1 00:00:47,040 --> 00:00:48,960 Buenos Dias to our friends in Mexico. 2 00:00:48,960 --> 00:00:52,960 Welcome to cyber security under pressure, real attacks, real 3 00:00:52,960 --> 00:00:55,640 lessons. Today is Wednesday, July 1st, 4 00:00:55,800 --> 00:00:58,440 2026. And it is quite the Wednesday. 5 00:00:58,440 --> 00:00:59,840 We've got a lot to get through today. 6 00:01:00,000 --> 00:01:02,680 What happens when the technical detail meets the boardroom 7 00:01:02,680 --> 00:01:05,640 reality? This story answers that as we 8 00:01:05,640 --> 00:01:08,720 dive into ransomware and industrial control systems, 9 00:01:09,160 --> 00:01:12,640 specifically the vulnerabilities in EV charging systems. 10 00:01:12,720 --> 00:01:14,560 Yeah. It's honestly it's a topic that 11 00:01:14,560 --> 00:01:16,560 keeps me up at night. I mean, I've got my coffee. 12 00:01:16,560 --> 00:01:19,160 Here it is the middle of the week and we are basically 13 00:01:19,160 --> 00:01:23,280 looking down the barrel of a massive impending crisis and 14 00:01:23,280 --> 00:01:25,120 frankly, most of the world doesn't even realize it's 15 00:01:25,120 --> 00:01:27,680 happening right in their local supermarket parking lot. 16 00:01:27,680 --> 00:01:29,440 Exactly. I mean, if you drove to work 17 00:01:29,440 --> 00:01:31,520 today, you probably passed, what, three or four of these 18 00:01:31,520 --> 00:01:32,600 machines? Oh, easily. 19 00:01:32,920 --> 00:01:35,880 And you probably think of them as, you know, nothing more than 20 00:01:35,880 --> 00:01:38,720 futuristic gas pumps. Just a place to plug in. 21 00:01:39,120 --> 00:01:43,640 But we are digging into a stack of intelligence today that 22 00:01:43,640 --> 00:01:46,840 paints a very different, very dark picture. 23 00:01:46,920 --> 00:01:49,040 Yeah, a much more complicated picture for sure. 24 00:01:49,280 --> 00:01:52,400 Right, we've got threat landscape reports from Vicone, 25 00:01:52,680 --> 00:01:56,680 The absolute bombshell findings from Pune to Own Automotive 26 00:01:56,680 --> 00:02:01,520 2026, research from the NICs lab on anomaly detection, and a 27 00:02:01,520 --> 00:02:05,640 really deep critical look into the IEC and ISO compliance 28 00:02:05,640 --> 00:02:07,640 standards. Right, the standards that are 29 00:02:08,720 --> 00:02:10,280 supposedly keeping all this safe. 30 00:02:10,320 --> 00:02:12,840 Exactly. So our mission today is to 31 00:02:12,840 --> 00:02:15,920 understand why the electric vehicle charging network, this 32 00:02:15,920 --> 00:02:18,680 entire foundation we are building our future mobility on, 33 00:02:19,000 --> 00:02:22,800 is essentially a massive unprotected attack surface. 34 00:02:22,880 --> 00:02:24,960 It really is the ultimate midweek reality check. 35 00:02:24,960 --> 00:02:27,360 Yeah, I mean, you look at an EV charger out in the parking lot 36 00:02:27,560 --> 00:02:29,520 and you just see a sophisticated extension cord. 37 00:02:29,600 --> 00:02:31,280 Yeah, a box with a cable. That's it. 38 00:02:31,320 --> 00:02:33,320 Right. But when you start peeling back 39 00:02:33,320 --> 00:02:36,520 the layers of the architecture, you realize it is a deeply 40 00:02:36,520 --> 00:02:39,200 complex computing node. And it's know that we are 41 00:02:39,200 --> 00:02:42,000 deploying with a terrifying lack of centralized security 42 00:02:42,000 --> 00:02:43,320 governance. So let's start right there, 43 00:02:43,320 --> 00:02:45,720 because I think the fundamental illusion we need to shatter for 44 00:02:45,720 --> 00:02:48,880 you today is exactly that, the idea that an EV charger is just 45 00:02:48,880 --> 00:02:50,400 an electrical outlet. It's really not. 46 00:02:50,400 --> 00:02:52,400 Not even close. According to the Vicone 47 00:02:52,400 --> 00:02:56,320 intelligence reports, an EV charger actually sits at a 48 00:02:56,320 --> 00:03:00,440 highly complex, completely unique three-way intersection. 49 00:03:00,720 --> 00:03:04,720 You have cloud software on one side, operational technology or 50 00:03:04,720 --> 00:03:08,120 OT on the other, and then the automotive systems themselves. 51 00:03:08,720 --> 00:03:11,840 Intersection is precisely where the danger lies, honestly, 52 00:03:11,840 --> 00:03:14,440 because you have 3 entirely different engineering 53 00:03:14,440 --> 00:03:17,800 philosophies basically colliding in a single piece of hardware. 54 00:03:17,800 --> 00:03:19,880 Which sounds like a recipe for disaster. 55 00:03:20,080 --> 00:03:21,480 Oh, it is. Let me break that down for you. 56 00:03:21,600 --> 00:03:25,160 You have the IT domain which is your cloud software, your 57 00:03:25,160 --> 00:03:27,240 payment gateways, your mobile apps. 58 00:03:27,320 --> 00:03:29,040 Right, the stuff we interact with on our phones. 59 00:03:29,040 --> 00:03:31,640 Exactly. Then you have the OT domain, the 60 00:03:31,680 --> 00:03:34,400 operational technology. This is the heavy physical 61 00:03:34,400 --> 00:03:36,560 stuff. We're talking high voltage power 62 00:03:36,560 --> 00:03:39,440 electronics, the internal cooling systems, the physical 63 00:03:39,440 --> 00:03:41,640 grid interfaces, the. Stuff that actually moves the 64 00:03:41,640 --> 00:03:44,120 electricity, yeah. And finally, you have the 65 00:03:44,120 --> 00:03:47,320 automotive domain, the vehicle itself, which is essentially 66 00:03:47,320 --> 00:03:50,160 just a rolling data center communicating via internal 67 00:03:50,160 --> 00:03:52,520 canvases. But the engineers who designed 68 00:03:52,520 --> 00:03:54,760 those three systems, they don't really talk to each other, do 69 00:03:54,760 --> 00:03:56,880 they? No, and that is the core 70 00:03:56,880 --> 00:03:59,640 vulnerability. Each of those domains has its 71 00:03:59,640 --> 00:04:03,800 own legacy, its own specialized tooling, and, most dangerously, 72 00:04:04,000 --> 00:04:07,040 its own dedicated team of professionals who are all 73 00:04:07,120 --> 00:04:09,560 silently assuming that someone, someone else is handling the 74 00:04:09,560 --> 00:04:12,040 broader security risk. Oh wow, so they're all just 75 00:04:12,040 --> 00:04:14,480 passing the buck without realizing it Pretty much. 76 00:04:14,880 --> 00:04:16,920 The IT team is securing the web back end. 77 00:04:16,920 --> 00:04:19,040 Assuming the physical cabinet is tamper proof. 78 00:04:19,440 --> 00:04:23,120 The OT engineers are entirely focused on, you know, preventing 79 00:04:23,120 --> 00:04:25,000 physical fires and ensuring power up time. 80 00:04:25,400 --> 00:04:27,120 They assume the software is locked down. 81 00:04:27,200 --> 00:04:29,800 And the automotive manufacturer is heavily focused on the 82 00:04:29,800 --> 00:04:33,160 security of the vehicle itself, often treating the charger as 83 00:04:33,160 --> 00:04:35,880 just some external third party edge case. 84 00:04:35,920 --> 00:04:37,760 Right. And that gap, that operational 85 00:04:37,760 --> 00:04:41,000 blind spot where the 3 domains overlap without a unified 86 00:04:41,000 --> 00:04:44,120 security architect, is exactly where adversaries are setting up 87 00:04:44,120 --> 00:04:45,920 camp. OK, let's unpack this. 88 00:04:46,000 --> 00:04:48,800 It sounds like we are building the world's most complex digital 89 00:04:48,800 --> 00:04:52,800 bank vault, but placing it in an unlit parking lot where the IT 90 00:04:52,880 --> 00:04:55,920 guy, the security guard and the bank manager are all pointing 91 00:04:55,920 --> 00:04:57,920 fingers at each other about who locked the door. 92 00:04:58,160 --> 00:04:59,520 That is the perfect way to put it. 93 00:04:59,880 --> 00:05:02,880 And what's fascinating here is this isn't a simulation. 94 00:05:03,000 --> 00:05:05,360 It's not an academic exercise. Right, this is happening right 95 00:05:05,360 --> 00:05:07,600 now. Yes, these are real devices 96 00:05:07,600 --> 00:05:09,240 deployed out in the real world world today. 