1
00:00:47,040 --> 00:00:49,120
We are halfway through the week 
and cybersecurity is still a 

2
00:00:49,120 --> 00:00:51,800
blazing hot topic. 
Today we're talking about how 

3
00:00:51,800 --> 00:00:54,960
electric vehicle charging 
systems are becoming a weak 

4
00:00:54,960 --> 00:00:59,080
point in automotive security. 
And it's a weakness that, 

5
00:00:59,280 --> 00:01:02,880
frankly, is scaling at a speed 
that is genuinely keeping me up 

6
00:01:02,880 --> 00:01:04,760
at night. 
Right, because this story has 

7
00:01:04,879 --> 00:01:07,480
everything. 
A real incident, a lesson nobody

8
00:01:07,480 --> 00:01:10,440
wants to hear, and a detail that
will make you check your own 

9
00:01:10,440 --> 00:01:12,480
systems. 
I want everyone listening to 

10
00:01:12,480 --> 00:01:14,520
just mentally place themselves 
in Tokyo. 

11
00:01:14,760 --> 00:01:18,560
It's January, We're at the Ping 
to Own Automotive 2026 event. 

12
00:01:18,560 --> 00:01:22,160
You have this massive conference
room and it is packed with the 

13
00:01:22,280 --> 00:01:25,920
absolute most brilliant, lethal 
Whitehead hackers on the planet.

14
00:01:26,080 --> 00:01:27,800
Oh man, P2 own? 
Yeah, that. 

15
00:01:27,800 --> 00:01:30,040
Was it was a bloodbath? 
You have these next generation 

16
00:01:30,040 --> 00:01:32,680
electric vehicles charging 
stations that look like they 

17
00:01:32,680 --> 00:01:36,240
belong in a sci-fi movie, and 
what we witnessed was literally 

18
00:01:36,480 --> 00:01:38,640
a digital massacre. 
Yeah, a massacre is the right 

19
00:01:38,640 --> 00:01:40,680
word. 
It was an exhibition of absolute

20
00:01:40,680 --> 00:01:43,120
vulnerability. 
I mean, the final tally was 76. 

21
00:01:43,280 --> 00:01:46,640
76 zero day vulnerabilities. 
Unique ones. 

22
00:01:47,120 --> 00:01:50,120
And here is the detail that just
completely breaks my brain. 

23
00:01:50,480 --> 00:01:53,720
Discovered in three days. 
Three days. 

24
00:01:53,720 --> 00:01:57,160
I mean, what are we even doing 
as an industry if in a long 

25
00:01:57,160 --> 00:02:01,800
weekend people can find 76 brand
new ways to shred these systems?

26
00:02:01,920 --> 00:02:04,240
Well, and that's the thing 
people don't fully grasp, right?

27
00:02:04,240 --> 00:02:06,480
Those are just the flaws that 
the research teams managed to 

28
00:02:06,480 --> 00:02:10,440
exploit, chain together, and 
document within this tiny, 

29
00:02:10,440 --> 00:02:12,680
strict time window of a 
competition. 

30
00:02:12,720 --> 00:02:14,520
Right under pressure. 
Exactly. 

31
00:02:14,920 --> 00:02:17,600
Now extrapolate that level of 
exposure to the real world 

32
00:02:17,640 --> 00:02:19,400
ecosystem. 
You have malicious actors, 

33
00:02:19,400 --> 00:02:22,760
cybercrime syndicates who have 
months, sometimes years, to 

34
00:02:22,760 --> 00:02:26,480
patiently probe the defenses of 
these networks without anyone 

35
00:02:26,480 --> 00:02:27,600
running a stopwatch on. 
Them. 

36
00:02:27,640 --> 00:02:29,360
Yeah, they don't have a referee 
blowing a whistle. 

37
00:02:29,640 --> 00:02:30,880
They have all the time in the 
world. 

38
00:02:31,120 --> 00:02:33,320
And what really hit me while 
reading through the research we 

39
00:02:33,320 --> 00:02:36,760
pulled for our deep dive today 
is just this massive paradigm 

40
00:02:36,760 --> 00:02:38,800
shift. 
Historically, if you owned a 

41
00:02:38,800 --> 00:02:41,480
car, your biggest security 
concern was physical. 

42
00:02:41,600 --> 00:02:44,400
Sure, like a busted window. 
Yeah, you worried someone would 

43
00:02:44,400 --> 00:02:48,040
steal your hubcaps or smash the 
glass in a dark alley to RIP out

44
00:02:48,040 --> 00:02:50,480
the radio. 
It was a problem of brute force.

45
00:02:50,760 --> 00:02:52,920
Broken glass. 
Right, the threat basically 

46
00:02:52,920 --> 00:02:57,560
ended at the hood of your car. 
But now, I mean, the reality is 

47
00:02:57,560 --> 00:02:59,960
you have to worry that someone 
sitting in a basement on another

48
00:02:59,960 --> 00:03:03,360
continent might remotely 
compromise a high voltage 

49
00:03:03,360 --> 00:03:06,920
computer, take total control of 
your two ton vehicle, extract 

50
00:03:06,920 --> 00:03:10,040
your financial data, and oh, by 
the way, maybe destabilize the 

51
00:03:10,040 --> 00:03:11,960
power grid for your entire 
neighborhood. 

52
00:03:12,520 --> 00:03:15,000
And all of this through what 
basically looks like a modern 

53
00:03:15,000 --> 00:03:17,240
gas pump. 
It's wild when you put it like. 

54
00:03:17,240 --> 00:03:19,960
That it really is. 
So our mission today for you 

55
00:03:19,960 --> 00:03:22,280
listening, whether you already 
have an EV in your garage or 

56
00:03:22,280 --> 00:03:25,920
you're just thinking about 
buying one down the line, is to 

57
00:03:25,920 --> 00:03:30,120
unpack this nightmare. 
We really need to dissect how we

58
00:03:30,120 --> 00:03:33,160
allow these public and private 
charging stations to become 

59
00:03:33,160 --> 00:03:36,080
highly complex computers 
operating with almost zero 

60
00:03:36,080 --> 00:03:38,080
protection. 
Well, it's because we've 

61
00:03:38,080 --> 00:03:41,560
essentially created this perfect
storm of vulnerability. 

62
00:03:41,800 --> 00:03:44,760
You have this critical tech 
being deployed and it's evolving

63
00:03:44,760 --> 00:03:47,680
so much faster than the 
regulatory frameworks can keep 

64
00:03:47,680 --> 00:03:51,280
up, and more importantly, faster
than corporate security teams 

65
00:03:51,280 --> 00:03:53,080
can manage. 
Because they're just rushing to 

66
00:03:53,080 --> 00:03:56,040
get them in the ground. 
Exactly, you're mixing heavy 

67
00:03:56,040 --> 00:04:00,600
industrial hardware with these 
super agile cloud applications, 

68
00:04:00,920 --> 00:04:04,520
all driven by this massive 
commercial urgency to plant one 

69
00:04:04,520 --> 00:04:07,080
of these things on every single 
street corner on the planet. 

70
00:04:07,280 --> 00:04:09,480
Which brings us right to the 
heart of the issue. 

71
00:04:09,520 --> 00:04:13,120
What I like to call the illusion
of physical scale because of the

72
00:04:13,120 --> 00:04:15,240
expansion we're talking about is
insane. 

73
00:04:15,480 --> 00:04:17,760
The infrastructure numbers I was
looking at are staggering, 

74
00:04:17,800 --> 00:04:21,399
192,000 physical charging ports 
in the US alone. 

75
00:04:21,760 --> 00:04:25,440
Another 34,000 or so in Canada. 
Yep, they are everywhere. 

76
00:04:25,640 --> 00:04:28,280
It's like we build a massive 
global network of Internet 

77
00:04:28,280 --> 00:04:31,480
connected computers, left them 
sitting out in the rain and 

78
00:04:31,560 --> 00:04:35,240
desolate parking lots and gas 
stations, and just basically 

79
00:04:35,240 --> 00:04:37,080
forgot to put passwords on half 
of them. 

80
00:04:37,680 --> 00:04:40,840
The physical expansion is 
entirely eclipsed with the 

81
00:04:40,840 --> 00:04:44,240
analysts at Upstream Security. 
Call their cyber security 

82
00:04:44,240 --> 00:04:46,840
maturity. 
That analogy of the computers 

83
00:04:46,840 --> 00:04:49,480
left out in the street is 
painfully accurate, but honestly

84
00:04:49,480 --> 00:04:52,640
I think it even falls short 
because the fundamental issue 

85
00:04:52,640 --> 00:04:56,640
here, the root of all those zero
days at PU 22 own, is this 

86
00:04:56,640 --> 00:05:00,120
tectonic mismatch and how we 
even understand the technology. 

87
00:05:00,200 --> 00:05:03,520
What do you mean by mismatch? 
Well, the operators of these EV 

88
00:05:03,600 --> 00:05:07,000
supply equipment units, the EVSC
is they're often energy 

89
00:05:07,000 --> 00:05:10,400
companies or these new 
infrastructure startups and they

90
00:05:10,400 --> 00:05:14,280
are trying to protect critical 
cyber kinetic systems using well

91
00:05:14,440 --> 00:05:17,720
traditional office IT tools. 
So they're using band aids to 

92
00:05:17,720 --> 00:05:19,680
stop an arterial bleed. 
That's exactly it. 

93
00:05:19,680 --> 00:05:22,160
They're trying to use 
conventional network firewalls 

94
00:05:22,160 --> 00:05:24,960
and standard antivirus solutions
that were built for e-mail 

95
00:05:24,960 --> 00:05:27,760
servers, and they're slapping 
them on to embedded firmware, 

96
00:05:27,760 --> 00:05:31,440
microcontrollers, programmable 
logic protocols, stuff that 

97
00:05:31,440 --> 00:05:32,840
operates at the bare metal 
level. 

98
00:05:33,080 --> 00:05:35,120
And that just doesn't translate.
Not at all. 

99
00:05:35,120 --> 00:05:37,920
Your office software cannot 
protect a machine that is 

100
00:05:37,920 --> 00:05:41,200
engineered to pump 800 volts of 
electricity. 

101
00:05:41,320 --> 00:05:43,240
OK, wait, let me stop you right 
there 'cause I really want to 

102
00:05:43,240 --> 00:05:45,560
address something I've been 
thinking about, and I bet a lot 

103
00:05:45,560 --> 00:05:46,960
of you listening have this in 
your head too. 

104
00:05:47,160 --> 00:05:48,880
I call it the illusion of the 
plug. 

105
00:05:49,560 --> 00:05:54,080
Like, isn't a charger at its 
most basic core just a giant 

106
00:05:54,320 --> 00:05:58,080
glorified, extremely expensive 
extension cord? 

107
00:05:58,200 --> 00:06:00,920
Oh, I wish, I really do. 
But think about the physical 

108
00:06:00,920 --> 00:06:03,320
action. 
You drive up, you grab the hose,

109
00:06:03,640 --> 00:06:06,920
plug it into your car, those 
thick copper pins make contact, 

110
00:06:07,080 --> 00:06:09,520
electricity flows into the 
battery, and you're done. 

111
00:06:09,600 --> 00:06:12,840
It's basic physics. 
Where on earth is the attack 

112
00:06:12,840 --> 00:06:15,640
surface on a cable that just 
pushes raw current? 

113
00:06:15,960 --> 00:06:19,480
Yeah, that is the sweet blissful
ignorance of the early days 

114
00:06:19,560 --> 00:06:21,160
phase of electrification right 
there. 

115
00:06:21,600 --> 00:06:25,160
I genuinely wish it was just a 
heavy duty extension cord, but 

116
00:06:25,160 --> 00:06:27,360
the reality is so much more 
terrifying. 

117
00:06:27,600 --> 00:06:29,920
When you take that heavy 
connector and snap it into your 

118
00:06:29,920 --> 00:06:33,000
vehicle, electricity doesn't 
just start flowing immediately. 

119
00:06:33,320 --> 00:06:35,480
No. 
If it did you would probably fry

120
00:06:35,480 --> 00:06:38,080
the car circuit instantly or 
electrocute yourself. 

