Electromagnetic Sensor and Actuator Attacks on Power Converters for Electric Vehicles

Dayanıklı, Gökçen Yılmaz; Hatch, Rees; Gerdes, Ryan; Wang, Hongjie; Zane, Regan

doi:10.1109/spw50608.2020.00032

Cited by 22 publications

(13 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors of [5] mentioned only briefly the possibility of a denial-of-service attack against the charging communication by emitting noise in its spectrum. And the researchers in [17] focused on the electromagnetic susceptibility of the voltage and current sensors in charging stations.…”

Section: Related Workmentioning

confidence: 99%

Brokenwire: Wireless Disruption of CCS Electric Vehicle Charging

Köhler¹,

Baker²,

Strohmeier³

et al. 2023

Proceedings 2023 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

We present a novel attack against the Combined Charging System, one of the most widely used DC rapid charging technologies for electric vehicles (EVs). Our attack, BROKEN-WIRE, interrupts necessary control communication between the vehicle and charger, causing charging sessions to abort. The attack requires only temporary physical proximity and can be conducted wirelessly from a distance, allowing individual vehicles or entire fleets to be disrupted stealthily and simultaneously. In addition, it can be mounted with off-the-shelf radio hardware and minimal technical knowledge. By exploiting CSMA/CA behavior, only a very weak signal needs to be induced into the victim to disrupt communication -exceeding the effectiveness of broadband noise jamming by three orders of magnitude. The exploited behavior is a required part of the HomePlug Green PHY, DIN 70121 & ISO 15118 standards and all known implementations exhibit it.We first study the attack in a controlled testbed and then demonstrate it against eight vehicles and 20 chargers in real deployments. We find the attack to be successful in the real world, at ranges up to 47 m, for a power budget of less than 1 W. We further show that the attack can work between the floors of a building (e.g., multi-story parking), through perimeter fences, and from 'drive-by' attacks. We present a heuristic model to estimate the number of vehicles that can be attacked simultaneously for a given output power. BROKENWIRE has immediate implications for a substantial proportion of the around 12 million battery EVs on the roads worldwide -and profound effects on the new wave of electrification for vehicle fleets, both for private enterprise and crucial public services, as well as electric buses, trucks and small ships. As such, we conducted a disclosure to the industry and discussed a range of mitigation techniques that could be deployed to limit the impact.The fastest-growing DC charging standard, already dominant across North America and Europe, is the Combined Charging System (CCS) [37], [26]. CCS provides a highbandwidth IP link via power-line communication (PLC) for the communication between the EV and EVSE. This brings benefits in terms of reusing commodity technologies and affording capacity for additional services, such as automatic billing and demand-response charging, in addition to the crucial charging session control [38].However, it is known that PLC, as used in CCS charging, unintentionally leaks communication signals via the charging Network and Distributed System Security (NDSS) Symposium 2023

show abstract

Section: Related Workmentioning

confidence: 99%

Brokenwire: Wireless Disruption of CCS Electric Vehicle Charging

Köhler¹,

Baker²,

Strohmeier³

et al. 2023

Proceedings 2023 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…With the increasing reliance on electric vehicles and their integration into the smart grid as an energy buffer, the security of the EV charging infrastructure has developed into an active field of research [14], [3]. Security issues that have been uncovered range from the physical layer of the charging station [2], [15], [8] to vulnerabilities in the software [9], [20], [4]. Researchers have also shown that the payment methods available for vehicle owners lack adequate protection.…”

Section: Related Workmentioning

confidence: 99%

CableAuth: A Biometric Second Factor Authentication Scheme for Electric Vehicle Charging

Sturgess¹,

Köhler²,

Birnbach³

et al. 2023

Proceedings Inaugural International Symposium on Vehicle Security &Amp; Privacy

View full text Add to dashboard Cite

Electric vehicle charging sessions can be authorised in different ways, ranging from smartphone applications to smart cards with unique identifiers that link the electric vehicle to the charging station. However, these methods do not provide strong authentication guarantees. In this paper, we propose a novel second factor authentication scheme to tackle this problem. We show that by using inertial sensor data collected from IMU sensors either embedded in the handle of the charging cable or on a separate smartwatch, users can be authenticated implicitly by behavioural biometrics as they unhook the cable from the charging station and plug it into their car at the start of a charging session. To validate the system, we conducted a user study (n=20) to collect data and we developed a suite of authentication models for which we achieve EERs of 0.06.

show abstract

“…A small window size (e.g., k = 4) works well to reduce the noise while maintaining the sensitivity. We have y 0 [n] = 6 18 y[n] + Analysis and Manipulation. Suppose that the injection induces perturbations in the system input by X ′ (t) = X(t)+p(t) (Eq.…”

Section: B Validationmentioning

confidence: 99%

“…However, a main barrier in applying existing attack methods to achieve continuous, realtime control is the lack of the feedback from the victim control system. Many works [3], [4], [5], [6] rely on tuning signals by observing statuses such as the sensor measurements and timing-related signals in the victim system to adjust attack effects. However, such approaches can be limited in attacks that require real-time adversarial control.…”

Section: Introductionmentioning

confidence: 99%

Towards Adversarial Control Loops in Sensor Attacks: A Case Study to Control the Kinematics and Actuation of Embedded Systems

Tu¹,

Rampazzi²,

Hei³

2022

Preprint

View full text Add to dashboard Cite

Recent works investigated attacks on sensors by influencing analog sensor components with acoustic, light, and electromagnetic signals. Such attacks can have extensive security, reliability, and safety implications since many types of the targeted sensors are also widely used in critical process control, robotics, automation, and industrial control systems.While existing works advanced our understanding of the physical-level risks that are hidden from a digital-domain perspective, gaps exist in how the attack can be guided to achieve system-level control in real-time, continuous processes. This paper proposes an adversarial control loop-based approach for real-time attacks on process and actuation control systems relying on sensors. We study how to utilize the system feedback extracted from physical-domain signals to guide the attacks. In the attack process, injection signals are adjusted in real time based on the extracted feedback to exert targeted influence on a victim control system that is continuously affected by the injected perturbations and applying changes to the physical environment. In our case study, we investigate how an external adversarial control system can be constructed over sensor-actuator systems and demonstrate the attacks with program-controlled processes to manipulate the victim system without accessing its internal statuses.

show abstract

Electromagnetic Sensor and Actuator Attacks on Power Converters for Electric Vehicles

Cited by 22 publications

References 6 publications

Brokenwire: Wireless Disruption of CCS Electric Vehicle Charging

Brokenwire: Wireless Disruption of CCS Electric Vehicle Charging

CableAuth: A Biometric Second Factor Authentication Scheme for Electric Vehicle Charging

Towards Adversarial Control Loops in Sensor Attacks: A Case Study to Control the Kinematics and Actuation of Embedded Systems

Contact Info

Product

Resources

About