97 00:05:09,600 --> 00:05:13,240 And what makes that dynamic so terrifying is the sheer scale of 98 00:05:13,240 --> 00:05:15,360 the deployment. We aren't talking about some 99 00:05:15,360 --> 00:05:18,640 niche pilot program anymore. This is critical national 100 00:05:18,640 --> 00:05:20,800 infrastructure. Yeah, the numbers in these 101 00:05:20,800 --> 00:05:23,360 reports are staggering. Just looking at the United 102 00:05:23,360 --> 00:05:26,440 States, we are deploying these chargers at an unprecedented 103 00:05:26,440 --> 00:05:31,480 scale. There are 192,000 public ports 104 00:05:31,480 --> 00:05:35,560 active today, and there's a federal mandate to hit 500,000 105 00:05:35,560 --> 00:05:36,800 by 2030. Think about. 106 00:05:36,800 --> 00:05:38,320 That for a second-half a million. 107 00:05:38,360 --> 00:05:41,000 Right half a million of these three-way intersections 108 00:05:41,000 --> 00:05:45,120 scattered across mall parking lots, along isolated highways in 109 00:05:45,120 --> 00:05:48,160 residential complexes and then against that backdrop of a 110 00:05:48,160 --> 00:05:51,440 massive hurried roll out, you have what happened in Tokyo this 111 00:05:51,440 --> 00:05:55,240 past January. PB own Automotive 2026. 112 00:05:55,240 --> 00:05:57,160 Oh man, that event was a watershed moment. 113 00:05:57,440 --> 00:05:59,880 It fundamentally changed the conversation in the industry. 114 00:06:00,160 --> 00:06:03,520 For anyone who isn't steeped in the cybersecurity world, Pun to 115 00:06:03,520 --> 00:06:07,200 own is this massive hacking competition where the best 116 00:06:07,200 --> 00:06:09,320 security researchers on the planet that gather to 117 00:06:09,320 --> 00:06:11,600 demonstrate 0 day vulnerabilities. 118 00:06:11,640 --> 00:06:13,720 Right. And just to clarify, a zero day 119 00:06:13,720 --> 00:06:17,680 is a flaw that the manufacturer has absolutely no idea exists, 120 00:06:17,880 --> 00:06:19,600 meaning there's zero time to patch it. 121 00:06:19,600 --> 00:06:22,560 The door is just wide open. And Tokyo was an absolute 122 00:06:22,560 --> 00:06:26,480 bloodbath for EV chargers. Over three days, researchers 123 00:06:26,480 --> 00:06:30,000 discovered 76 unique zero day vulnerabilities across the 124 00:06:30,000 --> 00:06:34,040 entire automotive spectrum. The organizers awarded over $1 125 00:06:34,040 --> 00:06:37,360 million in prize money. It was wild to watch. 126 00:06:37,360 --> 00:06:40,080 But the statistic that should really make your blood run cold 127 00:06:40,080 --> 00:06:43,600 is that more than 55% of all the PN 2 own automotive exploits 128 00:06:43,840 --> 00:06:47,000 targeted EV chargers. We are talking about successful 129 00:06:47,000 --> 00:06:50,960 complete system takeovers across nine major brands. 130 00:06:51,040 --> 00:06:53,440 And you have to understand the methodology here because the 131 00:06:53,440 --> 00:06:57,000 researchers proved that the attacker doesn't need to, you 132 00:06:57,000 --> 00:07:00,000 know, hack the car in the classic Hollywood sense anymore. 133 00:07:00,000 --> 00:07:02,240 Like breaking into the car's internal computer system 134 00:07:02,240 --> 00:07:03,440 directly. Right. 135 00:07:03,440 --> 00:07:06,440 You don't need to break into the vehicle's internal network 136 00:07:06,440 --> 00:07:09,040 directly, which is actually quite difficult these days 137 00:07:09,040 --> 00:07:12,720 because auto manufacturers have spent the last decade really 138 00:07:12,720 --> 00:07:15,280 hardening those systems. You just need to target the 139 00:07:15,280 --> 00:07:18,120 charger management interface. Because the charger isn't just 140 00:07:18,120 --> 00:07:21,240 delivering electricity, I mean it's establishing a high speed 141 00:07:21,240 --> 00:07:24,040 data connection with the car the second you plug it in. 142 00:07:24,200 --> 00:07:26,760 Exactly. The charger is a node in an 143 00:07:26,760 --> 00:07:29,360 ecosystem. It talks to the car to negotiate 144 00:07:29,360 --> 00:07:32,200 battery charging rates. It talks to your driver's mobile 145 00:07:32,200 --> 00:07:34,720 app to authorize a session. Right, it's handling the 146 00:07:34,720 --> 00:07:37,440 financial side too. Yes, it communicates with the 147 00:07:37,440 --> 00:07:40,720 banking network to process those payments, and it communicates 148 00:07:40,720 --> 00:07:43,320 with the national power grid to manage load. 149 00:07:44,320 --> 00:07:47,480 Because it touches all those things, a vulnerability in the 150 00:07:47,480 --> 00:07:50,080 charger becomes the ultimate pivot point. 151 00:07:50,080 --> 00:07:52,560 So if I can compromise the charger, I can potentially 152 00:07:52,560 --> 00:07:55,720 manipulate the charging signal being sent to the vehicle to 153 00:07:55,760 --> 00:07:58,680 cause like physical battery degradation. 154 00:07:58,960 --> 00:08:02,800 Or you can scrape the payment data of every single user who 155 00:08:02,800 --> 00:08:06,160 plugs in after you. Or honestly, worst of all, you 156 00:08:06,160 --> 00:08:09,440 can use the Chargers trusted connection to send spoofed 157 00:08:09,440 --> 00:08:12,680 commands back up into the cloud management system of the 158 00:08:12,680 --> 00:08:14,880 charging network operator. Wow. 159 00:08:15,280 --> 00:08:18,080 So we've designed the Charger to be trusted by every other system 160 00:08:18,080 --> 00:08:20,240 it touches, making it the perfect Trojan horse. 161 00:08:20,240 --> 00:08:22,400 Exactly. The trust is the vulnerability. 162 00:08:22,400 --> 00:08:26,280 So we have this massive macro scale problem of 500,000 ports, 163 00:08:26,320 --> 00:08:29,400 but let's zoom in. I want to talk about the actual 164 00:08:29,400 --> 00:08:32,360 physical box sitting in the rain in a parking lot. 165 00:08:32,760 --> 00:08:34,880 How are these attackers actually getting in? 166 00:08:34,880 --> 00:08:36,760 Yeah, let's look at the actual attacks. 167 00:08:36,840 --> 00:08:39,360 Because when you think of a cyber attack, you usually 168 00:08:39,360 --> 00:08:42,120 picture a guy in a hoodie in a basement in Eastern Europe 169 00:08:42,120 --> 00:08:44,280 bypassing firewalls over the Internet. 170 00:08:44,680 --> 00:08:48,120 But the V cone intelligence outlines attack vectors that are 171 00:08:48,240 --> 00:08:52,160 aggressively physical and local. It is the dark irony of 172 00:08:52,160 --> 00:08:54,720 convenience. We have designed these systems 173 00:08:54,720 --> 00:08:57,640 to be as frictionless as possible for you, the consumer. 174 00:08:57,880 --> 00:09:00,240 We want you to be able to just drive up, tap your phone and 175 00:09:00,240 --> 00:09:02,000 walk away. Which is great when it works. 176 00:09:02,240 --> 00:09:05,560 Sure, but in creating that seamless experience, we've 177 00:09:05,560 --> 00:09:09,040 basically handed attackers their entry vectors on a silver 178 00:09:09,040 --> 00:09:11,160 platter. Take Near Field Communication or 179 00:09:11,200 --> 00:09:13,600 NFC for example. Right, the tap to pay feature. 180 00:09:13,600 --> 00:09:16,000 We use it constantly. You tap your phone to buy 181 00:09:16,000 --> 00:09:20,240 coffee, to get on the subway, and now to authorize a charging 182 00:09:20,240 --> 00:09:22,360 session. Well, at Pune to own, the 183 00:09:22,360 --> 00:09:26,040 Synactive team demonstrated a completely novel attack against 184 00:09:26,040 --> 00:09:29,400 the Autel Massey charger. Using exactly that interface. 185 00:09:29,920 --> 00:09:34,320 They used a simple NFC tap to exploit the charger via a stack 186 00:09:34,320 --> 00:09:37,520 based buffer overflow. Wait, wait, so an attacker can 187 00:09:37,520 --> 00:09:40,880 literally walk up, tap their phone like they're buying a cup 188 00:09:40,880 --> 00:09:43,960 of coffee, and rewrite the firmware because someone left a 189 00:09:43,960 --> 00:09:45,840 buffer overflow in the payment parser? 190 00:09:45,840 --> 00:09:47,560 Yes. Yeah, that is exactly what 191 00:09:47,560 --> 00:09:48,560 happened. It's that simple. 