121
00:06:38,640 --> 00:06:42,080
What actually happens in that 
first millisecond is a massive 

122
00:06:42,080 --> 00:06:46,060
digital handshake. 
A handshake like like 2 old dial

123
00:06:46,060 --> 00:06:49,440
up modems connecting. 
More like a high speed security 

124
00:06:49,440 --> 00:06:52,760
interrogation. 
The car and the charger have to 

125
00:06:52,760 --> 00:06:56,920
have this incredibly detailed 
technical conversation before a 

126
00:06:56,920 --> 00:06:59,800
single electron of power is 
authorized to move. 

127
00:07:00,200 --> 00:07:01,440
OK, So what are they talking 
about? 

128
00:07:01,760 --> 00:07:04,800
The charger through these 
specific communication pins 

129
00:07:04,800 --> 00:07:09,000
inside that cable basically asks
the car, hey, who are you 

130
00:07:09,040 --> 00:07:10,600
exactly? 
What is your vehicle 

131
00:07:10,600 --> 00:07:12,320
identification number? 
Your VIN? 

132
00:07:12,600 --> 00:07:14,640
What kind of battery chemistry 
are you running? 

133
00:07:14,680 --> 00:07:16,360
What is your current 
temperature, your state of 

134
00:07:16,360 --> 00:07:18,600
charge? 
How much maximum current can you

135
00:07:18,600 --> 00:07:20,480
take right now without bursting 
into flames? 

136
00:07:20,760 --> 00:07:23,560
OK, so the charger is basically 
acting like a bouncer at a club,

137
00:07:23,680 --> 00:07:25,760
validating the car's ID. 
Exactly. 

138
00:07:25,760 --> 00:07:28,960
And it doesn't even stop there. 
Once the car responds and they 

139
00:07:28,960 --> 00:07:32,560
agree on the physics parameters,
the charger turns around, so to 

140
00:07:32,560 --> 00:07:35,920
speak, and opens a connection 
over cellular Internet or Wi-Fi 

141
00:07:36,200 --> 00:07:39,360
to an application programming 
interface cloud API. 

142
00:07:39,440 --> 00:07:40,160
Right. 
Calling home? 

143
00:07:40,360 --> 00:07:42,520
Yep. 
And it tells its central server 

144
00:07:42,520 --> 00:07:45,280
hey I've got this specific 
vehicle plug into port 3. 

145
00:07:45,680 --> 00:07:48,640
Does this user have funds in 
their digital wallet? 

146
00:07:49,200 --> 00:07:53,080
Is their credit card active? 
What is the dynamic billing rate

147
00:07:53,160 --> 00:07:55,680
in this exact zip code right 
this second? 

148
00:07:55,960 --> 00:07:59,440
My God, So I'm not plugging in a
cable, I am initiating a full 

149
00:07:59,440 --> 00:08:03,480
spectrum network transaction. 
It is a hyper complex network 

150
00:08:03,480 --> 00:08:06,360
choreography. 
You are chaining together 

151
00:08:06,360 --> 00:08:09,320
vehicle identifiers, digital 
certificates, dynamic charging 

152
00:08:09,320 --> 00:08:12,920
profiles, user accounts, cloud 
databases, mobile apps, and 

153
00:08:12,920 --> 00:08:16,440
international payment gateways, 
and it all happens in 

154
00:08:16,440 --> 00:08:18,200
milliseconds. 
That is insane. 

155
00:08:18,200 --> 00:08:21,600
It really is literally a high 
performance edge computer fully 

156
00:08:21,600 --> 00:08:24,120
integrated with the commercial 
cloud that, oh by the way, just 

157
00:08:24,120 --> 00:08:28,160
also happens to dispense lethal 
levels of electricity as a side 

158
00:08:28,160 --> 00:08:30,080
feature. 
And when you read the research, 

159
00:08:30,080 --> 00:08:32,720
like that upstream security 
report we devoured for this deep

160
00:08:32,720 --> 00:08:36,080
dive, it is just brutal to see 
the state of that edge computer.

161
00:08:36,360 --> 00:08:38,720
They point directly to the fact 
that this entire emerging 

162
00:08:38,720 --> 00:08:41,880
industry lacks the most basic 
encryption standards. 

163
00:08:42,120 --> 00:08:44,159
Yeah, it's bad. 
They mentioned that they suffer 

164
00:08:44,159 --> 00:08:47,160
from authentication gaps that 
would embarrass a college 

165
00:08:47,160 --> 00:08:51,160
freshman in computer science. 
We are basically connecting our 

166
00:08:51,160 --> 00:08:55,240
$80,000 vehicles to charging 
ports in a dark grocery store 

167
00:08:55,240 --> 00:08:58,200
parking lot that have less 
perimeter security than my 

168
00:08:58,200 --> 00:09:00,960
Netflix account. 
Oh, I guarantee you it is so 

169
00:09:00,960 --> 00:09:02,360
much worse than your Netflix 
account. 

170
00:09:02,360 --> 00:09:05,440
At least Netflix encrypts its 
streaming traffic by default. 

171
00:09:05,440 --> 00:09:08,640
You know, so your neighbor can't
intercept the data packets and 

172
00:09:08,640 --> 00:09:10,520
see exactly what episode you're 
watching. 

173
00:09:11,040 --> 00:09:14,080
What upstream security pointed 
out with a lot of alarm. 

174
00:09:14,160 --> 00:09:16,960
Is this chronic lack of 
encryption standards at the 

175
00:09:16,960 --> 00:09:19,120
communication layer of these 
chargers? 

176
00:09:19,480 --> 00:09:22,040
This means that the data flowing
between that machine on the 

177
00:09:22,040 --> 00:09:25,640
street and the energy network is
often traveling in plain text. 

178
00:09:25,960 --> 00:09:29,000
It is not scrambled at all. 
So anyone sniffing the network 

179
00:09:29,000 --> 00:09:30,360
and just read it like an open 
book? 

180
00:09:30,560 --> 00:09:34,200
Exactly, and the authentication 
gaps mean the mechanisms the 

181
00:09:34,200 --> 00:09:36,920
charger uses to verify who on 
earth is sending it. 

182
00:09:37,200 --> 00:09:41,420
Remote commands are incredibly 
weak or sometimes just non 

183
00:09:41,420 --> 00:09:43,400
existent. 
Think about it from a tactical 

184
00:09:43,400 --> 00:09:45,040
perspective. 
If you don't really know who is 

185
00:09:45,120 --> 00:09:47,360
talking to you, and on top of 
that you aren't hiding what 

186
00:09:47,360 --> 00:09:51,400
you're talking about, you are a 
static target with a neon sign 

187
00:09:51,400 --> 00:09:54,400
flashing Attack me. 
OK, I think we have permanently 

188
00:09:54,400 --> 00:09:55,920
destroyed the illusion of the 
plug. 

189
00:09:56,080 --> 00:09:58,480
We get that these posts on the 
street are vulnerable, 

190
00:09:58,480 --> 00:10:00,960
unprotected computers. 
So let's actually dig into the 

191
00:10:00,960 --> 00:10:02,480
tactics. 
How are the hackers actually 

192
00:10:02,480 --> 00:10:04,200
getting in? 
Let's talk about the attack 

193
00:10:04,200 --> 00:10:05,520
vector. 
Sure, let's get into it. 

194
00:10:05,680 --> 00:10:08,280
When I went through the research
notes from the OSTI, the 

195
00:10:08,280 --> 00:10:11,720
Department of Energy, they kept 
bringing up the OCPP 1.6 

196
00:10:11,720 --> 00:10:15,320
protocol over and over like it 
was the structural Achilles of 

197
00:10:15,320 --> 00:10:18,440
this whole ecosystem. 
What is it exactly, and why is 

198
00:10:18,440 --> 00:10:21,880
it such a disaster? 
The OCPP, the Open Chargepoint 

199
00:10:21,880 --> 00:10:23,520
protocol. 
You really have to understand 

200
00:10:23,520 --> 00:10:26,360
its history to get why it's such
a massive problem today. 

201
00:10:26,760 --> 00:10:29,960
Essentially, it's this universal
open source language that 

202
00:10:29,960 --> 00:10:32,720
physical charge points use to 
talk to central management 

203
00:10:32,720 --> 00:10:34,880
systems. 
The cloud servers that monitor 

204
00:10:34,880 --> 00:10:37,560
the networks. 
Exactly, and version 1.6 is the 

205
00:10:37,560 --> 00:10:39,320
dominant standard in the 
industry right now. 

206
00:10:39,560 --> 00:10:41,920
The vast majority of public 
chargers use it. 

207
00:10:42,120 --> 00:10:44,720
So what's the flaw? 
Do they just design it poorly 

208
00:10:44,720 --> 00:10:46,800
from day? 
Well, the problem is the 

209
00:10:46,800 --> 00:10:50,360
original context of the design. 
When OCPP was first conceived, 

210
00:10:50,560 --> 00:10:53,240
the assumption was that these 
charges were going to operate 

211
00:10:53,280 --> 00:10:56,640
inside private, isolated 
corporate networks. 

212
00:10:56,720 --> 00:10:59,440
Oh, closed loop networks. 
Right, closed loops where you 

213
00:10:59,440 --> 00:11:01,880
could inherently trust every 
connected device. 

214
00:11:02,000 --> 00:11:06,000
So the creators thought, hey, 
why add the processing overhead 

215
00:11:06,000 --> 00:11:09,000
of heavy encryption if 
everything is sitting inside our

216
00:11:09,000 --> 00:11:11,120
own trusted private network 
anyway? 

217
00:11:11,640 --> 00:11:13,480
I see. 
But now we've taken that exact 

218
00:11:13,480 --> 00:11:16,360
same protocol, which was 
designed for a walled garden, 

219
00:11:16,560 --> 00:11:18,720
and we just threw it out in the 
Wild West of the public 

220
00:11:18,720 --> 00:11:19,960
Internet. 
You nailed it. 

221
00:11:20,160 --> 00:11:23,200
So now you have this protocol 
that doesn't enforce encryption 

222
00:11:23,200 --> 00:11:26,840
by default, chatting over public
cellular networks or gas station

223
00:11:26,840 --> 00:11:30,280
Wi-fi's, and it is, like you 
said, just riddled with massive 

224
00:11:30,280 --> 00:11:32,920
structural holes. 
The research specifically 

225
00:11:32,920 --> 00:11:36,280
highlights man in the middle 
vulnerabilities, and because 

226
00:11:36,280 --> 00:11:39,920
there's no forced encryption, I 
assume it's trivial to just step

227
00:11:39,920 --> 00:11:42,920
right into that conversation. 
Is chillingly easy. 

228
00:11:43,040 --> 00:11:46,520
Imagine you are at a restaurant.
You're giving your order to a 

229
00:11:46,520 --> 00:11:51,080
waiter, but there's an invisible
silent guy standing exactly 

230
00:11:51,080 --> 00:11:53,640
between the two of you. 
OK, he intercepts your food 

231
00:11:53,640 --> 00:11:56,240
order, changes it so he can 
order something way more 

232
00:11:56,240 --> 00:11:59,240
expensive from the waiter, takes
your credit card number that you

233
00:11:59,240 --> 00:12:01,360
handed over, and then when 
you're done, he hands you a 

234
00:12:01,360 --> 00:12:04,800
completely fake receipt and 
neither you nor the waiter ever 

235
00:12:04,800 --> 00:12:06,160
knew he was there. 
Wow. 

236
00:12:06,760 --> 00:12:10,360
And translating that to the EV 
charger, the attacker is 

237
00:12:10,360 --> 00:12:13,480
spoofing the connections. 
The charger thinks it is talking

238
00:12:13,480 --> 00:12:16,520
securely to the energy company's
headquarters, reporting how much

239
00:12:16,520 --> 00:12:18,200
power it's pumping. 
But in reality. 

240
00:12:18,200 --> 00:12:20,640
But in reality it's suffered a 
session hijack. 

241
00:12:20,920 --> 00:12:23,560
The attacker manipulates the 
network traffic, maybe they 

242
00:12:23,560 --> 00:12:26,640
alter the DNS resolutions and 
they redirect that charger to an

243
00:12:26,640 --> 00:12:28,920
unauthorized server. 
The charger is now taking 

244
00:12:28,920 --> 00:12:31,360
commands from a cyber criminals 
malicious server. 

245
00:12:31,360 --> 00:12:33,240
And what can they even do with 
that control? 

246
00:12:33,360 --> 00:12:35,600
Are they just stealing credit 
card data? 

