Hacker News Reader

Comment by chaorace | Hacker News Reader

Just FYI: this is referring to USB charging stations, not EV stations.

This advice has been standard in cybersecurity training for a long time now and frankly I'm surprised that this is the first time the FBI has felt the need to issue an advisory on the subject.

View on HN

I have been somewhat curious if/when this will occur with EV stations as well. What controls might one gain over a car from the charging port on the assorted makes/models? Even hacking aside I am curious what PII, telemetry and tracking data could be pulled from the charge port.

At least on AC Level 1/2 charging (using just a J1772 port) the signalling is pretty rudimentary if I remember correctly. Something along the lines of the car puts out a square wave on one of the signalling pins and based on the resistance it sees it knows whether it's plugged in and how much power it can charge, so there isn't much room (dare I say any) way to interact much with the car through that port. I don't know how DC charging works but I assume there's a little bit more smarts to it. Tesla on the other hand is a completely different story.

The really high voltage fast chargers as far as I understand them connect directly to the battery bypassing the cars battery charger to directly charge the battery not sure how much communication there is on those channels though.

You're probably thinking about the on-board inverter, it's often referred to as a battery charger. The battery management system is entirely within the car, and the car will tell what voltage and amperage to deliver to it.

The design of CCS2 is actually quite nice. There are pins for singalling that, if broken, will immediately shut down power delivery. This means that you can just pull the cable out safely, without risking arcing or electrocuting yourself.

My understanding was it also bypassed the BMS but I may have confused what they were saying it's been a minute.

When I've done DC rapid charging on my Leaf, I noticed that the charger knew the battery percentage reported by the car. That seems likely to be digital signalling to me, so suddenly there's the risk of buffer overflows and suchlike.

I've not seen this on AC, but when I looked into this previously I got the impression that there exists a digital signalling protocol established by modulating something ignored by older cars and chargers that can be optionally supported. If that's the case then there's potentially attack surface there, too.

That’s why I only buy cars written in rust.

brings new meaning to the term "rust bucket"

you must be a fan of oldtimers then. since most new cars are made with stainless steel, aluminum, carbon fiber or and other materials.

The CCS standard has "HLC - High Level Communication", which is available for both AC and DC charging. While i'm not interested in paying $700 for ISO 15118, I imagine clients [cars] are set up to break the current flow if anything out of the ordinary happens or if the input power doesn't match what the station is saying it's sending in an instant.

I wonder if dealerships and other auto shops behave like every other company today, and when they plug into your OBD2 port they just hoover up as much data as they can and sell it off.

Even if it's not available via the charger they'll just do this with ALPR or their proprietary apps. Gotta love surveillance capitalism.

It is not the first time the FBI has warned about this (see [0] for example, or do a Google search with date filters).

This is the Denver field office maximizing Twitter engagement by repeating themselves. (Maybe that is not a fair way to view it, maybe the FBI should repeat advisories often.)

[0]: https://www.fbi.gov/contact-us/field-offices/portland/news/p...

Seriously need an edited title then. Original title is wildly misleading.

I agree - the only "public charging stations" I see on any kind of regular basis are EV charging stations. It's been a couple of decades since I remember seeing a USB one, not that I doubt their existence.

They're ubiquitous at conferences and in many trains, planes, airports, hotels, etc. Maybe you mean something different by public but USB charging stations that you don't control are very common especially in the context of places travelers are in. They're probably pretty common in schools, libraries, conference rooms, etc. as well.

They're in basically every major airport, as well as most modern airplanes.

I thought it was a wild clickbait and didn't even go to read the article. I read it as "EVs are dangerous according to the FBI, use V12 engines to avoid hackers"

but yeah, public charging stations *for phones* are terrible.

I used one of them once at a conference, with ADB enabled on my phone. I thought it would just feed me power, as not data collection was specified on the station.

but it enabled a data connection.

So I used a public station once, and I'll never do it again.

The moment I first saw one I knew something was wrong.

Reply on news.ycombinator.com