192 00:09:48,560 --> 00:09:51,360 That's terrifying. It really is, and to understand 193 00:09:51,360 --> 00:09:53,600 why that's so devastating, you need to understand what buffer 194 00:09:53,600 --> 00:09:56,680 overflow actually is. When you tap your phone, it 195 00:09:56,680 --> 00:09:59,000 sends a packet of data to the charger, things like your 196 00:09:59,000 --> 00:10:02,600 payment token or user ID, right? The charger software allocates a 197 00:10:02,600 --> 00:10:06,880 specific fixed amount of memory, a buffer to hold that incoming 198 00:10:06,880 --> 00:10:09,160 data while it reads it. So for anyone trying to 199 00:10:09,160 --> 00:10:12,160 visualize this, it's like pouring a glass of water into a 200 00:10:12,160 --> 00:10:15,120 shot glass. The shot glass is the memory 201 00:10:15,120 --> 00:10:18,800 buffer designed for a tiny standard NFC payment token. 202 00:10:18,920 --> 00:10:21,840 Precisely, And if the software doesn't check the size of the 203 00:10:21,840 --> 00:10:25,320 data before accepting it, which is by the way a classic flaw in 204 00:10:25,320 --> 00:10:28,760 CNC plus plus programming languages often used in these 205 00:10:28,760 --> 00:10:32,920 embedded systems, the attacker can send a massive oversized 206 00:10:32,920 --> 00:10:35,480 packet of data. Right, so the water overflows 207 00:10:35,480 --> 00:10:37,720 the shot glass. Yes, it spills over into the 208 00:10:37,720 --> 00:10:41,800 adjacent memory space, Yeah, but in a computer, that adjacent 209 00:10:41,800 --> 00:10:45,240 memory space contains the actual executing code of the operating 210 00:10:45,240 --> 00:10:48,200 system. So the attacker overflights the 211 00:10:48,200 --> 00:10:50,800 buffer, overwrites the legitimate instructions with 212 00:10:50,800 --> 00:10:53,400 their own malicious code, and suddenly the charger is 213 00:10:53,400 --> 00:10:55,240 following the attacker's commands instead of the 214 00:10:55,240 --> 00:10:56,920 manufacturers. Yes, exactly. 215 00:10:57,200 --> 00:11:00,560 And Trend AI Zero Day Initiative noted this was a massive first 216 00:11:00,560 --> 00:11:03,480 for public demonstrations. They triggered full code 217 00:11:03,480 --> 00:11:06,160 execution that fundamentally altered the charger's output 218 00:11:06,160 --> 00:11:08,840 behavior just by tapping A modified phone against the 219 00:11:08,840 --> 00:11:11,400 plastic. NFC was designed strictly as a 220 00:11:11,400 --> 00:11:14,760 consumer convenience feature. It was never intended to be, and 221 00:11:14,760 --> 00:11:17,720 obviously wasn't treated as a hardened security boundary. 222 00:11:18,520 --> 00:11:21,560 The system just implicitly trusted whatever data format 223 00:11:21,560 --> 00:11:24,520 came from the NFC reader. That is deeply unsettling. 224 00:11:24,680 --> 00:11:27,800 It requires absolutely zero network access. 225 00:11:28,000 --> 00:11:30,520 Someone could literally be walking their dog past the 226 00:11:30,520 --> 00:11:33,840 charger, tack a custom built device disguised as a phone 227 00:11:33,840 --> 00:11:37,200 against the reader and keep walking, leaving a completely 228 00:11:37,200 --> 00:11:40,640 compromised malicious node behind them to infect the next 229 00:11:40,640 --> 00:11:42,840 car that plugs in. It's the ultimate drive by, 230 00:11:42,840 --> 00:11:45,120 attack or walk by. Attack, I guess, right? 231 00:11:45,360 --> 00:11:48,080 But the VACUUM report shows that wasn't even the only local 232 00:11:48,080 --> 00:11:51,160 attack. Team 299 went after the Grizzly 233 00:11:51,160 --> 00:11:54,280 Smart 40 amp charger and they didn't even need to bother with 234 00:11:54,280 --> 00:11:56,680 writing a complex buffer overflow, they just used hard 235 00:11:56,680 --> 00:12:01,000 coded credentials. Yes, CWE 798 for those tracking 236 00:12:01,000 --> 00:12:04,360 the technical classifications in the on my reframe work, the use 237 00:12:04,360 --> 00:12:07,120 of hard coded credentials. It is a persistent, 238 00:12:07,200 --> 00:12:10,320 embarrassing, industry wide plague in embedded systems. 239 00:12:10,320 --> 00:12:11,800 So what exactly are they doing there? 240 00:12:12,040 --> 00:12:15,240 Well, manufacturers will build a device and leave a default 241 00:12:15,240 --> 00:12:18,680 username and password hard coded directly into the firmware 242 00:12:18,680 --> 00:12:21,120 source code. Like the classic admin and 243 00:12:21,120 --> 00:12:24,720 password 123 buried in the code. Why do they even do that? 244 00:12:24,880 --> 00:12:28,360 They do it to make maintenance or initial provisioning easier 245 00:12:28,360 --> 00:12:31,360 for their own technicians. They think you know if a PEC is 246 00:12:31,360 --> 00:12:33,360 standing in front of the box in the freezing rain. 247 00:12:33,560 --> 00:12:36,360 We want them to be able to log in easily without calling a help 248 00:12:36,360 --> 00:12:39,080 desk to authenticate. So they bake a universal 249 00:12:39,080 --> 00:12:41,800 backdoor into the device out of sheer laziness. 250 00:12:41,800 --> 00:12:45,720 Basically so team 299 extracted the firmware, found these 251 00:12:45,720 --> 00:12:48,400 credentials and use them to bypass the chargers 252 00:12:48,400 --> 00:12:50,440 authentication completely. But they didn't stop there, 253 00:12:50,440 --> 00:12:51,640 right? No they didn't. 254 00:12:52,040 --> 00:12:54,840 They chained that access with another vulnerability classified 255 00:12:54,840 --> 00:12:59,120 as CW 494, which is the downloading of code without an 256 00:12:59,120 --> 00:13:01,240 integrity check. OK, let me break that down for 257 00:13:01,240 --> 00:13:03,400 you. Listening normally, if a device 258 00:13:03,400 --> 00:13:07,480 downloads a software update, it uses cryptography to verify that 259 00:13:07,480 --> 00:13:09,480 the update actually came from the manufacturer. 260 00:13:09,800 --> 00:13:13,080 It checks the digital signature. Right, but the Grizzly didn't do 261 00:13:13,080 --> 00:13:16,040 that. So Team 299 used the hard coded 262 00:13:16,040 --> 00:13:19,400 password to get admin access and then simply told the charger to 263 00:13:19,400 --> 00:13:21,720 download and run a malicious firmware file. 264 00:13:21,840 --> 00:13:24,320 And the charger just did it. The charger just blindly 265 00:13:24,320 --> 00:13:27,080 accepted it and ran it without ever verifying if the code was 266 00:13:27,080 --> 00:13:28,960 mathematically signed by the manufacturer. 267 00:13:28,960 --> 00:13:31,640 Wow. And the Vicone analysis points 268 00:13:31,640 --> 00:13:33,280 out the terrifying reality of this. 269 00:13:34,000 --> 00:13:37,920 If you find a hard coded credential on one charger, you 270 00:13:37,920 --> 00:13:41,560 haven't just compromised that single unit, you've compromised 271 00:13:41,560 --> 00:13:45,080 the entire global fleet. Because it's the exact same code 272 00:13:45,080 --> 00:13:46,600 on every box. Exactly. 273 00:13:46,920 --> 00:13:50,280 The manufacturer flashes the exact same firmware image with 274 00:13:50,280 --> 00:13:53,760 the exact same hard coded password onto thousands of 275 00:13:53,760 --> 00:13:55,800 devices rolling off the assembly line. 276 00:13:56,000 --> 00:13:58,960 It is the definition of a highly scalable attack. 277 00:13:59,360 --> 00:14:03,720 These pans aren't deep, complex cryptographic breaks that take 278 00:14:03,720 --> 00:14:06,880 super for computers to crack. They are legitimate, intentional 279 00:14:06,880 --> 00:14:10,120 design choices, convenience features for consumers, and 280 00:14:10,120 --> 00:14:12,920 maintenance backdoors for technicians that become highly 281 00:14:12,920 --> 00:14:15,840 viable attack paths because they are trusted too broadly without 282 00:14:15,840 --> 00:14:18,640 any secondary validation. I want to pivot slightly because 283 00:14:18,640 --> 00:14:22,200 we also have to mention the purely user facing vectors. 284 00:14:22,800 --> 00:14:27,240 The ingenuity of cyber criminals when it comes to simple low tech 285 00:14:27,240 --> 00:14:31,680 fraud is always astounding. The intelligence reports detail 286 00:14:31,680 --> 00:14:34,560 a massive rise in a technique called Cushing. 287 00:14:34,840 --> 00:14:38,120 Cushing is brilliant in its absolute simplicity. 288 00:14:38,560 --> 00:14:41,760 It's phishing but utilizing fake QR codes. 289 00:14:41,960 --> 00:14:45,200 Think about your own experience. You pull up to a charger. 290 00:14:45,240 --> 00:14:48,000 Maybe the digital screen is broken, or the interface is 291 00:14:48,000 --> 00:14:51,040 confusing, or there's just a giant sticker right next to the 292 00:14:51,040 --> 00:14:53,720 screen that says scan here to pay quickly. 293 00:14:53,760 --> 00:14:56,920 And someone has simply printed out a highly realistic looking 294 00:14:56,920 --> 00:15:00,280 sticker with a malicious QR code and slapped it right over the 295 00:15:00,280 --> 00:15:02,200 legitimate 1. Right, You scan it with your 296 00:15:02,200 --> 00:15:05,320 phone, and your browser opens a website that looks exactly Pixel 297 00:15:05,320 --> 00:15:07,960 for Pixel, like the charging operator's official payment 298 00:15:07,960 --> 00:15:09,640 portal. You punch in your credit card 299 00:15:09,640 --> 00:15:12,040 details, maybe your billing address, and hit submit. 300 00:15:12,320 --> 00:15:14,480 The attacker harvests all that data instantly. 301 00:15:14,520 --> 00:15:17,040 They might even seamlessly forward you to the real payment 302 00:15:17,040 --> 00:15:19,080 page afterwards so you never suspect a thing. 303 00:15:19,240 --> 00:15:22,680 It requires 0 technical hacking of the chargers internal 304 00:15:22,680 --> 00:15:24,800 hardware. The attacker doesn't need to 305 00:15:24,800 --> 00:15:27,440 know C++ or understand buffer overflows. 306 00:15:27,760 --> 00:15:29,880 They just need 20 bucks for a label maker. 307 00:15:30,040 --> 00:15:32,760 Yet it completely destroys consumer trust in the 308 00:15:32,760 --> 00:15:36,440 infrastructure and alongside that you have crude physical 309 00:15:36,440 --> 00:15:38,760 tampering. Like prying open the box. 310 00:15:38,760 --> 00:15:42,040 Yeah, many of these charging cabinets have exposed USB, 311 00:15:42,040 --> 00:15:45,920 serial or debug interfaces located right behind a thin, 312 00:15:45,960 --> 00:15:49,120 cheap plastic panel. If a manufacturing technician 313 00:15:49,120 --> 00:15:52,480 leaves a debug port enabled in the production firmware, it 314 00:15:52,480 --> 00:15:54,680 happens constantly because they just forget to turn it off 315 00:15:55,120 --> 00:15:57,280 before shipping. An attacker can literally just 316 00:15:57,480 --> 00:15:59,120 pry the panel open with a screwdriver. 317 00:15:59,120 --> 00:16:00,440 Stop it right off. Exactly. 318 00:16:00,680 --> 00:16:04,160 They plug in a laptop and they own the internal file system of 319 00:16:04,160 --> 00:16:06,240 the device. So if the hardware is 320 00:16:06,240 --> 00:16:09,960 fundamentally this flawed, if a guy can just print a sticker or 321 00:16:09,960 --> 00:16:12,920 tap his phone or Bry, open a plastic door and plug into an 322 00:16:12,920 --> 00:16:17,280 exposed USB port, how on earth are these devices legally 323 00:16:17,280 --> 00:16:19,480 allowed to be installed on city streets? 324 00:16:19,600 --> 00:16:22,720 That's the $1,000,000 question. Because whenever you talk to the 325 00:16:22,720 --> 00:16:25,240 manufacturers about this, they immediately point to the rule 326 00:16:25,240 --> 00:16:26,800 book. They throw their hands up and 327 00:16:26,800 --> 00:16:30,760 say, look at our documentation. We have ISO 1/5 and 118 328 00:16:30,760 --> 00:16:35,120 certification. We have IC 62543 compliance. 329 00:16:35,280 --> 00:16:38,560 We are secure. That is the mantra of the entire 330 00:16:38,560 --> 00:16:40,440 energy and mobility sector right now. 331 00:16:40,440 --> 00:16:43,320 We passed the audit, therefore we are invulnerable. 332 00:16:43,520 --> 00:16:46,920 But the data from P2 own proves that paper compliance is 333 00:16:46,920 --> 00:16:49,800 definitively not operational security. 334 00:16:49,800 --> 00:16:53,080 Not even close. Between 2024 and 2026, 335 00:16:53,080 --> 00:16:56,840 researchers found 96 critical zero day vulnerabilities on 336 00:16:56,840 --> 00:16:59,000 certified, fully compliant products. 337 00:16:59,000 --> 00:17:01,120 A 96? That's insane. 338 00:17:01,120 --> 00:17:03,960 Yeah, these were devices that had all the right stamps of 339 00:17:03,960 --> 00:17:05,839 approval from international auditing bodies. 340 00:17:05,839 --> 00:17:08,800 They've passed all the lab tests, and they were still 341 00:17:08,800 --> 00:17:11,400 ripped to shreds by security researchers in a matter of 342 00:17:11,400 --> 00:17:13,000 minutes on a Convention Center stage. 343 00:17:13,280 --> 00:17:16,640 Let's really look closely at ISO 14118 because that standard is 344 00:17:16,640 --> 00:17:19,000 the absolute backbone of the entire plug and charge 345 00:17:19,079 --> 00:17:21,200 ecosystem. For you listening, the idea of 346 00:17:21,200 --> 00:17:23,480 Plug and charge is this beautiful, seamless future. 347 00:17:23,480 --> 00:17:26,319 It's a great concept in theory. Right, you just plug your car 348 00:17:26,319 --> 00:17:28,480 into the charger. The car and the charger 349 00:17:28,480 --> 00:17:31,240 automatically authenticate each other, your billing is handled 350 00:17:31,240 --> 00:17:33,800 invisibly in the background, and the power flows. 351 00:17:34,240 --> 00:17:37,720 No apps, no credit cards, no QR codes To make that work 352 00:17:37,720 --> 00:17:41,720 securely. ISO 15118 mandates heavy 353 00:17:41,720 --> 00:17:44,120 cryptography. Right, it requires TLS 354 00:17:44,120 --> 00:17:48,600 encryption and a public key infrastructure or PKI for the 355 00:17:48,600 --> 00:17:51,320 vehicle to grid the V2G communications. 356 00:17:51,400 --> 00:17:53,640 It looks completely ironclad on paper. 357 00:17:53,720 --> 00:17:55,920 It relies on a mathematical digital trust chain. 358 00:17:56,400 --> 00:17:58,760 The vehicle holds a cryptographic certificate issued 359 00:17:58,760 --> 00:18:01,320 by the manufacturer. The charging station holds a 360 00:18:01,320 --> 00:18:03,240 certificate issued by the network operator. 361 00:18:03,400 --> 00:18:06,840 When they connect, they perform a digital handshake, verifying 362 00:18:06,840 --> 00:18:08,960 each other's certificates through a trusted central 363 00:18:08,960 --> 00:18:10,800 authority. It sounds perfect, so where does 364 00:18:10,800 --> 00:18:12,720 it break down? Well, what Pinto and revealed 365 00:18:12,720 --> 00:18:15,240 was that the implementation of these standards by the hardware 366 00:18:15,240 --> 00:18:17,640 vendors is often disastrously flawed. 367 00:18:18,080 --> 00:18:20,880 The math of the cryptography is solid, but the way the engineers 368 00:18:20,880 --> 00:18:23,600 write the code to use that math is full of holes. 369 00:18:24,000 --> 00:18:26,360 So the theory is good, the execution is terrible. 370 00:18:26,560 --> 00:18:28,920 Exactly. Researchers were able to 371 00:18:28,920 --> 00:18:31,800 entirely intercept the VG communication channels. 372 00:18:32,160 --> 00:18:34,640 They successfully spoofed commands in transit, a 373 00:18:34,640 --> 00:18:37,560 vulnerability classified as CWE 345. 374 00:18:37,680 --> 00:18:40,480 Wait, if the channel is encrypted with TLS, how are they 375 00:18:40,480 --> 00:18:42,480 intercepting and spoofing commands? 376 00:18:42,480 --> 00:18:45,960 Because of poor key management, if an attacker can extract the 377 00:18:45,960 --> 00:18:49,240 private cryptographic key from the charger's memory, perhaps by 378 00:18:49,240 --> 00:18:52,320 using that exposed debug port or the hard coded credential we 379 00:18:52,320 --> 00:18:54,760 discussed earlier, they can impersonate the charger. 380 00:18:54,760 --> 00:18:56,680 Oh I see. They can decrypt the traffic, 381 00:18:56,920 --> 00:19:00,600 alter a command from the network operator, say changing a stop 382 00:19:00,600 --> 00:19:03,480 charging command to a deliver maximum voltage command, re 383 00:19:03,480 --> 00:19:05,280 encrypt it and send it to the car. 384 00:19:05,360 --> 00:19:07,800 And the car just takes it. The car accepts it because it 385 00:19:07,800 --> 00:19:11,000 was signed with the correct, albeit stolen, private key. 386 00:19:11,160 --> 00:19:15,280 So what does this all mean? If a piece of hardware has a 387 00:19:15,280 --> 00:19:18,120 multi $1,000,000 stamp of approval saying it meets 388 00:19:18,120 --> 00:19:21,120 international cybersecurity standards, but a single 389 00:19:21,120 --> 00:19:23,880 researcher can extract the private keys and spoof the 390 00:19:23,880 --> 00:19:26,920 entire command chain, what is the standard actually 391 00:19:26,920 --> 00:19:28,960 protecting? If we connect this to the bigger 392 00:19:28,960 --> 00:19:32,440 picture, the standards are protecting the theory of the 393 00:19:32,440 --> 00:19:35,840 system, not the messy physical reality of the deployment. 394 00:19:35,840 --> 00:19:37,240 Which is a huge problem. Huge. 395 00:19:37,880 --> 00:19:42,720 Let's look at IEC 62443, which is heavily pushed as the gold 396 00:19:42,720 --> 00:19:45,000 standard for industrial control system security. 397 00:19:45,640 --> 00:19:49,120 It strictly mandates firmware hardening, secure boot processes 398 00:19:49,320 --> 00:19:51,960 and robust authentication for all critical functions. 399 00:19:52,000 --> 00:19:55,680 OK, yet as we just discussed with the Grizzly charger in Team 400 00:19:55,680 --> 00:19:59,160 299, vendors are routinely shipping firmware with hard 401 00:19:59,160 --> 00:20:02,760 coded credentials and update mechanisms that require 0 402 00:20:02,760 --> 00:20:05,360 authentication. Let me push back on that because 403 00:20:05,360 --> 00:20:11,000 it kind of defies logic. If IEC 62443 strictly mandates 404 00:20:11,000 --> 00:20:15,400 secure authentication, how on earth is a box with admin and 405 00:20:15,400 --> 00:20:17,880 password 123 getting a compliance stamp? 406 00:20:17,960 --> 00:20:20,520 It's baffling, right? It sounds like these auditors 407 00:20:20,520 --> 00:20:22,720 are just checking off a paperwork matrix instead of 408 00:20:22,720 --> 00:20:24,800 actually pen testing the live firmware. 409 00:20:24,800 --> 00:20:26,920 You've hit the nail on the head. That is exactly what is 410 00:20:26,920 --> 00:20:28,760 happening. Compliance audits are largely 411 00:20:28,760 --> 00:20:32,400 point in time assessment based on design documentation, not 412 00:20:32,480 --> 00:20:34,840 adversarial penetration testing. So they aren't actually 413 00:20:34,840 --> 00:20:36,560 attacking the device to see if it holds up. 414 00:20:36,720 --> 00:20:39,080 Exactly. An auditor walks into a 415 00:20:39,080 --> 00:20:41,520 conference room, asks the engineering manager. 416 00:20:41,840 --> 00:20:43,720 Do you securely manage passwords? 417 00:20:44,280 --> 00:20:47,720 The manager hands them a 500 page design document that says 418 00:20:48,160 --> 00:20:50,560 yes, passwords are securely managed. 419 00:20:50,840 --> 00:20:53,320 And the auditor just checks a box and moves on, Yes. 420 00:20:53,680 --> 00:20:56,480 They're not pulling the firmware image off a production device, 421 00:20:56,760 --> 00:20:59,600 throwing it into a disassembler, and reverse engineering the 422 00:20:59,600 --> 00:21:01,840 binary code to look for hard coded text strings. 423 00:21:02,000 --> 00:21:03,960 And it gets worse when you look at the automotive side. 424 00:21:03,960 --> 00:21:07,040 The automotive industry has its own standard for cybersecurity. 425 00:21:07,040 --> 00:21:11,400 I so say 21434. It defines rigorous requirements 426 00:21:11,400 --> 00:21:13,640 for a vehicle cybersecurity management system. 427 00:21:14,160 --> 00:21:17,720 Yes, but historically it has frequently excluded the EV 428 00:21:17,760 --> 00:21:20,600 supply equipment, the actual chargers, from its scope 429 00:21:20,600 --> 00:21:24,320 entirely, the automakers argued. We build the car, we secure the 430 00:21:24,320 --> 00:21:26,040 car. The charger is infrastructure. 431 00:21:26,040 --> 00:21:27,520 So that's the energy sector's problem. 432 00:21:27,520 --> 00:21:30,400 So the car is heavily regulated by automotive standards, the 433 00:21:30,400 --> 00:21:33,080 power grid is regulated by energy sector standards, and the 434 00:21:33,080 --> 00:21:36,680 charger itself sits in this vast unregulated Gray area in the 435 00:21:36,680 --> 00:21:37,160 middle. Yep. 436 00:21:38,040 --> 00:21:40,600 The exact spot where all the data and power flows through. 437 00:21:40,800 --> 00:21:44,040 And the consequences of compromising that plug and 438 00:21:44,040 --> 00:21:47,800 charge trust chain in that Gray area are massive. 439 00:21:48,480 --> 00:21:52,040 One of the intelligence reports details that if the V2G PKI is 440 00:21:52,040 --> 00:21:54,560 compromised, you aren't just looking at someone getting a 441 00:21:54,560 --> 00:21:56,120 free charge for their Tesla. Right. 442 00:21:56,120 --> 00:21:58,760 It's way bigger than that. You are looking at widespread 443 00:21:58,760 --> 00:22:02,120 systemic availability. Loss attackers can steal the 444 00:22:02,120 --> 00:22:04,440 charging station certificates on mass. 445 00:22:04,760 --> 00:22:07,400 With those certificates, they can impersonate legitimate 446 00:22:07,400 --> 00:22:10,360 chargers across the network, intercepting payment 447 00:22:10,360 --> 00:22:14,640 authorizations and leading to massive systemic billing fraud 448 00:22:14,880 --> 00:22:17,280 that the operators wouldn't be able to distinguish from 449 00:22:17,280 --> 00:22:19,520 legitimate traffic. And the fundamental reason this 450 00:22:19,520 --> 00:22:22,080 keeps happening is that the industry is using the wrong 451 00:22:22,080 --> 00:22:25,520 mental model for defense. Most Chargepoint operators are 452 00:22:25,520 --> 00:22:27,760 relying on traditional IT security tools. 453 00:22:27,920 --> 00:22:29,360 Like what? What are they using? 454 00:22:29,400 --> 00:22:33,160 They are buying standard firewalls, VPNs, and SIM alert, 455 00:22:33,160 --> 00:22:35,360 security information and event management systems. 456 00:22:35,960 --> 00:22:38,440 Those tools are great for protecting cloud infrastructure 457 00:22:38,440 --> 00:22:42,440 and corporate e-mail, but an IT firewall cannot identify an 458 00:22:42,440 --> 00:22:44,680 embedded firmware risk. Right, it doesn't speak that 459 00:22:44,680 --> 00:22:47,560 language. No, it cannot inspect the 460 00:22:47,560 --> 00:22:51,280 payload of a specialized OCPP protocol message to see if it 461 00:22:51,280 --> 00:22:53,760 contains A maliciously crafted voltage command. 462 00:22:54,560 --> 00:22:58,080 We are treating a complex cyber physical system exactly like a 463 00:22:58,080 --> 00:23:01,440 standard corporate network and it is failing catastrophically. 464 00:23:01,960 --> 00:23:04,480 So we have a scenario where the standards fail and the hardware 465 00:23:04,480 --> 00:23:07,680 is basically wide open. If I'm an advanced attacker, 466 00:23:07,760 --> 00:23:11,480 stealing a single credit card via QR code or getting a free 467 00:23:11,480 --> 00:23:14,920 charge is small time. The real money and the real 468 00:23:14,920 --> 00:23:18,400 terror for an energy executive or a government official comes 469 00:23:18,400 --> 00:23:20,960 when you weaponize that access at scale. 470 00:23:21,240 --> 00:23:23,000 And that's where things get really bleak. 471 00:23:23,120 --> 00:23:25,520 Which brings us to the boardroom, because when you 472 00:23:25,520 --> 00:23:29,800 explain buffer overflows to ACEO, their eyes glaze over, but 473 00:23:29,800 --> 00:23:32,440 they sit straight up when you talk about ransomware, and they 474 00:23:32,440 --> 00:23:35,120 break into a cold sweat when you talk about the national power 475 00:23:35,120 --> 00:23:36,720 grid. Oh yeah, you mentioned the grid 476 00:23:36,720 --> 00:23:38,600 and suddenly everyone is paying attention. 