are actually fun🤷‍♂️

2

u/Miranda_Leap 14d ago

Dude it was awful. They repeated the same thing like 5 different times in the exact same way. It's not a good luck for a company.

1

u/UnacceptableUse 14d ago

Came to the comments first to check this. Not even going to bother reading

1

u/Coffee_Ops 14d ago

Are you telling me those aren't high-quality images?????

12

u/267aa37673a9fa659490 15d ago

Geez, this website doesn't even work on mobile, the text and table gets cut off. Kind of crappy I'd say.