247
00:12:35,880 --> 00:12:38,320
Oh, that's the least of it. 
I mean, they can steal payment 

248
00:12:38,320 --> 00:12:41,680
info, sure, but they they can 
also spoof charging sessions, 

249
00:12:41,680 --> 00:12:44,880
making other users foot the bill
for charging entire commercial 

250
00:12:44,880 --> 00:12:47,440
fleets. 
Or, in a much more destructive 

251
00:12:47,440 --> 00:12:49,920
scenario, they can launch 
massive denial of service 

252
00:12:49,920 --> 00:12:51,160
attacks. 
The docs attacks. 

253
00:12:51,160 --> 00:12:53,960
Right, they can send malicious 
commands through the spoofed 

254
00:12:53,960 --> 00:12:58,360
OCPP that caused every single 
charger in a city to reboot in 

255
00:12:58,360 --> 00:13:00,840
an infinite loop, just 
paralyzing an entire 

256
00:13:00,840 --> 00:13:02,400
infrastructure network in 
seconds. 

257
00:13:02,880 --> 00:13:05,720
But the cloud and the Wi-Fi 
aren't even the only issues 

258
00:13:05,720 --> 00:13:06,800
here. 
And this is where the reading 

259
00:13:06,800 --> 00:13:09,120
got truly technical and 
fascinating for me. 

260
00:13:09,720 --> 00:13:12,080
The pure hardware and protocol 
flaws. 

261
00:13:12,640 --> 00:13:15,360
I want to talk about firmware 
rollbacks, which we saw in the 

262
00:13:15,360 --> 00:13:18,240
point to own documents. 
Walk me through the mechanics of

263
00:13:18,240 --> 00:13:20,920
a rollback. 
The rollback is such a classic, 

264
00:13:20,920 --> 00:13:23,760
devastating attack against 
Internet of Things devices. 

265
00:13:23,920 --> 00:13:26,320
Look, manufacturers aren't 
totally blind. 

266
00:13:26,640 --> 00:13:29,000
Sometimes they realize there's a
massive security hole in their 

267
00:13:29,000 --> 00:13:32,040
code, so they develop a patch 
and push an over the air for a 

268
00:13:32,040 --> 00:13:33,920
more update to the charger to 
fix it. 

269
00:13:34,320 --> 00:13:37,960
Like when my smartphone forces 
me to reboot at 3:00 AM to 

270
00:13:37,960 --> 00:13:41,240
install a security patch. 
Exactly the same concept. 

271
00:13:41,760 --> 00:13:45,040
The charger downloads the new 
software and becomes 

272
00:13:45,280 --> 00:13:48,000
theoretically secure against 
that specific flaw. 

273
00:13:48,440 --> 00:13:51,400
But if the chargers update 
mechanism isn't rigorously 

274
00:13:51,400 --> 00:13:55,280
protected by cryptography, if it
doesn't strictly verify digital 

275
00:13:55,280 --> 00:13:59,680
signatures, a local or remote 
attacker can trick the device. 

276
00:13:59,840 --> 00:14:02,400
Trick it how? 
They can send a command that 

277
00:14:02,400 --> 00:14:06,240
literally forces the charger to 
uninstall the safe software and 

278
00:14:06,240 --> 00:14:08,680
reinstall an old obsolete 
version. 

279
00:14:08,840 --> 00:14:11,240
Wait, you're saying they've 
force the machine to physically 

280
00:14:11,240 --> 00:14:12,640
time travel at the software 
level? 

281
00:14:12,640 --> 00:14:16,480
Yes, they force the device to 
roll back to a version from, 

282
00:14:16,480 --> 00:14:19,800
say, two years ago, and the 
reason they do this is that the 

283
00:14:19,840 --> 00:14:22,880
old version contains known 
public vulnerabilities that the 

284
00:14:22,880 --> 00:14:26,040
manufacturer already documented 
and the attacker already has 

285
00:14:26,040 --> 00:14:28,600
prefabricated tools to exploit 
perfectly. 

286
00:14:28,600 --> 00:14:31,240
That is just diabolical. 
It's like a burglar magically 

287
00:14:31,240 --> 00:14:34,040
convincing you to remove your 
high tech electronic front door 

288
00:14:34,040 --> 00:14:36,840
lock and reinstall that old 
brass lock that everyone in the 

289
00:14:36,840 --> 00:14:38,840
neighborhood already has a copy 
of the key for. 

290
00:14:39,040 --> 00:14:41,840
They know the currency system is
too hard so they just downgraded

291
00:14:41,840 --> 00:14:43,040
to one they can break in their 
sleep. 

292
00:14:43,440 --> 00:14:45,240
Wow. 
And then there are the math 

293
00:14:45,240 --> 00:14:48,520
vulnerabilities which should be 
coned detailed in their post 

294
00:14:48,520 --> 00:14:51,320
Ping to own reports. 
They talk a lot about buffer 

295
00:14:51,320 --> 00:14:54,480
overflows triggering remote code
execution or RCE. 

296
00:14:55,320 --> 00:14:57,960
And there was also this flaw 
that sounded similar but is 

297
00:14:57,960 --> 00:15:00,400
apparently different. 
Let me check my notes here. 

298
00:15:00,400 --> 00:15:04,160
Right, the CWE 839. 
It's described as a numeric 

299
00:15:04,160 --> 00:15:07,520
range input flaw, right? 
For those of us who don't spend 

300
00:15:07,520 --> 00:15:11,440
our weekends compiling C++ code,
what is the actual difference 

301
00:15:11,440 --> 00:15:13,680
between these two attacks? 
Because they both just sound 

302
00:15:13,680 --> 00:15:16,360
like overloading the system. 
It's a crucial technical 

303
00:15:16,360 --> 00:15:18,560
distinction, and people mix them
up a lot. 

304
00:15:19,080 --> 00:15:21,680
Let's start with the classic, 
the buffer overflow. 

305
00:15:22,280 --> 00:15:25,120
This happens at the level of the
device processors physical 

306
00:15:25,120 --> 00:15:28,040
memory. 
Imagine the system sets aside a 

307
00:15:28,040 --> 00:15:31,640
tiny block of memory, a buffer 
to store let's say the name of 

308
00:15:31,640 --> 00:15:34,040
your vehicle. 
It expects a maximum of 20 

309
00:15:34,040 --> 00:15:35,800
characters. 
OK, seems normal. 

310
00:15:36,160 --> 00:15:38,960
But the attacker sends a name 
that is 5000 characters long, 

311
00:15:39,240 --> 00:15:41,680
and right in the middle of those
characters they hide malicious 

312
00:15:41,680 --> 00:15:43,880
software code. 
So the system is trying to pour 

313
00:15:43,880 --> 00:15:46,520
a gallon of water into a tiny 
shot glass. 

314
00:15:46,720 --> 00:15:48,600
And the water spills all over 
the table. 

315
00:15:48,800 --> 00:15:51,760
In hardware terms, those 
thousands of extra characters 

316
00:15:51,760 --> 00:15:54,840
overflow from their assigned 
block and overwrite the adjacent

317
00:15:54,840 --> 00:15:57,080
parts of the devices. 
Critical operating memory. 

318
00:15:57,600 --> 00:16:00,880
And by doing that, the attacker 
can trick the processor into 

319
00:16:00,880 --> 00:16:03,640
executing those malicious 
instructions they hid in the 

320
00:16:03,640 --> 00:16:05,560
spilled water. 
Which is the remote code 

321
00:16:05,560 --> 00:16:07,880
execution RCE. 
Exactly. 

322
00:16:08,160 --> 00:16:12,400
You now have total administrator
level control over the hardware.

323
00:16:12,400 --> 00:16:14,080
You can make the charger do 
whatever you want. 

324
00:16:14,320 --> 00:16:15,920
Got it. 
So that's a brute force attack 

325
00:16:15,920 --> 00:16:17,440
on the memory architecture 
itself. 

326
00:16:18,000 --> 00:16:21,240
So what about The CW 839? 
The integer handling? 

327
00:16:21,240 --> 00:16:23,040
If it's not a memory overflow, 
what is it? 

328
00:16:23,440 --> 00:16:27,600
CWE 839 is much more subtle. 
It is purely a logic flaw, not 

329
00:16:27,600 --> 00:16:30,160
physical memory. 
It refers to situations where 

330
00:16:30,160 --> 00:16:33,480
the software just fails to 
properly verify if a number 

331
00:16:33,480 --> 00:16:37,000
entered by the user, or in this 
case the car, makes any sense in

332
00:16:37,000 --> 00:16:38,800
the real world. 
Give me an example of how that 

333
00:16:38,800 --> 00:16:42,480
looks on a charging station. 
OK, say the charger has a logic 

334
00:16:42,480 --> 00:16:46,120
security gate that says if the 
battery percentage reported by 

335
00:16:46,120 --> 00:16:48,480
the car is less than 100, keep 
charging. 

336
00:16:48,600 --> 00:16:51,760
If it hits 100, stop the current
immediately so you don't start a

337
00:16:51,760 --> 00:16:54,240
fire. 
The software logically expects 

338
00:16:54,240 --> 00:16:56,800
to receive an integer between 0 
and 100. 

339
00:16:56,880 --> 00:16:59,600
Rates of percentage. 
But the developers, in a rush, 

340
00:16:59,800 --> 00:17:03,040
forgot to tell the system what 
to do if it receives a number 

341
00:17:03,040 --> 00:17:06,800
that breaks the laws of physics.
So the attacker manipulating the

342
00:17:06,800 --> 00:17:11,960
communication doesn't send 90%, 
they send the number -50,000. 

343
00:17:12,119 --> 00:17:15,240
Or they send 3 billion. 
And how does the programmable 

344
00:17:15,240 --> 00:17:17,880
logic controller handle that? 
Does it just crash? 

345
00:17:18,119 --> 00:17:20,240
It depends on the system, but 
often the results are 

346
00:17:20,240 --> 00:17:22,720
disastrous. 
The software tries to process 

347
00:17:22,720 --> 00:17:25,920
the logic of charging a battery 
up to -50,000%. 

348
00:17:26,280 --> 00:17:29,000
It gets mathematically confused 
and throws an unhandled error 

349
00:17:29,000 --> 00:17:31,000
state. 
And in a lot of these poorly 

350
00:17:31,000 --> 00:17:34,040
designed industrial systems, 
when a critical logic error 

351
00:17:34,040 --> 00:17:37,200
happens, the system defaults to 
a fail open state instead of 

352
00:17:37,200 --> 00:17:40,040
fail closed. 
Fail open meaning instead of 

353
00:17:40,040 --> 00:17:43,440
locking down and shutting off 
for safety, the controls fail by

354
00:17:43,440 --> 00:17:45,040
just leaving everything wide 
open. 

355
00:17:45,320 --> 00:17:48,200
Exactly. 
The logic lock breaks and the 

356
00:17:48,200 --> 00:17:51,720
door swings wide open. 
It allows the attacker to bypass

357
00:17:51,720 --> 00:17:55,560
safety checks, evade 
authentication, or just keep the

358
00:17:55,560 --> 00:17:57,320
current flowing without any 
restrictions. 

359
00:17:57,320 --> 00:18:00,120
It's unbelievable. 
We're talking about overflowing 

360
00:18:00,120 --> 00:18:03,600
physical memory and injecting 
impossible math, and all of this

361
00:18:03,600 --> 00:18:05,760
assumes they're attacking 
through the charger cellular 

362
00:18:05,760 --> 00:18:07,800
network. 
But this leads us to the 

363
00:18:07,800 --> 00:18:10,320
vulnerability that honestly 
disturbed me the most when I was

364
00:18:10,320 --> 00:18:13,160
reading the physical attack at 
the cable level. 

365
00:18:13,280 --> 00:18:15,160
Oh yeah, the SWC can. 
Attack right? 

