SpringerLink
Log in

Vulnerability Analysis of an Electric Vehicle Charging Ecosystem

  • Conference paper
  • First Online:
Critical Information Infrastructures Security (CRITIS 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14599))

  • 21 Accesses

Abstract

The increase of electric vehicles has exacerbated the need for adequate security measures in the electric vehicle charging ecosystem (EVCE). Integrating IT services into the electric vehicle charging infrastructure exposes it to several new attack vectors. In this paper, we apply a vulnerability analysis method to assess the current security posture of the internet-connected EVCE components. Our method is based on penetration testing principles using open-source cybersecurity search engines. Using this method, we gathered security-related information apparently associated with eight charging station vendors and three management systems, and we found 13 vulnerable technologies containing 81 vulnerabilities. Based on the information provided by vulnerability databases, we classified the threats according to the STRIDE model and analyzed the potential consequences of the vulnerabilities in terms of the security properties that can be violated.

Supported by Vinnova through the project Sustainable Energy with Adaptive Security (2021-01683) and RICS Centre on Resilient Information and Control Systems financed by Swedish Civil Contingencies Agency (MSB).

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
EUR 32.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or Ebook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 64.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free ship** worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://www.utilitydive.com/news/putin-hacks-of-ev-electric-vehicle-charging-stations-cybersecurity-preparations/634547/.

  2. 2.

    https://www.bbc.com/news/uk-england-hampshire-61006816.

  3. 3.

    https://www.cvedetails.com/.

  4. 4.

    https://nvd.nist.gov/.

References

  1. Acharya, S., Dvorkin, Y., Pandžić, H., Karri, R.: Cybersecurity of smart electric vehicle charging: a power grid perspective. IEEE Access 8, 214434–214453 (2020)

    Article  Google Scholar 

  2. Alcaraz, C., Cumplido, J., Trivino, A.: OCPP in the spotlight: threats and countermeasures for electric vehicle charging infrastructures 40. Int. J. Inf. Secur. 1–27 (2023)

    Google Scholar 

  3. Ashley, T., Gourisetti, S.N.G., Brown, N., Bonebrake, C.: Aggregate attack surface management for network discovery of operational technology. Comput. Secur. 123, 102939 (2022)

    Article  Google Scholar 

  4. Baggott, S.S., Santos, J.R.: A risk analysis framework for cyber security and critical infrastructure protection of the us electric power grid. Risk Anal. 40(9), 1744–1761 (2020)

    Article  Google Scholar 

  5. Casola, V., De Benedictis, A., Rak, M., Villano, U.: Toward the automation of threat modeling and risk assessment in IoT systems. Internet Things 7, 100056 (2019)

    Article  Google Scholar 

  6. ElHussini, H., Assi, C., Moussa, B., Atallah, R., Ghrayeb, A.: A tale of two entities: contextualizing the security of electric vehicle charging stations on the power grid. ACM Trans. Internet Things 2(2) (2021). https://doi.org/10.1145/3437258

  7. Gautam, M., Bhusal, N., Benidris, M.: Concept of smart charging management system and its consensus on cybersecurity (2020)

    Google Scholar 

  8. Ghafouri, M., Kabir, E., Moussa, B., Assi, C.: Coordinated charging and discharging of electric vehicles: a new class of switching attacks. ACM Trans. Cyber-Phys. Syst. (TCPS) 6(3), 1–26 (2022)

    Article  Google Scholar 

  9. Gonzalez-Granadillo, G., et al.: Dynamic risk management response system to handle cyber threats. Futur. Gener. Comput. Syst. 83, 535–552 (2018)

    Article  Google Scholar 

  10. Gottumukkala, R., Merchant, R., Tauzin, A., Leon, K., Roche, A., Darby, P.: Cyber-physical system security of vehicle charging stations. In: 2019 IEEE Green Technologies Conference (GreenTech), pp. 1–5. IEEE (2019)

    Google Scholar 

  11. Hamdare, S., et al.: Cybersecurity risk analysis of electric vehicles charging stations. Sensors 23(15), 6716 (2023)

    Article  Google Scholar 

  12. Heiding, F., Süren, E., Olegård, J., Lagerström, R.: Penetration testing of connected households. Comput. Secur. 126, 103067 (2023)

    Article  Google Scholar 

  13. Johnson, J., et al.: Cybersecurity for electric vehicle charging infrastructure. Technical report, Sandia National Lab. (SNL-NM), Albuquerque, NM (United States) (2022)

    Google Scholar 

  14. Johnson, J., Berg, T., Anderson, B., Wright, B.: Review of electric vehicle charger cybersecurity vulnerabilities, potential impacts, and defenses. Energies 15(11), 3931 (2022)

    Article  Google Scholar 

  15. Katsikas, S., et al.: A hybrid dynamic risk analysis methodology for cyber-physical systems. In: Katsikas, S., et al. (eds.) ESORICS 2022. LNCS, vol. 13785, pp. 134–152. Springer, Cham (2023). https://doi.org/10.1007/978-3-031-25460-4_8

    Chapter  Google Scholar 

  16. Kern, D., Krauß, C.: Analysis of e-mobility-based threats to power grid resilience. In: Proceedings of the 5th ACM Computer Science in Cars Symposium, pp. 1–12 (2021)