477 00:23:38,800 --> 00:23:41,760 Let's elevate the stakes here. If the devices are inherently 478 00:23:41,760 --> 00:23:44,040 vulnerable, what is the worst case scenario? 479 00:23:44,320 --> 00:23:48,040 The worst case scenario is that we are inadvertently rapidly 480 00:23:48,040 --> 00:23:50,840 building the infrastructure for nationwide blackouts. 481 00:23:51,280 --> 00:23:52,720 Let the math sink in for a minute. 482 00:23:53,400 --> 00:23:56,520 By 20-30, we expect to have 30 million electric vehicles on the 483 00:23:56,520 --> 00:23:59,840 road. 30 million, yes. The charging infrastructure is 484 00:23:59,840 --> 00:24:02,720 rapidly evolving from a niche convenience service into a 485 00:24:02,720 --> 00:24:06,240 critical load bearing layer of the energy grid itself. 486 00:24:06,480 --> 00:24:08,480 So let's start with the immediate financial threat to 487 00:24:08,480 --> 00:24:10,480 the operators. First, ransomware. 488 00:24:10,880 --> 00:24:14,480 We are used to seeing ransomware hit hospitals or oil pipelines, 489 00:24:15,160 --> 00:24:18,800 but station ransomware is becoming a very real, very 490 00:24:18,800 --> 00:24:21,960 profitable attack model. It's highly lucrative. 491 00:24:22,000 --> 00:24:24,560 An adversary doesn't just walk up to lock a single charger. 492 00:24:24,880 --> 00:24:27,680 They use a localized vulnerability to gain an initial 493 00:24:27,680 --> 00:24:29,920 foothold. And then they exploit a flaw in 494 00:24:29,920 --> 00:24:32,040 the Open Chargepoint protocol OCPP. 495 00:24:32,200 --> 00:24:35,080 What does that do exactly? OCPP is the communication 496 00:24:35,080 --> 00:24:37,400 protocol used between the charging station and the Central 497 00:24:37,400 --> 00:24:40,320 Cloud Management System. It's essentially the language 498 00:24:40,320 --> 00:24:43,160 the network uses to say start charging, stop charging, or 499 00:24:43,160 --> 00:24:46,720 update your software. So the attacker rides the OCPP 500 00:24:46,720 --> 00:24:49,960 connection backward, pivoting from the physical charger in the 501 00:24:49,960 --> 00:24:53,040 parking lot up into the Chargepoint operator's central 502 00:24:53,040 --> 00:24:54,880 cloud system. Exactly. 503 00:24:55,160 --> 00:24:58,200 Once they compromise the central management system, they have the 504 00:24:58,200 --> 00:25:01,040 keys to the Kingdom. They can push a malicious 505 00:25:01,040 --> 00:25:05,240 firmware update to every single charger in the operator's fleet 506 00:25:05,240 --> 00:25:07,640 simultaneously. So basically holding the whole 507 00:25:07,640 --> 00:25:09,440 network hostage at once? Yes. 508 00:25:09,840 --> 00:25:13,880 Suddenly on a Tuesday morning, 10,000 chargers across the 509 00:25:13,880 --> 00:25:17,000 country freeze. The digital screens all change 510 00:25:17,000 --> 00:25:19,000 to display a Bitcoin wallet address. 511 00:25:19,440 --> 00:25:22,400 Until the ransom is paid, fleet operations are crippled. 512 00:25:22,520 --> 00:25:26,160 Delivery trucks can't charge, commuters are stranded, and the 513 00:25:26,160 --> 00:25:29,000 operator is bleeding millions of dollars a day in lost revenue, 514 00:25:29,080 --> 00:25:31,560 not to mention the catastrophic reputational damage. 515 00:25:31,600 --> 00:25:34,400 Exactly, but honestly even that is the scariest part. 516 00:25:34,520 --> 00:25:37,000 Right, because it's one thing to have your credit card skimmed. 517 00:25:37,200 --> 00:25:40,080 It's an entirely different Wednesday when a hacker turns 30 518 00:25:40,080 --> 00:25:43,320 million cars into a synchronized weapon to take down the national 519 00:25:43,320 --> 00:25:45,640 power grid. And that is not hyperbole. 520 00:25:46,360 --> 00:25:48,800 We have to look at the research coming out of the NICs lab. 521 00:25:49,440 --> 00:25:52,960 They detail the profound grid impacts of compromised vehicle 522 00:25:52,960 --> 00:25:56,120 to grid sessions. B2G is a technology that allows 523 00:25:56,120 --> 00:25:59,720 cars to not just take power from the grid, but to push power 524 00:25:59,720 --> 00:26:01,960 stored in their massive batteries back into it. 525 00:26:01,960 --> 00:26:04,560 So it acts like a giant decentralized battery. 526 00:26:04,640 --> 00:26:06,600 Right. It's designed to be a buffer, 527 00:26:06,600 --> 00:26:09,800 helping to balance the grid during peak demand times by 528 00:26:09,800 --> 00:26:12,320 using millions of cars as a distributed power plant. 529 00:26:12,520 --> 00:26:15,520 But by doing that, it creates a bi directional coupling between 530 00:26:15,520 --> 00:26:19,720 millions of automotive batteries and the fragile legacy, the 531 00:26:19,720 --> 00:26:23,520 national energy infrastructure, which means the flow of energy 532 00:26:23,520 --> 00:26:25,960 can be weaponized. Precisely to understand the 533 00:26:25,960 --> 00:26:28,280 threat, you need to understand how the power grid works. 534 00:26:28,440 --> 00:26:30,920 The grid operates on a very delicate balance of supply and 535 00:26:30,920 --> 00:26:32,880 demand to maintain frequency stability. 536 00:26:32,920 --> 00:26:34,400 It has to stay balanced at all times. 537 00:26:34,480 --> 00:26:34,920 Right. Yes. 538 00:26:35,120 --> 00:26:38,200 In North America, the grid must operate at exactly 60 Hertz. 539 00:26:38,560 --> 00:26:41,600 If demand suddenly outstrips supply, the frequency drops. 540 00:26:41,880 --> 00:26:44,160 If supply outstrips demand, it spikes. 541 00:26:44,480 --> 00:26:47,440 Large charging operators remotely control hundreds of 542 00:26:47,440 --> 00:26:50,880 thousands of charging notes. Attacker gains control of that 543 00:26:50,880 --> 00:26:53,920 central system. They could remotely switch a 544 00:26:53,920 --> 00:26:56,440 massive percentage of those chargers on and off 545 00:26:56,440 --> 00:26:58,840 simultaneously. Like flipping a giant national 546 00:26:58,840 --> 00:27:02,520 light switch, thousands of megawatts of power instantly 547 00:27:02,520 --> 00:27:04,800 pulling from the grid, then instantly stopping. 548 00:27:05,600 --> 00:27:07,600 And the grid's physical infrastructure, the massive 549 00:27:07,600 --> 00:27:10,840 spinning turbines and power plants, have physical inertia. 550 00:27:11,600 --> 00:27:14,080 They cannot react to instantaneous massive 551 00:27:14,080 --> 00:27:16,080 fluctuations. So what happens if they try? 552 00:27:16,280 --> 00:27:19,360 If you suddenly drop gigawatts of demand and then instantly 553 00:27:19,360 --> 00:27:22,520 spike it back up, you create severe frequency oscillations. 554 00:27:22,960 --> 00:27:25,840 If those imbalances are large enough, they can overwhelm local 555 00:27:25,840 --> 00:27:29,200 substations, cause Transformers to literally overheat and melt, 556 00:27:29,440 --> 00:27:32,600 and trigger protective relays to trip, leading to cascading 557 00:27:32,600 --> 00:27:35,520 nationwide blackouts. The NICs library search even 558 00:27:35,520 --> 00:27:39,160 outlines specific localized physical attacks that don't even 559 00:27:39,160 --> 00:27:41,880 require hacking the network. They detail something and called 560 00:27:41,880 --> 00:27:44,760 the broken wire attack. Broken wire is mechanically 561 00:27:44,760 --> 00:27:48,000 fascinating and terrifying. Researchers prove they could use 562 00:27:48,000 --> 00:27:51,440 targeted electromagnetic interference EMI to wirelessly 563 00:27:51,440 --> 00:27:54,080 disrupt the communication between the vehicle and a rapid 564 00:27:54,080 --> 00:27:56,640 DC fast charger. How does that even work? 565 00:27:56,760 --> 00:27:59,480 The charger in the car communicate over the charging 566 00:27:59,480 --> 00:28:03,280 cable using a specific signaling protocol, often a pulse width 567 00:28:03,280 --> 00:28:06,200 modulation signal. The researchers built a radio 568 00:28:06,200 --> 00:28:08,720 frequency emitter that broadcasts A malicious 569 00:28:08,720 --> 00:28:11,240 overpowering electromagnetic signal nearby. 570 00:28:11,320 --> 00:28:13,520 Like a jammer. Sort of, yes. 571 00:28:14,120 --> 00:28:16,360 The interference corrupts the signal on the wire. 572 00:28:17,000 --> 00:28:19,800 The charger safety systems interpret the corrupted signal 573 00:28:20,120 --> 00:28:24,120 as a critical physical fault, like a severed cable, and it 574 00:28:24,120 --> 00:28:26,880 immediately forces a high voltage charging session to 575 00:28:26,880 --> 00:28:29,400 abort to prevent a fire. They don't even need to touch 576 00:28:29,400 --> 00:28:31,520 the charger. So you could have an attacker in 577 00:28:31,520 --> 00:28:34,960 a van driving slowly through a busy city center, silently 578 00:28:34,960 --> 00:28:38,720 broadcasting this RF signal, shutting down every EV charging 579 00:28:38,720 --> 00:28:42,000 session they pass, completely paralyzing municipal fleets or 580 00:28:42,000 --> 00:28:43,160 electric buses. Exactly. 581 00:28:43,640 --> 00:28:47,720 And the NICs Lab also models the ultimate doomsday scenario, the 582 00:28:47,720 --> 00:28:50,760 threat of an EV botnet. Imagine a scenario where a 583 00:28:50,760 --> 00:28:53,720 malware infection slowly spreads through a specific brand of 584 00:28:53,720 --> 00:28:57,000 charger or a popular third party charging app over months. 585 00:28:57,000 --> 00:28:58,560 So it's just sitting there waiting. 586 00:28:58,840 --> 00:29:01,040 Yes, it doesn't do anything malicious. 587 00:29:01,040 --> 00:29:03,440 At first. The botnet remains dormant, 588 00:29:03,760 --> 00:29:07,120 waiting for a specific trigger. It waits for a moment of peak 589 00:29:07,120 --> 00:29:10,320 grid stress, say the hottest afternoon in late August, with 590 00:29:10,400 --> 00:29:13,520 every air conditioner in the region is maxed out and the grid 591 00:29:13,520 --> 00:29:17,400 is operating at 99% capacity. And then the botnet 592 00:29:17,400 --> 00:29:20,800 simultaneously commands every single infected vehicle to 593 00:29:20,880 --> 00:29:25,040 instantly draw maximum voltage. It's a massive coordinated 594 00:29:25,040 --> 00:29:28,040 denial of service attack, not against the website, but against 595 00:29:28,040 --> 00:29:31,320 the physical power grid itself. The sudden spike in demand would 596 00:29:31,320 --> 00:29:34,240 instantly crash the local grid. And this isn't just hypothetical 597 00:29:34,240 --> 00:29:35,960 anymore. The ENISA Threat Landscape 598 00:29:35,960 --> 00:29:39,240 reports are already flagging energy and transportation as the 599 00:29:39,240 --> 00:29:42,200 two most critical targets for state sponsored cybercrime. 600 00:29:42,800 --> 00:29:45,840 And with EV infrastructure, we are merging those two sectors 601 00:29:45,840 --> 00:29:48,280 electronically for the first time in human history. 602 00:29:48,560 --> 00:29:51,440 I really want you, the listener, to think about the cascading 603 00:29:51,440 --> 00:29:54,280 societal risk here. Mobility is the absolute 604 00:29:54,280 --> 00:29:57,840 lifeblood of the modern economy. It impacts literally everything, 605 00:29:57,960 --> 00:30:00,400 yes. If the charging infrastructure 606 00:30:00,400 --> 00:30:04,920 goes offline or is destroyed by a grid surge, food doesn't get 607 00:30:04,920 --> 00:30:08,080 delivered to supermarkets. Emergency medical personnel 608 00:30:08,080 --> 00:30:10,080 might not be able to deploy their vehicles. 609 00:30:10,600 --> 00:30:13,400 The economic damage of these attacks isn't just the cost of 610 00:30:13,400 --> 00:30:17,000 replacing a ruined charger, it's the total paralysis of a city. 611 00:30:17,560 --> 00:30:21,200 So if the grid is at risk and the vulnerabilities are this 612 00:30:21,200 --> 00:30:24,640 severe, who is actually supposed to be guarding this? 613 00:30:24,800 --> 00:30:27,920 We have the threats, we know the high stakes, we know the 614 00:30:27,920 --> 00:30:30,120 international technical standards are riddled with 615 00:30:30,120 --> 00:30:32,840 loopholes. So who is legally and 616 00:30:32,840 --> 00:30:34,920 operationally responsible for fixing it? 617 00:30:35,160 --> 00:30:38,040 That is the ultimate governance problem defining the entire 618 00:30:38,040 --> 00:30:40,320 industry right now. We have to fundamentally stop 619 00:30:40,320 --> 00:30:42,920 viewing the EV charger. It's just a piece of dumb 620 00:30:42,920 --> 00:30:45,720 infrastructure for mobility. It is conceptually and 621 00:30:45,720 --> 00:30:48,560 technically a trust boundary. And right now, no, absolutely no 622 00:30:48,560 --> 00:30:51,040 one wants to own that boundary. Because owning it means 623 00:30:51,040 --> 00:30:53,560 accepting liability. Think about the convoluted chain 624 00:30:53,560 --> 00:30:55,960 of custody for a single everyday charging session. 625 00:30:56,440 --> 00:30:59,040 You have the vehicle manufactured by an OEM like 626 00:30:59,040 --> 00:31:01,560 Ford, Tesla or Volkswagen. OK, that's one. 627 00:31:01,760 --> 00:31:04,640 You have the physical charger hardware built by a manufacturer 628 00:31:04,640 --> 00:31:08,360 like Ottel, ABB or Chargepoint. You have the Chargepoint 629 00:31:08,360 --> 00:31:11,440 operator managing the physical site and setting the pricing. 630 00:31:11,680 --> 00:31:15,240 You have a massive cloud provider like AWS or Azure 631 00:31:15,520 --> 00:31:18,480 hosting the back end databases, and you might have a commercial 632 00:31:18,480 --> 00:31:20,720 fleet operator managing the specific vehicles. 633 00:31:20,920 --> 00:31:24,080 So when a vulnerability is found, say the one we discussed, 634 00:31:24,080 --> 00:31:27,440 where a spoofed signal manipulation translates from the 635 00:31:27,440 --> 00:31:30,120 charger into the vehicle's internal battery management 636 00:31:30,120 --> 00:31:33,280 system, causing physical damage, who owns the risk? 637 00:31:33,440 --> 00:31:36,240 Who pays the insurance claim? It is a jurisdictional 638 00:31:36,240 --> 00:31:38,600 nightmare. The OEM will point to their logs 639 00:31:38,600 --> 00:31:41,320 and say our car's internal firewall is secure. 640 00:31:41,600 --> 00:31:44,480 The external charger sent a malicious voltage spike. 641 00:31:44,880 --> 00:31:46,840 Blame them. And the charger manufacturer? 642 00:31:46,840 --> 00:31:49,440 The charger manufacturer will say the hardware functioned 643 00:31:49,440 --> 00:31:52,040 exactly as designed but the cloud back end was broached, 644 00:31:52,240 --> 00:31:54,960 sending us a bad command, and the cloud provider will point at 645 00:31:54,960 --> 00:31:58,560 the OCPP communication protocol and blame the network operator. 646 00:31:58,800 --> 00:32:01,600 It's like buying a high end security system for your house 647 00:32:01,680 --> 00:32:04,720 but leaving the garage door open because the garage come Wait, 648 00:32:04,720 --> 00:32:06,440 no, because the power company. See what I mean? 649 00:32:06,840 --> 00:32:08,720 The jurisdiction is a complete mess. 650 00:32:09,160 --> 00:32:11,880 It is, and while the corporations point fingers at 651 00:32:11,880 --> 00:32:15,120 each other, the uncomfortable truth is that the end customer 652 00:32:15,480 --> 00:32:18,840 does not care about internal vendor disputes or complex 653 00:32:18,840 --> 00:32:21,560 supply chains. They will not separate the blame 654 00:32:21,560 --> 00:32:23,200 cleanly. No, of course not. 655 00:32:23,280 --> 00:32:27,080 Put yourself in the driver's shoes if you plug your brand new 656 00:32:27,080 --> 00:32:31,960 $80,000 luxury EV into a public charger and your car's dashboard 657 00:32:31,960 --> 00:32:35,680 goes blank black and the vehicle is completely bricked because of 658 00:32:35,680 --> 00:32:37,920 a ransomware payload delivered through the charger. 