366
00:18:15,480 --> 00:18:18,040
Forget the gas station Wi-Fi. 
Forget intercepting cloud 

367
00:18:18,040 --> 00:18:20,960
communications. 
The teams at Tune to Own prove 

368
00:18:20,960 --> 00:18:25,120
they could access the SWCS can 
interface the single wire CAN 

369
00:18:25,120 --> 00:18:28,160
bus by injecting code directly 
through the pins of the physical

370
00:18:28,160 --> 00:18:30,160
plug. 
You have to explain the CAN bus 

371
00:18:30,160 --> 00:18:32,360
to the listener because this 
completely changes the rules of 

372
00:18:32,360 --> 00:18:35,000
automotive security. 
The CAN bus is, without 

373
00:18:35,000 --> 00:18:38,320
exaggeration, the absolute 
central nervous system of your 

374
00:18:38,320 --> 00:18:40,800
car. 
It is the deep internal 

375
00:18:40,800 --> 00:18:43,440
communication network that 
allows all the critical 

376
00:18:43,440 --> 00:18:46,520
components like the engine 
control module, the anti lock 

377
00:18:46,520 --> 00:18:49,240
brake sensors, the power 
steering and the high voltage 

378
00:18:49,240 --> 00:18:52,720
battery management systems to 
talk to each other in real time,

379
00:18:53,000 --> 00:18:56,880
thousands of times a second and.
By design, it was always assumed

380
00:18:56,880 --> 00:18:59,400
that internal network was 
physically isolated from the 

381
00:18:59,400 --> 00:19:01,960
outside world, right? 
Like a super secure intranet 

382
00:19:01,960 --> 00:19:04,040
trapped inside the steel shell 
of the car. 

383
00:19:04,040 --> 00:19:06,480
Correct. 
Historically, if you wanted to 

384
00:19:06,480 --> 00:19:10,680
meaningfully hack a car's can 
bus, you had to physically smash

385
00:19:10,720 --> 00:19:14,480
the window, climb under the 
dashboard, find the OBD 2 

386
00:19:14,480 --> 00:19:17,880
diagnostic port, and plug a 
device directly into the car's 

387
00:19:17,880 --> 00:19:20,080
wiring. 
It was an intrusive physical 

388
00:19:20,080 --> 00:19:24,040
attack, but the EV revolution 
broke that isolation complete. 

389
00:19:24,040 --> 00:19:26,760
Because the car now has to have 
that complex conversation with 

390
00:19:26,760 --> 00:19:30,280
the power pump outside. 
Exactly because the vehicle 

391
00:19:30,280 --> 00:19:32,840
needs to intimately communicate 
with the street charger to 

392
00:19:32,840 --> 00:19:36,240
negotiate voltages and manage 
the thermals of the lithium 

393
00:19:36,240 --> 00:19:39,640
batteries, the manufacturers had
to extend a bridge from that 

394
00:19:39,640 --> 00:19:42,600
secure internal canvas out into 
the real world. 

395
00:19:43,160 --> 00:19:46,080
That communication line, the 
single wire can or similar 

396
00:19:46,080 --> 00:19:50,080
systems now travels right along 
that thick charging cable you 

397
00:19:50,080 --> 00:19:52,240
hold in your hand. 
So when I grab that hose at a 

398
00:19:52,240 --> 00:19:56,040
highway rest stop, that cable is
not just a copper pipe for 

399
00:19:56,040 --> 00:20:00,560
electricity, it is literally a 
direct Ethernet cable plugged 

400
00:20:00,560 --> 00:20:03,160
straight into the deepest brain 
tissue of my car. 

401
00:20:03,360 --> 00:20:06,160
It is a drawbridge that the 
manufacturers have permanently 

402
00:20:06,160 --> 00:20:09,080
lowered, and what the 
researchers demonstrated is 

403
00:20:09,080 --> 00:20:11,400
chilling. 
If they compromise the public 

404
00:20:11,400 --> 00:20:14,520
charger, or if they managed to 
manipulate the physical pins or 

405
00:20:14,520 --> 00:20:18,560
the PLC modems inside the cable,
they can completely bypass all 

406
00:20:18,560 --> 00:20:21,640
the sophisticated wireless 
cybersecurity defenses that the 

407
00:20:21,640 --> 00:20:23,280
car manufacturer built in the 
cloud. 

408
00:20:23,680 --> 00:20:26,800
They just start injecting low 
level unauthenticated commands 

409
00:20:27,000 --> 00:20:29,400
directly onto the hardware bus 
of the vehicle. 

410
00:20:29,480 --> 00:20:32,040
You're bypassing the castle's 
firewall by crawling up through 

411
00:20:32,040 --> 00:20:33,640
the sewer pipes. 
Basically, yeah. 

412
00:20:33,760 --> 00:20:36,080
They can tell the brakes to 
disengage, they can tell the 

413
00:20:36,080 --> 00:20:38,160
battery to ignore it's 
temperature sensors. 

414
00:20:38,160 --> 00:20:40,920
It is the absolute worst case 
scenario. 

415
00:20:41,040 --> 00:20:43,120
Everything we are discussing 
here can't. 

416
00:20:43,120 --> 00:20:46,200
Bus injections, man in the 
middle protocols, firmware 

417
00:20:46,200 --> 00:20:48,280
rollbacks. 
It all sounds like really 

418
00:20:48,280 --> 00:20:50,760
advanced sci-fi. 
Like intelligence agencies by 

419
00:20:50,760 --> 00:20:53,840
tactics. 
But then when you keep reading 

420
00:20:53,840 --> 00:20:57,120
the sources, you hit the real 
world examples of how actual 

421
00:20:57,120 --> 00:21:00,040
charging station providers are 
managing their infrastructure, 

422
00:21:00,400 --> 00:21:02,360
and the dissonance just makes 
you want to bang your head 

423
00:21:02,360 --> 00:21:05,760
against a desk. 
I know the massive, unfathomable

424
00:21:05,760 --> 00:21:08,200
gap between the mathematical 
sophistication of the threat 

425
00:21:08,200 --> 00:21:11,560
vectors and the raw, almost 
comical administrative 

426
00:21:11,560 --> 00:21:13,920
incompetence of some operators 
in this space. 

427
00:21:14,480 --> 00:21:16,640
It's hard to believe until you 
actually read the incident 

428
00:21:16,640 --> 00:21:18,480
reports. 
Let's talk about those absurd 

429
00:21:18,480 --> 00:21:21,000
incidents. 
I mean, Human 2 owned 2024. 

430
00:21:21,040 --> 00:21:23,560
The researchers are analyzing a 
charging station from a 

431
00:21:23,720 --> 00:21:26,600
legitimate vendor, a real 
company with hardware deployed 

432
00:21:26,600 --> 00:21:28,960
in actual cities, and they 
discovered that the software 

433
00:21:28,960 --> 00:21:32,720
engineers had embedded a private
AWS access key, Amazon Web 

434
00:21:32,720 --> 00:21:36,120
Services, directly inside the 
static firmware of the charger. 

435
00:21:36,280 --> 00:21:39,320
It's just monumental negligence.
To put this in perspective for 

436
00:21:39,320 --> 00:21:42,920
you, AWS is the cloud 
infrastructure that houses 

437
00:21:42,920 --> 00:21:46,120
entire databases, billing 
servers, customer profiles. 

438
00:21:46,760 --> 00:21:50,120
Embedding an admin access key 
into the uncompiled code of a 

439
00:21:50,120 --> 00:21:53,680
physical device sitting on the 
street is well, it's the digital

440
00:21:53,680 --> 00:21:56,720
equivalent of spending millions 
to build the world's most secure

441
00:21:56,720 --> 00:22:00,800
bank vault with retina scanners,
laser sensors and armed guards, 

442
00:22:01,040 --> 00:22:03,880
and then deciding to take the 
physical master key under the 

443
00:22:03,880 --> 00:22:07,480
welcome mat at the front door. 
And just assuming nobody's going

444
00:22:07,480 --> 00:22:10,880
to look under the mat, anyone 
who plugs in a laptop, extracts 

445
00:22:10,880 --> 00:22:14,720
that firmware, and runs a simple
text search tool has the keys to

446
00:22:14,720 --> 00:22:17,120
the entire corporate cloud 
Kingdom of that that energy 

447
00:22:17,120 --> 00:22:19,400
company. 
And it is not an isolated case 

448
00:22:19,400 --> 00:22:22,480
of stupidity, either. 
Consider the 2023 incident with 

449
00:22:22,480 --> 00:22:25,360
the Electrify America network, 
which was widely documented. 

450
00:22:25,720 --> 00:22:28,160
Researchers found that public 
charging stations out on the 

451
00:22:28,160 --> 00:22:30,400
streets were running active 
Teamviewer sessions. 

452
00:22:30,560 --> 00:22:34,600
Wait, Teamviewer? 
Like the free remote desktop 

453
00:22:34,600 --> 00:22:37,320
software with the blue icon that
I used to log into my 

454
00:22:37,320 --> 00:22:39,440
grandmother's laptop to fix her 
printer. 

455
00:22:39,600 --> 00:22:42,280
That exact one. 
And it wasn't just installed. 

456
00:22:42,400 --> 00:22:45,240
The sessions were exposed to the
network and in many cases not 

457
00:22:45,240 --> 00:22:48,720
properly authenticated. 
And here we are back at the root

458
00:22:48,720 --> 00:22:50,840
of the cybersecurity maturity 
problem. 

459
00:22:51,400 --> 00:22:54,840
This happens because they are 
treating complex cyberkinetic 

460
00:22:54,840 --> 00:22:58,240
industrial machinery like it's 
an HR computer in an air 

461
00:22:58,240 --> 00:23:00,720
conditioned office. 
It's just pure operational 

462
00:23:00,720 --> 00:23:01,880
laziness. 
Totally. 

463
00:23:01,960 --> 00:23:05,120
The infrastructure managers 
think, hey, sending a certified 

464
00:23:05,120 --> 00:23:08,040
technician in a truck every time
a touch screen freezes on a 

465
00:23:08,040 --> 00:23:10,160
charger in the middle of nowhere
is really expensive. 

466
00:23:10,800 --> 00:23:14,240
Let's just install a standard 
remote desktop tool so the tier 

467
00:23:14,240 --> 00:23:17,120
one support team at our call 
center can reboot the machine 

468
00:23:17,120 --> 00:23:20,040
with a click. 
The intention is cost savings 

469
00:23:20,040 --> 00:23:23,080
and efficiency. 
But by doing that without 

470
00:23:23,080 --> 00:23:26,520
segmenting the network, without 
using strict virtual private 

471
00:23:26,520 --> 00:23:31,040
networks or VPNs, without multi 
factor or biometric access 

472
00:23:31,040 --> 00:23:32,520
controls. 
They basically left an 

473
00:23:32,520 --> 00:23:35,000
administrative backdoor with 
full operating system 

474
00:23:35,000 --> 00:23:37,240
privileges. 
Why open to the public Internet?

475
00:23:37,360 --> 00:23:40,760
Just waiting for any automated 
port scanner to find it and walk

476
00:23:40,760 --> 00:23:43,440
right in. 
And that frankly drags us into 

477
00:23:43,440 --> 00:23:47,040
the third major issue of our 
deep dive today, the blast 

478
00:23:47,040 --> 00:23:49,320
radius. 
Because once we understand the 

479
00:23:49,320 --> 00:23:52,360
attackers already know how to 
get in through the cable, and we

480
00:23:52,360 --> 00:23:54,280
know that sometimes the 
companies literally just leave 

481
00:23:54,280 --> 00:23:57,880
the Teamviewer backdoor open for
them, the pressing question is 

482
00:23:58,000 --> 00:24:00,560
what happens when the attacker 
actually decides to turn the 

483
00:24:00,560 --> 00:24:03,520
key? 
Let's talk about the impacts. 

484
00:24:03,600 --> 00:24:05,680
And we need to start local 
before we get to the end of the 

485
00:24:05,680 --> 00:24:07,280
world stuff. 
We are just talking about 

486
00:24:07,280 --> 00:24:10,120
teenage hackers stealing free 
electricity to avoid paying a 

487
00:24:10,120 --> 00:24:11,920
bill. 
Although they absolutely could 

488
00:24:11,920 --> 00:24:15,080
do that and theft of service is 
going to be a multi $1,000,000 

489
00:24:15,080 --> 00:24:18,360
problem on its own. 
But stealing electricity is 

490
00:24:18,360 --> 00:24:20,760
anecdotal compared to the value 
of the data. 

491
00:24:21,080 --> 00:24:25,440
Look at November 2024 reports 
detailed a massive silent data 

492
00:24:25,440 --> 00:24:28,080
breach of a central database 
belonging to a charging 

493
00:24:28,080 --> 00:24:31,120
operator. 
It compromised huge logs of 

494
00:24:31,200 --> 00:24:34,800
personally identifiable 
information PII of users across 

495
00:24:34,800 --> 00:24:37,640
multiple vendor networks. 
And PII in this context isn't 

496
00:24:37,640 --> 00:24:38,760
just your name and e-mail, 
right? 

