DEF CON Demo Exposes Cybersecurity Risks in High-Speed EV Chargers

The video features a DEF CON demonstration by Adam Lori (aka Major Malfunction) of Alpatronic, showcasing cybersecurity risks in high-speed electric vehicle (EV) chargers, specifically a 400 kW unit. The discussion highlights that EV chargers function as networked devices, creating IPv6 connections with vehicles and backend systems, including payment and grid operators, making them potential pivot points for attacks. Early vulnerabilities involved exposed network services discovered via scanning tools like Nmap, while current threats include sophisticated attacks leveraging bidirectional communication between chargers and vehicles. The demo revealed a hardware-level NFC fault in custom firmware, allowing unauthorized access to run arbitrary code—illustrated by running Doom on the charger. Alpatronic emphasizes proactive security measures, including red teaming, bug bounties, and collaboration with hackers to identify unknown vulnerabilities, given the chargers' role in critical infrastructure. The company warns that coordinated attacks on EV networks could disrupt energy grids, particularly if load disruptions occur at critical moments. The segment concludes with an open challenge to DEF CON attendees to test the charger’s security.