Electric cars: Security flaws could let attackers control charging stations
Electric car drivers could find themselves unable to charge their vehicles, if attackers exploit recently discovered flaws in Schneider Electric's EVlink Parking charging stations, found in offices, hotels, and supermarkets across several countries.
Featured
Security experts Vladimir Kononovich and Vyacheslav Moskvin at Positive Technologies are now offering details of the three vulnerabilities they found that led to the energy-management company issuing a security notification on December 20.
Schneider Electric is urging its customers to install new firmware on the charging stations, if the current one is version 3.2.0-12_v1 or earlier. It also said users could "set up a firewall to block remote/external access except by authorized users" to reduce the risk of an attack.
Of the three vulnerabilities, one is critical, one high risk, and the third is rated medium.
The critical vulnerability, CVE-2018-7800, is tied to a hard-coded credential bug that could enable attackers to gain access to the charging station with maximum privileges.
The hacker could access the station's web interface and send commands to control the charging process. It could, for instance, stop a car from charging, but it could also switch on the reservation mode of the charging station, rendering it inaccessible to customers.
In addition, the researchers say a malicious actor could unlock the cable during the charging of a car by manipulating the socket locking hatch, allowing a thief to walk away with the cable.
The second vulnerability, CVE-2018-7801, is rated high risk. This code-injection vulnerability allows remote attackers to execute arbitrary code and obtain unauthorized access with maximum privileges.
SEE: Tech and the future of transportation (ZDNet special report) | Download the report as a PDF (TechRepublic)
Attackers could also manage the OS directly, performing actions such as adding new users, changing files and configurations, and adding backdoors and other modifications not detectable or fixable though standard means.
The third, CVE-2018-7802, is an SQL injection vulnerability that could enable an attacker to bypass authorization and gain access to the station's web interface with full privileges.
"Exploitation of these vulnerabilities may lead to serious consequences," said Paolo Emiliani, industry and SCADA research analyst at Positive Technologies. "Attackers can actually block electric car charging and cause serious damage to the energy industry."
Security researchers sent Schneider Electric the details regarding the vulnerabilities they found in May 2018.
Moscow-headquartered Positive Technologies has been analyzing the security of Schneider Electric products for several years. It has helped the energy-management company find bugs in industrial process automation systems and APC uninterruptible power sources.
ZDNet has contacted Schneider Electric for comment and will update this article if it receives a response.
Previous and related coverage
Schneider Electric launches fast charger for electric vehicles
The EVlink DC Quick Charger joins a growing portfolio of EV chargers designed to provide up to 80 percent of a battery's charger in a half-hour or less.
Singapore utility group rolls out first batch of electric vehicle charging points
SP Group has launched its 38 charging points at eight locations across the island, that use a mix of 50kW direct current and 43kW alternating current, as part of its plans to build a network of 1,000 charging points by 2020.
Volkswagen snaps up stake in EV charging tech firm Hubject
The automaker is betting big on new technologies to put old scandals to rest.
The new commute: How driverless cars, hyperloop, and drones will change our travel plans TechRepublic
Transportation is about to get a technology-driven reboot. The details are still taking shape, but future transport systems will certainly be connected, data-driven and highly automated.
The new commute: How driverless cars, hyperloop, and drones will change our travel plans CNET
Transportation is about to get a technology-driven reboot. The details are still taking shape, but future transport systems will certainly be connected, data-driven and highly automated.