497
00:24:39,080 --> 00:24:41,640
Oh, it's so much richer. 
They have your name, your 

498
00:24:41,640 --> 00:24:45,040
banking info tied to the RFID 
charging account, the unique 

499
00:24:45,040 --> 00:24:48,200
identifier of your very 
expensive vehicle, and the most 

500
00:24:48,200 --> 00:24:51,680
alarming part, the transactional
logs that reveal your precise 

501
00:24:51,680 --> 00:24:55,480
geolocations with time stamps. 
So they know exactly what time 

502
00:24:55,480 --> 00:24:58,760
of night, what days of the week 
you leave your car parked and 

503
00:24:58,760 --> 00:25:01,360
immobilized at a specific remote
charger. 

504
00:25:01,640 --> 00:25:04,200
They know when you charge at 
home, when you are at work, when

505
00:25:04,200 --> 00:25:07,320
you are traveling. 
It's literally a real time map 

506
00:25:07,320 --> 00:25:10,040
of your life. 
It is a stalker's wet dream and 

507
00:25:10,040 --> 00:25:13,560
an absolute goldmine for 
identity theft rings or in 

508
00:25:13,560 --> 00:25:15,960
corporate and government 
scenarios, for intelligence on 

509
00:25:15,960 --> 00:25:18,880
personnel movements. 
The security research from 

510
00:25:18,880 --> 00:25:21,360
Sandia National Lab also 
highlights how this data 

511
00:25:21,360 --> 00:25:24,800
harvesting is facilitated by the
absurd exposure of Bluetooth Low

512
00:25:24,800 --> 00:25:28,280
energy traffic BLE. 
A lot of chargers use Bluetooth 

513
00:25:28,280 --> 00:25:31,360
to talk to the apps on your 
phone to initiate a session, and

514
00:25:31,360 --> 00:25:34,480
Sandhya found that often this 
BLE communication is completely 

515
00:25:34,480 --> 00:25:37,000
unencrypted. 
A criminal can just sit in a car

516
00:25:37,000 --> 00:25:39,760
30 feet away with a simple 
packet sniffer and capture your 

517
00:25:39,760 --> 00:25:41,880
login credentials as you walk up
to the charger. 

518
00:25:42,160 --> 00:25:44,400
OK, privacy and identity theft 
are terrible. 

519
00:25:44,840 --> 00:25:47,840
But where this topic made me 
stop reading, where the dark 

520
00:25:47,840 --> 00:25:51,000
humor I used to cope with 
technological terror almost 

521
00:25:51,000 --> 00:25:53,960
failed me completely, is when 
the reports pivot to the 

522
00:25:53,960 --> 00:25:56,760
physical threats. 
I want to go back to a term. 

523
00:25:56,760 --> 00:26:00,440
The Sandia report used the 
potential compromise of EBSC 

524
00:26:00,520 --> 00:26:03,200
life safety systems. 
So stop right there and break 

525
00:26:03,200 --> 00:26:05,360
that down. 
What does life safety systems 

526
00:26:05,360 --> 00:26:08,560
mean when we are talking about 
an appliance that charges a car?

527
00:26:08,960 --> 00:26:10,280
It sounds like hospital 
equipment. 

528
00:26:10,520 --> 00:26:14,040
It sounds dramatic, but it is 
the correct technical term. 

529
00:26:14,080 --> 00:26:16,880
You have to visualize the 
physical forces we are playing 

530
00:26:16,880 --> 00:26:20,080
with here in DC. 
Fast charging direct current. 

531
00:26:20,080 --> 00:26:22,800
We're not talking about the wall
outlet that powers your toaster.

532
00:26:22,920 --> 00:26:25,240
We're talking about industrial 
levels of power. 

533
00:26:25,360 --> 00:26:29,240
We are funneling up to 800 volts
of tension and three to 400 amps

534
00:26:29,240 --> 00:26:33,080
of direct current through cables
into a highly volatile chemical 

535
00:26:33,080 --> 00:26:35,040
battery. 
It's an insane amount of energy 

536
00:26:35,040 --> 00:26:38,440
flowing inches from your hand. 
It is lethal energy if that 

537
00:26:38,440 --> 00:26:41,560
transfer is not managed with 
absolute math medical precision.

538
00:26:41,840 --> 00:26:45,240
That amount of current will melt
copper, it will fuse plastics, 

539
00:26:45,480 --> 00:26:48,480
it will cause electrical arcs 
that can start unstoppable 

540
00:26:48,480 --> 00:26:51,520
lithium fires or just straight 
up electrocute a human being 

541
00:26:51,520 --> 00:26:54,800
instantly and fatally. 
The life safety systems are the 

542
00:26:54,800 --> 00:26:56,840
critical hardware and firmware 
components. 

543
00:26:57,120 --> 00:27:00,240
The physical contactor relays, 
the thermal sensors in the plug 

544
00:27:00,240 --> 00:27:02,320
handle, the logic software 
loops. 

545
00:27:02,640 --> 00:27:05,600
Their only job is to monitor 
everything millisecond by 

546
00:27:05,600 --> 00:27:09,120
millisecond, and if the cable 
gets 1° above the limit, or if 

547
00:27:09,120 --> 00:27:12,240
they detect a resistance 
anomaly, they brutally stop the 

548
00:27:12,240 --> 00:27:14,960
current, cutting the circuit. 
But yes, like you said earlier, 

549
00:27:14,960 --> 00:27:17,200
a remote attacker manages to 
exploit one of those 

550
00:27:17,200 --> 00:27:20,840
vulnerabilities, injects multis 
code and gets remote execution 

551
00:27:20,840 --> 00:27:23,160
on the logic microcontroller 
governing that station. 

552
00:27:23,480 --> 00:27:26,560
The attacker now has the ability
to rewrite the rules of that 

553
00:27:26,560 --> 00:27:29,960
physics. 
They can theoretically override 

554
00:27:29,960 --> 00:27:32,520
those built in safety limits. 
They could send a command to the

555
00:27:32,520 --> 00:27:36,320
charger that says ignore the 
thermal sensor alert, ignore the

556
00:27:36,320 --> 00:27:39,560
maximum voltage limit the car is
requesting, keep pumping the 

557
00:27:39,560 --> 00:27:43,000
maximum current the grid can 
supply no matter what, and do 

558
00:27:43,000 --> 00:27:44,960
not open the relays to cut the 
flow. 

559
00:27:45,160 --> 00:27:47,400
You were talking about causing 
intentional physical harm 

560
00:27:47,400 --> 00:27:50,000
through a computer. 
It's a pure cyber kinetic 

561
00:27:50,000 --> 00:27:54,000
scenario, using a digital attack
vector to manifest thermal and 

562
00:27:54,000 --> 00:27:56,640
kinetic destruction in the real 
physical world. 

563
00:27:56,840 --> 00:28:00,200
They can overcharge the vehicles
battery cells, damaging them 

564
00:28:00,200 --> 00:28:02,760
irreparably and turning the car 
into instant scrap metal. 

565
00:28:03,160 --> 00:28:06,720
Or worse, induced thermal 
runaway in the lithium battery, 

566
00:28:07,040 --> 00:28:09,960
creating an explosive fire 
hazard in the middle of a gas 

567
00:28:09,960 --> 00:28:11,920
station or in the victim's home 
garage. 

568
00:28:12,040 --> 00:28:15,200
That just freezes your blood. 
You are literally transforming a

569
00:28:15,200 --> 00:28:18,720
piece of green public utility 
infrastructure into a remote 

570
00:28:18,720 --> 00:28:22,120
controlled incendiary weapon. 
And that is so hard to process. 

571
00:28:22,520 --> 00:28:25,120
But what is even more more 
credible about this research is 

572
00:28:25,120 --> 00:28:28,800
that localized physical damage 
to a single vehicle isn't even 

573
00:28:28,800 --> 00:28:30,440
the ultimate nightmare scenario 
here. 

574
00:28:30,600 --> 00:28:33,000
We have to pull the camera back 
and take this conversation to 

575
00:28:33,000 --> 00:28:36,320
the macro level into large scale
dystopian territory. 

576
00:28:36,320 --> 00:28:38,560
And this brings us to BI 
Directional integration and the 

577
00:28:38,560 --> 00:28:42,720
magic acronyms VDG Vehicle to 
grid and V2 X Vehicle to 

578
00:28:42,720 --> 00:28:45,080
everything. 
Explain the concept because this

579
00:28:45,080 --> 00:28:47,000
is the green utopia everyone is 
selling. 

580
00:28:47,080 --> 00:28:49,280
And it is a brilliant utopia on 
paper. 

581
00:28:49,360 --> 00:28:52,320
The vision for the next decade 
of electrification isn't just 

582
00:28:52,320 --> 00:28:55,080
that the grid powers the cars. 
The idea is that electric 

583
00:28:55,080 --> 00:28:57,880
vehicles act as this immense 
distributed battery system on 

584
00:28:57,880 --> 00:28:59,960
wheels. 
With V2G interfaces. 

585
00:28:59,960 --> 00:29:02,680
Vehicles don't just consume 
energy, they store it, they hold

586
00:29:02,680 --> 00:29:04,360
it. 
And most importantly, they can 

587
00:29:04,360 --> 00:29:06,040
push it back into the public 
power grid. 

588
00:29:06,040 --> 00:29:08,920
During national demand peaks, 
your car becomes a node in a 

589
00:29:08,920 --> 00:29:12,920
massive virtual power plant. 
Which logistically sounds like 

590
00:29:12,920 --> 00:29:15,920
an efficiency miracle. 
I picture a sweltering Tuesday 

591
00:29:15,920 --> 00:29:18,520
in August. 
I get home from work at 6:00 PM.

592
00:29:18,960 --> 00:29:20,840
Everyone in the city is turning 
on their AC units. 

593
00:29:20,840 --> 00:29:22,560
The grid is groaning under the 
pressure. 

594
00:29:23,000 --> 00:29:25,760
Instead of plugging my car in 
and draining the grid even more,

595
00:29:25,760 --> 00:29:30,360
causing a blackout, my connected
car recognizes the demand peak 

596
00:29:30,960 --> 00:29:34,000
and starts feeding power from 
its massive battery back into my

597
00:29:34,000 --> 00:29:36,160
neighborhood grid, stabilizing 
it. 

598
00:29:36,760 --> 00:29:39,680
And then at 3:00 AM, when demand
drops and wind power is cheap 

599
00:29:39,680 --> 00:29:41,840
and abundant, the car recharges 
itself. 

600
00:29:42,360 --> 00:29:44,840
It is a marvel of smart grid 
engineering, yes, but 

601
00:29:44,840 --> 00:29:47,520
architecturally, from the 
perspective of a military 

602
00:29:47,520 --> 00:29:51,240
cybersecurity analyst, it means 
you just enabled a high speed 

603
00:29:51,240 --> 00:29:54,160
two way communication conduit 
directly between millions of 

604
00:29:54,160 --> 00:29:56,960
vulnerable mobile batteries 
parked in garages and the 

605
00:29:56,960 --> 00:29:59,400
critical infrastructure 
Transformers of an entire 

606
00:29:59,400 --> 00:30:02,040
nation. 
V2G interfaces elevate the 

607
00:30:02,040 --> 00:30:03,960
status of a humble street corner
charger. 

608
00:30:04,320 --> 00:30:06,840
They turn them instantly into 
ultra high value national 

609
00:30:06,840 --> 00:30:10,360
infrastructure targets. 
So I usually use my dark humor 

610
00:30:10,760 --> 00:30:13,280
trying to cope with the 
ridiculous fact that if I 

611
00:30:13,280 --> 00:30:17,160
misconfigure my car's app after 
a long day, I might accidentally

612
00:30:17,160 --> 00:30:18,800
cause the lights in my house to 
flicker. 

613
00:30:19,440 --> 00:30:22,080
But what you are saying is that 
if these networks fall into the 

614
00:30:22,080 --> 00:30:24,960
hands of a real sophisticated 
attacker. 

615
00:30:25,520 --> 00:30:28,960
I think big picture if a 
criminal cell or a nation state 

616
00:30:28,960 --> 00:30:34,200
actor compromises just one major
chargepoint operator ACPO and 

617
00:30:34,200 --> 00:30:37,520
gains remote administrative 
access to a database controlling

618
00:30:37,520 --> 00:30:41,360
10s of thousands of distributed 
V2G chargers across a major 

619
00:30:41,360 --> 00:30:43,960
metropolitan region. 
They don't just attack one car, 

620
00:30:43,960 --> 00:30:46,520
they launch a synchronized 
attack like a swarm. 

621
00:30:46,640 --> 00:30:49,240
Exactly. 
They could use a vulnerability 

622
00:30:49,240 --> 00:30:53,000
in the OCPP protocol or a cloud 
back door to send a simultaneous

623
00:30:53,000 --> 00:30:55,440
command to 30,000 high capacity 
vehicles. 

624
00:30:56,040 --> 00:31:00,320
Imagine telling those 30,000 
vehicles to, at exactly 2.0 PM 

625
00:31:00,320 --> 00:31:02,800
on the hottest day of the 
summer, instantly switched from 

626
00:31:02,800 --> 00:31:05,800
resting to pulling the absolute 
violent maximum amount of power 

627
00:31:05,800 --> 00:31:07,840
possible from the grid 
simultaneously. 

628
00:31:07,920 --> 00:31:10,160
Or the reverse scenario, which I
assume is just as bad. 

629
00:31:11,480 --> 00:31:14,320
They ordered those thousands of 
vehicles which were peacefully 

630
00:31:14,320 --> 00:31:17,640
feeding the grid to 
intermittently inject massive, 

631
00:31:17,640 --> 00:31:21,160
erratic, out of phase power 
spikes right back into the local

632
00:31:21,160 --> 00:31:23,880
transmission lines. 
You are basically creating a 

633
00:31:23,920 --> 00:31:27,760
grid level frequency disturbance
or a massive artificial demand 

634
00:31:27,760 --> 00:31:31,000
spike that the city's systems 
cannot predict or handle. 

635
00:31:31,120 --> 00:31:33,920
And that is exactly how you 
destabilize and collapse a 

636
00:31:33,920 --> 00:31:38,000
modern, fragile power grid. 
Those artificial demand spikes 

637
00:31:38,000 --> 00:31:41,200
or dirty frequency injections 
can blow out local substation 

638
00:31:41,200 --> 00:31:44,240
Transformers, cause the 
automated safety fail safes at 

639
00:31:44,240 --> 00:31:47,280
major power plants to trip out 
of precaution, and trigger a 

640
00:31:47,280 --> 00:31:49,680
catastrophic cascade of rolling 
blackouts. 

641
00:31:49,840 --> 00:31:51,640
You could literally blind an 
entire city. 

642
00:31:51,720 --> 00:31:55,600
We are taking the 21st century 
star ecological solution and 

643
00:31:55,600 --> 00:31:58,040
weaponizing it without even 
realizing it, turning it into 

644
00:31:58,040 --> 00:32:01,080
the ultimate cyber warfare 
attack vector hidden in plain 

645
00:32:01,080 --> 00:32:02,800
sight. 
OK, I need to take a sanity 

646
00:32:02,800 --> 00:32:04,840
pause here. 
Are we seeing this happen right 

647
00:32:04,840 --> 00:32:06,640
now? 
Are foreign military minutes 

648
00:32:06,640 --> 00:32:09,240
hacking charging stations at 
local gas stations today? 

649
00:32:09,280 --> 00:32:11,760
I need to know if the sky is 
actually falling or if we're 

650
00:32:11,760 --> 00:32:15,880
just seeing the cracks. 
No, the sky is not falling today

651
00:32:15,960 --> 00:32:18,880
and it's crucial to clarify that
so we don't just foster blind 

652
00:32:18,880 --> 00:32:21,080
panic. 
The intelligence community and 

653
00:32:21,080 --> 00:32:24,360
the researchers we read clearly 
state that there is no current 

654
00:32:24,360 --> 00:32:26,520
evidence of advanced persistent 
threats. 

655
00:32:26,760 --> 00:32:30,200
The famous nation state funded 
AP TS like groups tied to 

656
00:32:30,200 --> 00:32:33,480
Russia, North Korea or China 
carrying out large scale 

657
00:32:33,480 --> 00:32:36,320
destructive kinetic attacks 
against EVSE infrastructure. 

658
00:32:36,760 --> 00:32:39,880
Yet there are no blackouts 
caused by electric cars. 

659
00:32:39,920 --> 00:32:42,960
I feel a colossal butt hovering 
in the air right now. 

660
00:32:43,040 --> 00:32:46,560
The mountain sized butt, because
what we do see actively in daily

661
00:32:46,560 --> 00:32:49,320
in the network logs are ordinary
cyber criminal bot Nets, 

662
00:32:49,320 --> 00:32:51,840
ransomware gangs and 
vulnerability research scanners 

663
00:32:51,840 --> 00:32:53,560
aggressively probing the 
ecosystem. 

664
00:32:53,960 --> 00:32:56,280
They are mapping the network 
topologies, they are testing the

665
00:32:56,280 --> 00:32:59,920
API defenses, looking for 
misconfigured OCPP servers and 

666
00:32:59,920 --> 00:33:02,560
scraping databases. 
All the deep tactical 

667
00:33:02,560 --> 00:33:04,040
reconnaissance work is happening
right now. 

668
00:33:04,040 --> 00:33:05,200
They're drawing the treasure 
map. 

669
00:33:05,320 --> 00:33:08,080
They're outlining the entire 
attack surface. 

670
00:33:08,280 --> 00:33:10,280
And the golden rule of 
cybersecurity is this. 

671
00:33:11,280 --> 00:33:14,880
If a financially motivated mid 
level cyber criminal can get 

672
00:33:14,880 --> 00:33:18,080
into a network by bypassing a 
weak authentication check to 

673
00:33:18,080 --> 00:33:21,920
mine cryptocurrency or steal 
credit cards, rest assured that 

674
00:33:21,920 --> 00:33:25,520
a nation state threat actor with
unlimited resources can also get

675
00:33:25,520 --> 00:33:28,480
in. 
And what states do isn't steel. 

676
00:33:28,600 --> 00:33:32,000
They hide, they infiltrate, they
establish persistence deep 

677
00:33:32,000 --> 00:33:34,400
inside the infrastructure's 
firmware, and they wait 

678
00:33:34,400 --> 00:33:37,720
patiently for years until 
geopolitical tensions flare up 

679
00:33:37,720 --> 00:33:40,000
and they need to push a button 
to cause civil chaos. 

680
00:33:40,280 --> 00:33:42,960
The incalculable strategic value
is already there. 

681
00:33:43,160 --> 00:33:46,080
Which relentlessly drags us 
toward the next pit of despair. 

682
00:33:46,080 --> 00:33:49,400
In our analysis of the sources. 
Metro grid is at imminent risk, 

683
00:33:49,600 --> 00:33:53,000
our personal privacy and PII is 
exposed, automotive computers 

684
00:33:53,000 --> 00:33:55,760
can be remote controlled and 
cars might end up the smoking 

685
00:33:55,760 --> 00:33:58,080
$80,000 paperweights with melted
batteries. 

686
00:33:58,600 --> 00:34:01,640
So the $1,000,000 follow up 
question, who on earth do we 

687
00:34:01,640 --> 00:34:04,160
blame when the music stops? 
Let's wade into the absolute 

688
00:34:04,160 --> 00:34:07,040
abyss that is the legal and 
regulatory landscape of the EV 

689
00:34:07,200 --> 00:34:09,639
ecosystem. 
It is the governance nightmare 

690
00:34:09,639 --> 00:34:12,159
that the upstream reports 
highlighted in bright red. 

691
00:34:12,360 --> 00:34:15,320
I would call it the nightmare of
fragmented liability. 

692
00:34:15,679 --> 00:34:18,400
To understand the panic in 
corporate boardrooms right now, 

693
00:34:18,520 --> 00:34:21,520
you have to understand the 
brutal paradigm shift the 

694
00:34:21,520 --> 00:34:23,040
automotive industry is going 
through. 

695
00:34:23,639 --> 00:34:27,199
For over 100 years, the security
of a car ended physically and 

696
00:34:27,199 --> 00:34:29,960
logically at the sheet metal of 
the hood and the door lock. 

697
00:34:30,679 --> 00:34:32,840
If the engine was sealed tight, 
you were safe. 

698
00:34:33,360 --> 00:34:36,120
And even as cars filled up with 
computers over the last decade, 

699
00:34:36,320 --> 00:34:39,600
the ultimate defensive perimeter
was the ECU, the electronic 

700
00:34:39,600 --> 00:34:43,000
control unit of the vehicle. 
The car was essentially a 

701
00:34:43,000 --> 00:34:47,199
self-contained digital castle 
surrounded by a massive Moat. 

702
00:34:47,760 --> 00:34:48,840
Right. 
And what are the strategy 

703
00:34:48,840 --> 00:34:51,520
documents we read? 
I think from Cone literally had 

704
00:34:51,520 --> 00:34:54,360
this blunt heading that said 
automotive cybersecurity cannot 

705
00:34:54,360 --> 00:34:57,280
stop at the ECU anymore. 
Because the castle is no longer 

706
00:34:57,280 --> 00:35:00,200
isolated, you can no longer just
build high walls on your car and

707
00:35:00,200 --> 00:35:03,520
call it a day, because that 
castle now lowers a massive 

708
00:35:03,520 --> 00:35:07,600
drawbridge of copper and fiber 
optics to connect to a strange 

709
00:35:07,600 --> 00:35:10,680
village, which is the public 
charging station, several times 

710
00:35:10,680 --> 00:35:13,000
a week. 
And the problem is, from a 

711
00:35:13,000 --> 00:35:16,880
cybersecurity perspective, that 
village is constantly on fire. 

712
00:35:17,360 --> 00:35:20,480
A modern attacker doesn't need 
to spend millions of dollars 

713
00:35:20,480 --> 00:35:23,720
trying to hack the car directly 
anymore, trying to penetrate the

714
00:35:23,720 --> 00:35:28,040
complex cellular firewall that a
BMW or Tesla engineer built. 

715
00:35:28,040 --> 00:35:30,680
It would be a waste of effort to
attack the strongest point. 

716
00:35:30,720 --> 00:35:32,600
Exactly. 
Instead, they take the path of 

717
00:35:32,600 --> 00:35:34,960
least resistance. 
They just make a lateral move 

718
00:35:34,960 --> 00:35:36,440
through the adjacent 
infrastructure. 

719
00:35:36,960 --> 00:35:40,160
They exploit an old unpatched 
router on a poorly segmented 

720
00:35:40,160 --> 00:35:43,240
charging network at a delivery 
van depot, or they infiltrate 

721
00:35:43,240 --> 00:35:45,520
the free Wi-Fi at a car 
dealership, or they hack the 

722
00:35:45,520 --> 00:35:47,920
outdated software on a public 
charger in a mall basement. 

723
00:35:48,520 --> 00:35:51,120
Once they are inside the village
they just cross the drawbridge 

724
00:35:51,120 --> 00:35:53,560
into the car the exact moment it
plugs in. 

725
00:35:53,840 --> 00:35:57,040
OK, let me pose a legal dilemma 
to you that I distilled from the

726
00:35:57,040 --> 00:35:59,960
liability reports. 
The situation that in my notes 

727
00:35:59,960 --> 00:36:01,560
I've called the pasted text 
dilemma. 

728
00:36:02,560 --> 00:36:04,760
This is the ultimate 
hypothetical scenario and I want

729
00:36:04,760 --> 00:36:07,000
you to walk me through the legal
carnage. 

730
00:36:07,720 --> 00:36:11,080
Let's say I empty my savings to 
buy a brand new luxury electric 

731
00:36:11,080 --> 00:36:13,280
vehicle. 
The automakers factory assembled

732
00:36:13,280 --> 00:36:15,920
it to absolute perfection. 
It passes every test. 

733
00:36:16,240 --> 00:36:19,400
It rolls off the production line
in Detroit, Oregon, Stuttgart as

734
00:36:19,400 --> 00:36:21,480
an impenetrable digital 
fortress. 

735
00:36:22,000 --> 00:36:24,640
It's got real time software 
validation, secure boot, 

736
00:36:24,840 --> 00:36:26,760
military grade encryption on the
ECU. 