659 00:32:38,240 --> 00:32:39,840 Man, people would lose their minds. 660 00:32:40,160 --> 00:32:42,640 Right. And you aren't going to blame an 661 00:32:42,640 --> 00:32:45,920 obscure cloud provider or a middleware protocol. 662 00:32:46,040 --> 00:32:48,360 You were going to blame the logo on the steering wheel. 663 00:32:48,600 --> 00:32:52,240 You were going to tell everyone you know my car got hacked? 664 00:32:52,640 --> 00:32:55,680 Which means the strategic error the automotive industry has been 665 00:32:55,680 --> 00:32:59,360 making for the last five years is treating charger security as 666 00:32:59,360 --> 00:33:01,400 a separate, isolated work stream. 667 00:33:01,760 --> 00:33:04,960 They're acting like it's the energy company's problem, but 668 00:33:04,960 --> 00:33:07,920 it's not. They are the exact same problem. 669 00:33:08,240 --> 00:33:11,760 Security validation must extend beyond the physical boundary of 670 00:33:11,760 --> 00:33:13,040 the vehicle. Precisely. 671 00:33:13,360 --> 00:33:16,640 Automakers and Tier 1 suppliers have to absorb the entire 672 00:33:16,640 --> 00:33:18,840 charging network into their core threat model. 673 00:33:19,120 --> 00:33:21,760 They cannot just trust the plug. They be doing. 674 00:33:21,800 --> 00:33:25,040 They need to be demanding audits of the firmware pipelines of 675 00:33:25,040 --> 00:33:27,440 their charging partners. They need to be actively 676 00:33:27,440 --> 00:33:31,760 penetration testing the OCPP implementations and securing the 677 00:33:31,760 --> 00:33:34,680 mobile apps as if they were internal mission critical 678 00:33:34,680 --> 00:33:37,280 vehicle components. But the research also points to 679 00:33:37,280 --> 00:33:40,360 solutions emerging right We aren't just sitting here waiting 680 00:33:40,360 --> 00:33:43,600 for the grid to collapse. The NICs Lab Intelligence 681 00:33:43,600 --> 00:33:46,880 highlights new advanced approaches, specifically 682 00:33:46,880 --> 00:33:50,400 detailing the CAD 4 CS model. Yes, the Collaborative Anomaly 683 00:33:50,400 --> 00:33:52,160 Detection System for charging stations. 684 00:33:52,560 --> 00:33:55,480 This represents A crucial necessary shift in our defense 685 00:33:55,480 --> 00:33:58,040 strategy. Historically we've relied on 686 00:33:58,040 --> 00:34:00,600 signature based detection. Like an antivirus looking for a 687 00:34:00,600 --> 00:34:02,120 known bad file. Right. 688 00:34:02,440 --> 00:34:06,000 We look for the fingerprint of known malware, but as pinned to 689 00:34:06,000 --> 00:34:09,520 improved adversaries are using zero days attacks that have no 690 00:34:09,520 --> 00:34:13,400 known signature. 4C has abandoned signatures entirely. 691 00:34:13,800 --> 00:34:16,800 Instead, it uses advanced machine learning to monitor the 692 00:34:16,800 --> 00:34:20,159 actual physical thermodynamic behavior of the station. 693 00:34:20,239 --> 00:34:21,760 Explain how that works in practice. 694 00:34:21,760 --> 00:34:24,880 What is it actually looking at? It looks for deviations in power 695 00:34:24,880 --> 00:34:27,880 consumption and timing. A normal charging session 696 00:34:27,880 --> 00:34:30,800 follows a very specific mathematical curve of power draw 697 00:34:31,040 --> 00:34:33,679 as the battery fills up. The machine learning model 698 00:34:33,880 --> 00:34:36,239 learns this curve perfectly. OK, I'm following. 699 00:34:36,719 --> 00:34:39,960 If an attacker compromises the charger software and tries to 700 00:34:39,960 --> 00:34:43,520 execute a payload that silently manipulates the voltage or tries 701 00:34:43,520 --> 00:34:46,400 to launch a botnet attack, the physical power draw of the 702 00:34:46,400 --> 00:34:48,400 internal components will spike erratically. 703 00:34:49,120 --> 00:34:51,920 So even if the attacker has completely compromised the 704 00:34:51,920 --> 00:34:54,280 software logs, even if they've rewritten the code to say 705 00:34:54,280 --> 00:34:56,760 everything is perfectly fine here, the cats foresee the 706 00:34:56,760 --> 00:34:58,680 system flags, the physical power spike. 707 00:34:59,000 --> 00:35:02,000 You can lie in the software, but you can't lie about the physics. 708 00:35:02,280 --> 00:35:04,560 Exactly. It's bridging the critical gap 709 00:35:04,800 --> 00:35:07,080 between IT security and OT security. 710 00:35:07,440 --> 00:35:10,080 It relies on Collaborate Intelligence, meaning charging 711 00:35:10,080 --> 00:35:14,320 stations securely share this anonymized physical anomaly data 712 00:35:14,560 --> 00:35:17,920 across the entire network. So they can see the big picture. 713 00:35:17,920 --> 00:35:22,040 Yes, if three chargers in a city suddenly show identical abnormal 714 00:35:22,040 --> 00:35:25,520 power curves, the central system can instantly isolate them 715 00:35:25,680 --> 00:35:27,720 before a grid scale attack can cascade. 716 00:35:28,120 --> 00:35:30,320 It is true infrastructure level thinking. 717 00:35:30,800 --> 00:35:32,840 This raises an important question, what are we doing 718 00:35:32,840 --> 00:35:35,040 tomorrow? If you are a network operator, a 719 00:35:35,040 --> 00:35:37,680 government regulator, or an automotive executive listening 720 00:35:37,680 --> 00:35:40,720 to this, how do you actually start fixing this today before 721 00:35:40,720 --> 00:35:42,760 the 500,000 ports are fully deployed? 722 00:35:43,120 --> 00:35:46,520 Well, first they have to start by enforcing strict physical and 723 00:35:46,520 --> 00:35:50,800 logical network segmentation and EV charger should never ever 724 00:35:50,800 --> 00:35:53,880 have a direct unmonitored pathway into the core corporate 725 00:35:53,880 --> 00:35:56,840 network of the operator. If the charger falls, it needs 726 00:35:56,840 --> 00:36:00,480 to be an isolated island. Second, they need to implement 727 00:36:00,480 --> 00:36:02,720 rigorous certificate life cycle governance. 728 00:36:03,280 --> 00:36:06,480 If a charger is physically tampered with, its cryptographic 729 00:36:06,480 --> 00:36:10,200 certificate must be instantly globally revoked to protect the 730 00:36:10,200 --> 00:36:13,480 plug and charge trust chain. And most importantly, the entire 731 00:36:13,480 --> 00:36:17,120 industry needs to stop relying entirely on point in time 732 00:36:17,120 --> 00:36:21,200 compliance audits. ISO and IEC certifications are a 733 00:36:21,200 --> 00:36:24,120 baseline, not a finish line. It's just the starting point. 734 00:36:24,480 --> 00:36:26,360 Right. They must institute continuous, 735 00:36:26,360 --> 00:36:29,720 aggressive, adversarial penetration testing across the 736 00:36:29,720 --> 00:36:33,280 entire stack, hardware, firmware and cloud, just like they do at 737 00:36:33,280 --> 00:36:36,160 Punto Own, but every single day. Think about this. 738 00:36:36,240 --> 00:36:38,920 If our vehicles are rapidly becoming massive mobile 739 00:36:38,920 --> 00:36:42,240 batteries directly hardwired into a fragile legacy power 740 00:36:42,240 --> 00:36:45,120 grid, does securing that grid eventually mean we'll have to 741 00:36:45,120 --> 00:36:48,160 fundamentally restrict how much software we legally allow inside 742 00:36:48,160 --> 00:36:50,560 the car itself? It is definitely a terrifying 743 00:36:50,560 --> 00:36:53,120 thought to leave everyone with. That's all for this episode of 744 00:36:53,120 --> 00:36:56,200 Cybersecurity Under Pressure. Real attacks, real lessons. 745 00:36:56,200 --> 00:36:58,120 It's been a great deep dive, thanks for having me. 746 00:36:58,280 --> 00:37:01,360 The technical detail matters, the board perspective matters, 747 00:37:01,640 --> 00:37:04,400 but what matters most is what you do with both tomorrow, 748 00:37:04,720 --> 00:37:08,360 especially when considering the security of EV charging systems 749 00:37:08,600 --> 00:37:11,000 and their impact on industrial control systems. 750 00:37:11,000 --> 00:37:12,120 Safe, secure, everyone. See. 751 00:37:12,160 --> 00:37:13,000 You in the next chapter.