    Google Scholar 

  17. Kern, D., Krauß, C.: Detection of e-mobility-based attacks on the power grid. In: 2023 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 352–365 (2023). https://doi.org/10.1109/DSN58367.2023.00042

  18. Kure, H.I., Islam, S., Razzaque, M.A.: An integrated cyber security risk management approach for a cyber-physical system. Appl. Sci. 8(6), 898 (2018)

    Article  Google Scholar 

  19. Lee, S., Park, Y., Lim, H., Shon, T.: Study on analysis of security vulnerabilities and countermeasures in ISO/IEC 15118 based electric vehicle charging technology. In: 2014 International Conference on IT Convergence and Security (ICITCS), pp. 1–4. IEEE (2014)

    Google Scholar 

  20. Müller, N., Heussen, K., Afzal, Z., Ekstedt, M., Eliasson, P.: Threat scenarios and monitoring requirements for cyber-physical systems of flexibility markets. In: 2022 IEEE PES Generation, Transmission and Distribution Conference and Exposition–Latin America, pp. 1–6. IEEE (2022)

    Google Scholar 

  21. Nasr, T., Torabi, S., Bou-Harb, E., Fachkha, C., Assi, C.: ChargePrint: a framework for internet-scale discovery and security analysis of EV charging management systems (2023)

    Google Scholar 

  22. Nasr, T., Torabi, S., Bou-Harb, E., Fachkha, C., Assi, C.: Power jacking your station: in-depth security analysis of electric vehicle charging station management systems. Comput. Secur. 112, 102511 (2022)

    Article  Google Scholar 

  23. Sarieddine, K., Sayed, M., Torabi, S., Atallah, R., Assi, C.: Investigating the security of EV charging mobile applications as an attack surface (2022). https://dl.acm.org/doi/10.1145/3609508

  24. Sayed, M.A., Atallah, R., Assi, C., Debbabi, M.: Electric vehicle attack impact on power grid operation. Int. J. Electr. Power Energy Syst. 137, 107784 (2022)

    Article  Google Scholar 

  25. Shevchenko, N., Chick, T.A., O’Riordan, P., Scanlon, T.P., Woody, C.: Threat modeling: a summary of available methods. Technical report, Carnegie Mellon University Software Engineering Institute (2018)

    Google Scholar 

  26. Shrestha, M., Johansen, C., Noll, J., Roverso, D.: A methodology for security classification applied to smart grid infrastructures. Int. J. Crit. Infrastruct. Prot. 28, 100342 (2020)

    Article  Google Scholar 

  27. Skarga-Bandurova, I., Kotsiuba, I., Biloborodova, T.: Cyber security of electric vehicle charging infrastructure: Open issues and recommendations. In: 2022 IEEE International Conference on Big Data (Big Data), pp. 3099–3106. IEEE (2022)

    Google Scholar 

  28. Süren, E., Heiding, F., Olegård, J., Lagerström, R.: PatrIoT: practical and agile threat research for IoT. Int. J. Inf. Secur. 22(1), 213–233 (2023)

    Article  Google Scholar 

  29. Tuma, K., Scandariato, R.: Two architectural threat analysis techniques compared. In: Cuesta, C.E., Garlan, D., Pérez, J. (eds.) ECSA 2018. LNCS, vol. 11048, pp. 347–363. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-00761-4_23

    Chapter  Google Scholar 

  30. UcedaVelez, T., Morana, M.M.: Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis, 1st edn. Wiley, Chicester (2015)

    Book  Google Scholar 

  31. Zhdanova, M., Urbansky, J., Hagemeier, A., Zelle, D., Herrmann, I., Höffner, D.: Local power grids at risk–an experimental and simulation-based analysis of attacks on vehicle-to-grid communication. In: Proceedings of the 38th Annual Computer Security Applications Conference, pp. 42–55 (2022)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Department of Computer and Information Science, Linkö** University, Linkö**, Sweden

    Roland Plaka, Mikael Asplund & Simin Nadjm-Tehrani

Authors
  1. Roland Plaka
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Mikael Asplund
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Simin Nadjm-Tehrani
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Roland Plaka .

Editor information

Editors and Affiliations

  1. University of the Bundeswehr Munich, Neubiberg, Germany

    Stefan Pickl

  2. Lucerne University of Applied Sciences, Luzern, Switzerland

    Bernhard Hämmerli

  3. Laurea University of Applied Sciences, Vantaa, Finland

    Päivi Mattila

  4. Laurea University of Applied Sciences, Vantaa, Finland

    Annaleena Sevillano

Rights and permissions

Reprints and permissions

Copyright information

© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Plaka, R., Asplund, M., Nadjm-Tehrani, S. (2024). Vulnerability Analysis of an Electric Vehicle Charging Ecosystem. In: Pickl, S., Hämmerli, B., Mattila, P., Sevillano, A. (eds) Critical Information Infrastructures Security. CRITIS 2023. Lecture Notes in Computer Science, vol 14599. Springer, Cham. https://doi.org/10.1007/978-3-031-62139-0_9

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-62139-0_9

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-62138-3

  • Online ISBN: 978-3-031-62139-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation