“Through our penetration testing, we found that the PLC layer was poorly secured and lacked encryption between the vehicle and the chargers,” says Katherine Kozan, an engineer who led the project for SwRI’s High Reliability Systems Department. 

The research is part of SwRI’s ongoing efforts to help the mobility sector and government improve automotive cybersecurity spanning embedded automotive computers and smart-grid infrastructure. It builds upon a 2020 project where SwRI hacked a J1772 charger, disrupting the charging process with a lab-built spoofing device.

In the latest project, SwRI explored vehicle-to-grid (V2G) charging technologies governed by ISO 15118 specifications for communications between EVs and electric vehicle supply equipment (EVSE) to support electric power transfer.

“As the grid evolves to take on more EVs, we need to defend our critical grid infrastructure against cyberattacks while also securing payments to charge EVs,” says Vic Murray, assistant director of SwRI’s High Reliability Systems Department. “Our research found room for improvements.”

The SwRI engineers developed an adversary-in-the-middle (AitM) device with specialized software and a modified combined charging system interface. The AitM allowed testers to eavesdrop on traffic between EVs and EVSE for data collection, analysis and potential attack. By ascertaining the media access control addresses of the EV and EVSE, the engineers identified the network membership key that allows devices to join a network and monitor traffic.