737
00:36:26,760 --> 00:36:29,720
Everything is beautiful. 
I drive this hyper secure tank 

738
00:36:29,720 --> 00:36:33,240
for a week, then I run low on 
battery and I pull up to a high 

739
00:36:33,240 --> 00:36:36,440
speed public charger operated by
a third party franchise network 

740
00:36:36,440 --> 00:36:39,600
in the middle of the highway. 
Turns out that public charger 

741
00:36:39,600 --> 00:36:42,800
was previously compromised by a 
ransomware gang, maybe through 

742
00:36:42,800 --> 00:36:44,720
one of those OCPP flaws we 
talked about. 

743
00:36:44,720 --> 00:36:46,920
I follow you. 
The charger is compromised and 

744
00:36:46,920 --> 00:36:50,200
let's say the moment I plug my 
perfect tank in the chargers 

745
00:36:50,200 --> 00:36:53,240
infected firmware attacks the 
physical Southwest can 

746
00:36:53,240 --> 00:36:57,160
interface, injects A payload 
that exploits A microscopic flaw

747
00:36:57,160 --> 00:37:00,600
in how my car reads voltage and 
the result is that the vehicle's

748
00:37:00,600 --> 00:37:03,600
main computer permanently bricks
the main battery as a poorly 

749
00:37:03,600 --> 00:37:08,440
executed fail safe mechanism. 
My car is paralyzed, dead and 

750
00:37:08,440 --> 00:37:12,440
simultaneously my bank data tied
to the cars A is extracted and 

751
00:37:12,440 --> 00:37:14,760
sold. 
My question to you, looking at 

752
00:37:14,760 --> 00:37:17,760
the current structure of the 
industry is whose fault is it? 

753
00:37:18,280 --> 00:37:20,520
Who owns that financial 
monstrous risk? 

754
00:37:20,880 --> 00:37:23,640
Whose lawyers do I sue to get my
$80,000 back? 

755
00:37:24,040 --> 00:37:26,680
Wow, well I wish you the best of
luck trying to figure out which 

756
00:37:26,680 --> 00:37:28,960
office to even serve that 
lawsuit to, because your 

757
00:37:28,960 --> 00:37:31,280
question is exactly the 
bottomless pit that is keeping 

758
00:37:31,280 --> 00:37:33,680
corporate risk mitigation 
lawyers awake and sweating cold 

759
00:37:33,680 --> 00:37:35,960
all over the world right now. 
You have just described an 

760
00:37:35,960 --> 00:37:39,160
unbearably tangled web of 
fragmented liability where 

761
00:37:39,160 --> 00:37:41,920
multiple entities control the 
ecosystem, but nobody actually 

762
00:37:41,920 --> 00:37:43,840
owns the complete life cycle of 
the session. 

763
00:37:43,880 --> 00:37:47,000
Break this down for me, who is 
on my list of legal targets. 

764
00:37:47,520 --> 00:37:50,080
Well, you have a lineup of 
defendants and they are all 

765
00:37:50,080 --> 00:37:53,920
pointing fingers at each other. 
First, as a consumer you go to 

766
00:37:53,920 --> 00:37:56,920
the original equipment 
manufacturer, the OEM, meaning 

767
00:37:57,120 --> 00:37:58,920
the car brand that sold you the 
vehicle. 

768
00:37:59,560 --> 00:38:03,000
Their lawyers look at you and 
say our car was structurally 

769
00:38:03,000 --> 00:38:05,760
perfect and met every ISO 
regulation. 

770
00:38:06,040 --> 00:38:09,280
The problem was the malware 
injected by the third party 

771
00:38:09,280 --> 00:38:12,040
station you chose to plug into 
Sue the station. 

772
00:38:12,440 --> 00:38:14,920
Fine, so I go to the company 
that built the metal post. 

773
00:38:15,120 --> 00:38:18,160
You go to the chargers hardware 
manufacturer, they will respond.

774
00:38:18,160 --> 00:38:20,240
Look, we just bent the metal and
assembled the circuits. 

775
00:38:20,240 --> 00:38:22,640
The hardware was fine. 
The software was compromised the

776
00:38:22,640 --> 00:38:26,680
exclusive responsibility of the 
Chargepoint operator, the CPO 

777
00:38:26,880 --> 00:38:28,720
who manages the remote 
management system. 

778
00:38:28,960 --> 00:38:32,240
So you escalate and go to the 
corporate offices of the CPO. 

779
00:38:32,280 --> 00:38:33,640
Surely they have to take the 
blame. 

780
00:38:33,880 --> 00:38:36,320
They run the network. 
The CPO will tell you. 

781
00:38:36,480 --> 00:38:40,120
Listen, we were passive victims 
of a sophisticated 0 day 

782
00:38:40,120 --> 00:38:43,440
vulnerability attack on the 
cloud server release which 

783
00:38:43,440 --> 00:38:45,320
should have been protected by 
our cloud provider. 

784
00:38:45,840 --> 00:38:49,080
Blame AWS or Azure for not 
filtering the traffic. 

785
00:38:49,480 --> 00:38:52,160
And if you somehow get to the 
cloud provider, they'll say the 

786
00:38:52,160 --> 00:38:56,080
regional energy network partner 
was the one who failed on their 

787
00:38:56,080 --> 00:38:58,840
API authentication protocols in 
the 1st place, leaving the 

788
00:38:58,840 --> 00:39:02,360
session open. 
It is the worst, most expensive 

789
00:39:02,360 --> 00:39:05,840
game of musical chairs in 
corporate history, and nobody in

790
00:39:05,840 --> 00:39:08,960
the entire supply chain wants to
sit down and take the blame. 

791
00:39:08,960 --> 00:39:11,720
When the destructive music 
stops, they all just wash their 

792
00:39:11,720 --> 00:39:14,000
hands of it. 
The liability just evaporates 

793
00:39:14,000 --> 00:39:16,120
into the cloud. 
But reading Upstream Security, 

794
00:39:16,120 --> 00:39:17,720
they made it very clear this has
a time limit. 

795
00:39:17,960 --> 00:39:20,800
They brought up some immensely 
serious regulatory implications 

796
00:39:20,800 --> 00:39:22,880
here. 
Because let's be real, federal 

797
00:39:22,880 --> 00:39:25,240
governments and trade 
commissions are not going to 

798
00:39:25,240 --> 00:39:28,040
just let this new national 
ecosystem burn to the ground 

799
00:39:28,040 --> 00:39:30,680
without intervening, 
legislating, or issuing 

800
00:39:30,680 --> 00:39:33,000
crippling fines to somebody. 
Absolutely not. 

801
00:39:33,000 --> 00:39:35,440
And government. 
Patience is wearing incredibly 

802
00:39:35,440 --> 00:39:37,120
thin. 
This is where federal and 

803
00:39:37,120 --> 00:39:40,320
European regulators are going to
use legislative brute force. 

804
00:39:40,960 --> 00:39:43,320
Upstream was prophetically clear
about this. 

805
00:39:43,560 --> 00:39:46,840
The compliance landscape is 
shifting beneath their feet as 

806
00:39:46,840 --> 00:39:50,560
sovereign data protection laws 
tighten with real teeth all over

807
00:39:50,560 --> 00:39:51,760
the world. 
I mean, think about the 

808
00:39:51,760 --> 00:39:55,120
destructive weight of GDPR in 
the European Union, or the 

809
00:39:55,120 --> 00:39:57,440
growing ramifications of 
consumer privacy laws in 

810
00:39:57,440 --> 00:40:00,760
California like CCPA. 
The patience for incompetence is

811
00:40:00,760 --> 00:40:03,320
0. 
Continuous leaks of personally 

812
00:40:03,320 --> 00:40:06,480
identifiable information through
porous, unencrypted charging 

813
00:40:06,480 --> 00:40:09,520
networks are not going to be 
forgiven or viewed as just the 

814
00:40:09,520 --> 00:40:12,280
growing pains of a new industry.
The regulatory agencies are 

815
00:40:12,280 --> 00:40:14,160
going to start. 
Issuing fines, they are going to

816
00:40:14,160 --> 00:40:16,680
issue financial. 
Death sentences agencies could 

817
00:40:16,680 --> 00:40:19,320
invite massive monetary 
penalties for every single 

818
00:40:19,400 --> 00:40:21,960
incident. 
And what people don't understand

819
00:40:21,960 --> 00:40:25,440
about the EV charging business 
is that right now a lot of these

820
00:40:25,440 --> 00:40:29,480
Chargepoint operators, the CP 
OS, they operate on incredibly 

821
00:40:29,480 --> 00:40:31,800
thin, almost microscopic profit 
margins. 

822
00:40:32,160 --> 00:40:34,560
They're burning capital trying 
to expand their physical 

823
00:40:34,560 --> 00:40:37,280
infrastructure footprint, 
installing capital intensive 

824
00:40:37,280 --> 00:40:40,480
hardware everywhere before mass 
EV adoption actually makes them 

825
00:40:40,480 --> 00:40:43,560
profitable. 
A massive regulatory fine for 

826
00:40:43,560 --> 00:40:47,400
GDPR non compliance or for cyber
security negligence that results

827
00:40:47,400 --> 00:40:49,960
in a massive bank data breach 
that could literally wipe out 

828
00:40:49,960 --> 00:40:52,920
their entire annual profit 
margin entirely or push them 

829
00:40:52,920 --> 00:40:56,600
straight into insolvency. 
If the CP, OS and OEMs don't sit

830
00:40:56,600 --> 00:40:59,240
down together and radically 
figure out holistic security at 

831
00:40:59,240 --> 00:41:01,960
the software level, data breach 
fines will bankrupt them long 

832
00:41:01,960 --> 00:41:04,240
before they can install the next
batch of charges on the highway,

833
00:41:04,560 --> 00:41:07,600
which pushes us inexorably. 
To our last point of analysis, 

834
00:41:07,760 --> 00:41:10,320
because we cannot leave our 
audience wallowing in this 

835
00:41:10,320 --> 00:41:13,880
absolute despair, we have to 
address how you cope with this 

836
00:41:13,880 --> 00:41:16,480
reality. 
We've navigated the dark pit, 

837
00:41:16,480 --> 00:41:20,480
the power grid threatened by V2G
spikes, personal info, stolen 

838
00:41:20,640 --> 00:41:23,880
car batteries turned into fire 
bombs, and the impenetrable 

839
00:41:23,880 --> 00:41:27,680
legal maze you just described. 
So, facing this mountain of grim

840
00:41:27,680 --> 00:41:31,360
evidence, the question is how on
earth is the industry responding

841
00:41:31,360 --> 00:41:34,440
to get ahead of this threat? 
What is the counterweight to all

842
00:41:34,440 --> 00:41:36,840
this chaos? 
Well, there is light at the. 

843
00:41:36,840 --> 00:41:39,920
End of this very dark tunnel, 
thankfully, and it comes from a 

844
00:41:39,920 --> 00:41:43,600
long overdue maturation toward 
an offensive security mindset 

845
00:41:43,600 --> 00:41:46,400
rather than a defensive one. 
Think back to the original 

846
00:41:46,400 --> 00:41:48,520
catalyst for this entire 
conversation today. 

847
00:41:48,800 --> 00:41:51,360
Everything we're discussing was 
triggered and documented by the 

848
00:41:51,360 --> 00:41:54,840
brutally honest findings of 
controlled white hat hacking 

849
00:41:54,840 --> 00:41:57,000
competitions. 
Right the Puno and Tuona van in.

850
00:41:57,000 --> 00:41:59,320
Tokyo Exactly. 
The mobility. 

851
00:41:59,320 --> 00:42:02,840
Industry is finally starting to 
adopt proactive measures by 

852
00:42:02,840 --> 00:42:05,680
intense, intentionally and 
structurally exposing themselves

853
00:42:05,680 --> 00:42:08,960
to these lethal attacks and test
environments instead of waiting 

854
00:42:08,960 --> 00:42:11,160
for cyber criminals to discover 
them on the street. 

855
00:42:11,400 --> 00:42:14,200
It's a fundamental shift. 
Look at the track record of the 

856
00:42:14,200 --> 00:42:17,200
research led by companies like 
Vicone and their involvement in 

857
00:42:17,200 --> 00:42:20,400
the zero day initiative, the 
ZDI, which the reports detail. 

858
00:42:20,440 --> 00:42:22,000
Yeah, the efficiency numbers 
they revealed. 

859
00:42:22,000 --> 00:42:24,200
There seemed honestly like a 
beacon of hope to me. 

860
00:42:24,680 --> 00:42:27,600
They reported the discovery, 
verification and responsible 

861
00:42:27,600 --> 00:42:32,280
disclosure of 174 unique zero 
day vulnerabilities in the 

862
00:42:32,280 --> 00:42:35,040
connected infrastructure and the
statistical. 

863
00:42:35,040 --> 00:42:37,640
Context of that number is what's
truly staggering. 

864
00:42:38,280 --> 00:42:44,080
Those 174 flaws represented 73% 
of all known critical market 

865
00:42:44,080 --> 00:42:47,320
vulnerabilities in that specific
industrial sector at the time. 

866
00:42:47,880 --> 00:42:50,880
By aggressively funding and 
buying these flaws, which are 

867
00:42:50,880 --> 00:42:54,280
often abstract and deeply hidden
from brilliant independent 

868
00:42:54,280 --> 00:42:56,920
researchers, before criminal 
cartels can use them to build 

869
00:42:56,920 --> 00:43:00,400
exploitation tools, initiatives 
like ZDI achieved this 

870
00:43:00,400 --> 00:43:03,720
invaluable tactical advantage. 
They can analyze the flaw, 

871
00:43:03,960 --> 00:43:07,000
develop intrusion signatures, 
and provide active mitigation 

872
00:43:07,000 --> 00:43:09,240
intelligence to their 
infrastructure clients an 

873
00:43:09,240 --> 00:43:12,320
average of 102 days before the 
original hardware vendor 

874
00:43:12,320 --> 00:43:15,280
manages, if they ever do, to 
publish an official software 

875
00:43:15,280 --> 00:43:17,160
patch. 
A full 100. 

876
00:43:17,200 --> 00:43:19,880
And two days of early 
protection, That is more than 

877
00:43:19,880 --> 00:43:22,280
1/3 of a year. 
When you talk about the speed at

878
00:43:22,280 --> 00:43:25,080
which modern digital threats 
move, that time window isn't 

879
00:43:25,080 --> 00:43:28,720
just a statistical luxury. 
That 102 day window is literally

880
00:43:28,720 --> 00:43:31,640
the difference between having a 
boring routine Tuesday morning 

881
00:43:31,640 --> 00:43:34,560
in your network operation center
and waking up on the front page 

882
00:43:34,560 --> 00:43:38,360
of the Evening News globally as 
Ground Zero for a data leak and 

883
00:43:38,360 --> 00:43:40,480
a National Grid collapse. 
It's a vital. 

884
00:43:41,200 --> 00:43:43,440
It is the difference between 
survival and cororate 

885
00:43:43,440 --> 00:43:46,560
extinction. 
The overwhelming conclusion, the

886
00:43:46,560 --> 00:43:49,240
urgent recommendation echoing 
through every one of these 

887
00:43:49,240 --> 00:43:52,720
technical documents and policies
is that the entire automotive 

888
00:43:52,720 --> 00:43:56,160
electrical supply industry has 
to completely and permanently 

889
00:43:56,160 --> 00:43:59,400
abandoned this complacent 
mindset of treating charger 

890
00:43:59,400 --> 00:44:03,440
cyber risk as a purely 
theoretical problem or hiding 

891
00:44:03,440 --> 00:44:05,880
behind the foolish assumption of
oh, we're too small to be 

892
00:44:05,880 --> 00:44:07,760
targeted. 
They have to start adopting 

893
00:44:08,000 --> 00:44:11,160
military grade critical 
infrastructure thinking from day

894
00:44:11,160 --> 00:44:13,280
one of design. 
And according to the analysts, 

895
00:44:13,280 --> 00:44:14,600
this isn't. 
Just about using better. 

896
00:44:15,400 --> 00:44:18,200
No, this requires deep. 
Architectural engineering. 

897
00:44:18,680 --> 00:44:22,120
It means implementing ultra 
strict network segmentation, 

898
00:44:22,360 --> 00:44:25,600
ensuring that if one charger 
falls, it does not drag the 

899
00:44:25,600 --> 00:44:27,400
entire central database down 
with it. 

900
00:44:27,680 --> 00:44:30,840
It means wholeheartedly adopting
a zero trust architecture where 

901
00:44:30,840 --> 00:44:33,720
absolutely no system component, 
not the cloud, not the car, not 

902
00:44:33,720 --> 00:44:36,240
the charging cable, 
automatically assumes that 

903
00:44:36,240 --> 00:44:38,480
another component is friendly or
safe just because they are 

904
00:44:38,480 --> 00:44:41,080
physically connected. 
Every single interaction has to 

905
00:44:41,080 --> 00:44:44,440
be cryptographically verified 
and it demands constant ruthless

906
00:44:44,440 --> 00:44:47,200
hostile cell penetration testing
at the deep hardware level and 

907
00:44:47,200 --> 00:44:50,840
on low level protocols like the 
Canvas, not just running generic

908
00:44:50,840 --> 00:44:53,280
IT vulnerability scans that look
for open web ports. 

909
00:44:53,720 --> 00:44:56,200
You know, as we unpacked. 
This massive, terrifying 

910
00:44:56,200 --> 00:44:59,520
infrastructure, it inevitably 
makes me reflect on something 

911
00:44:59,520 --> 00:45:02,240
much more philosophical. 
It makes me think about how the 

912
00:45:02,240 --> 00:45:05,240
nature and the burden of social 
trust in our daily lives has 

913
00:45:05,240 --> 00:45:08,120
just radically changed. 
Think about how we lived just a 

914
00:45:08,120 --> 00:45:10,360
few decades ago, in the last 
century. 

915
00:45:10,560 --> 00:45:14,280
As citizens, we implicitly and 
blindly trusted the physical 

916
00:45:14,280 --> 00:45:16,120
public infrastructure of our 
cities. 

917
00:45:16,560 --> 00:45:18,400
It was an unwritten social 
contract. 

918
00:45:18,720 --> 00:45:22,040
Nobody, absolutely nobody, went 
to bed worrying that the humble 

919
00:45:22,040 --> 00:45:24,560
street light in their alley or 
the gas pump at the neighborhood

920
00:45:24,560 --> 00:45:28,280
station had a hidden malicious 
agenda or was secretly being 

921
00:45:28,280 --> 00:45:31,520
operated from the shadows by an 
international extortionate 

922
00:45:31,520 --> 00:45:34,440
ransomware consortium. 
Because back then, public 

923
00:45:34,440 --> 00:45:36,360
infrastructure. 
Was just that, physical. 

924
00:45:36,440 --> 00:45:39,480
It was cast iron, cement, 
mechanical valves, raw gasoline,

925
00:45:39,480 --> 00:45:41,120
and rudimentary electrical 
relays. 

926
00:45:41,360 --> 00:45:43,360
The infrastructure was inert. 
It was passive. 

927
00:45:43,680 --> 00:45:47,120
A gas pump couldn't have 
ulterior motives exactly, and 

928
00:45:47,120 --> 00:45:50,040
yet look at where. 
We are now every piece of public

929
00:45:50,040 --> 00:45:52,680
utility we trivially interact 
with is actually a hyper 

930
00:45:52,680 --> 00:45:54,520
connected Internet of Things 
device. 

931
00:45:54,920 --> 00:45:57,880
Every new smart gas pump, every 
digital parking meter that reads

932
00:45:57,880 --> 00:46:01,440
cards, and definitely every 
massive 4 or 800 Volt fast 

933
00:46:01,440 --> 00:46:03,160
charging block that we tether 
our cars. 

934
00:46:04,280 --> 00:46:05,920
They are no longer passive 
tools. 

935
00:46:06,160 --> 00:46:09,000
They are dynamic computing nodes
in an immensely contested global

936
00:46:09,000 --> 00:46:12,680
network under constant attack. 
And we are sleepwalking through 

937
00:46:12,680 --> 00:46:15,960
a world where gigantic integral 
infrastructures for society are,

938
00:46:16,160 --> 00:46:18,920
in many staggering cases, 
operating with essentially the 

939
00:46:18,920 --> 00:46:22,200
same broken, neglected 
cybersecurity maturity that a 

940
00:46:22,200 --> 00:46:24,400
cheap home Internet router had 
15 years ago. 

941
00:46:24,600 --> 00:46:28,040
And the tragic irony. 
Is that we blindly, almost 

942
00:46:28,040 --> 00:46:30,920
without thinking about the 
consequences of that place fate,

943
00:46:31,560 --> 00:46:35,800
plug into those flawed, exposed 
notes the very same massive, 

944
00:46:35,800 --> 00:46:38,920
expensive machines that we rely 
on to transport our families and

945
00:46:38,920 --> 00:46:40,760
ourselves each and every single 
day. 

946
00:46:41,280 --> 00:46:44,120
It is an astoundingly complex 
puzzle of risks. 

947
00:46:44,600 --> 00:46:47,720
We have surrounded and wrapped 
ourselves in layers of amazing 

948
00:46:47,720 --> 00:46:51,000
technological convenience, but 
it is becoming increasingly 

949
00:46:51,000 --> 00:46:53,880
obvious that this apparent 
convenience is precariously tied

950
00:46:53,880 --> 00:46:57,160
to an incredibly fragile digital
rope that is starting to fray 

951
00:46:57,160 --> 00:46:59,400
right down the middle. 
It is totally wild. 

952
00:46:59,400 --> 00:47:00,440
It's an epical. 
Shift. 

953
00:47:00,640 --> 00:47:03,480
Think about our past. 
Over the last two decades, we've

954
00:47:03,480 --> 00:47:05,920
conditioned ourselves and our 
employees to worry about 

955
00:47:05,920 --> 00:47:09,040
ethereal threats on screens. 
We worried about not sticking 

956
00:47:09,040 --> 00:47:12,760
strange, malicious USD drives we
mysteriously found lying on the 

957
00:47:12,760 --> 00:47:15,680
parking lot asphalt into our 
work computer ports. 

958
00:47:15,800 --> 00:47:19,000
Or we anxiously trained our 
parents not to click on tempting

959
00:47:19,000 --> 00:47:20,800
links inside poorly written 
emails. 

960
00:47:20,800 --> 00:47:22,640
Foreign Princess promising 
fortunes. 

961
00:47:22,880 --> 00:47:25,480
Those were the peaks of our 
collective digital terrors. 

962
00:47:25,600 --> 00:47:27,160
They seem like infinitely 
simpler. 

963
00:47:27,160 --> 00:47:29,760
Quaint times in retrospect, so 
much simpler. 

964
00:47:30,320 --> 00:47:33,480
Because Fast forward deep into 
this decade and seeing the 

965
00:47:33,520 --> 00:47:36,320
overwhelming direction these 
vulnerability reports point to, 

966
00:47:36,880 --> 00:47:39,840
the most dangerous, 
consequential, and physically 

967
00:47:39,840 --> 00:47:42,160
destructive digital connection 
you're going to make in your 

968
00:47:42,160 --> 00:47:46,360
daily life will no longer even 
require a keyboard or a mouse 

969
00:47:46,360 --> 00:47:48,480
click. 
The most dangerous digital 

970
00:47:48,480 --> 00:47:52,000
connection of all might simply 
be that thick heavy black cable 

971
00:47:52,240 --> 00:47:55,080
that without hesitation you pull
from a harmless looking metal 

972
00:47:55,080 --> 00:47:57,960
post and plug into the side of 
your family car in the middle of

973
00:47:57,960 --> 00:48:00,720
the night in the cold rain, 
desperate to get the kilowatts 

974
00:48:00,720 --> 00:48:02,920
of energy needed to just safely 
made it home. 

975
00:48:03,680 --> 00:48:06,000
It leaves us with an error 
defining question that we should

976
00:48:06,000 --> 00:48:07,880
start asking ourselves very 
seriously. 

977
00:48:08,480 --> 00:48:11,960
What happens to us as a modern 
hyper connected society when the

978
00:48:11,960 --> 00:48:14,680
physical, inescapable 
infrastructure that we literally

979
00:48:14,680 --> 00:48:17,680
and absolutely depend on for our
mobility, our survival and our 

980
00:48:17,680 --> 00:48:20,760
energy is corrupted from the 
inside out, becoming the 

981
00:48:20,800 --> 00:48:23,360
ultimate, most perfect Trojan 
horse ever conceived? 

982
00:48:24,040 --> 00:48:26,760
That is all for this episode of 
cybersecurity under pressure, 

983
00:48:27,000 --> 00:48:30,280
real attacks, real lessons. 
Until the next chapter.