Plugged In and Exposed: The Growing Cybersecurity Threat to EV Charging Infrastructure

The intersection of OT and EV infrastructure is a growing attack surface that most security teams aren't ready for. This piece from Flare highlights how the rapid deployment of EV charging stations is outpacing security controls, creating a soft target for both cybercriminals and nation-state actors.

Technical Breakdown

• Attack Vectors: Compromised charge point management systems (CPMS) and OCPP (Open Charge Point Protocol) vulnerabilities. Threat actors can pivot from poorly segmented networks to disrupt grid connectivity or steal payment data.
• TTPs: Exploitation of unpatched firmware, weak API authentication in backend management portals, and physical USB attacks on public charging units.
• IOCs: Not specified in the article, but typical indicators would include anomalous OCPP traffic, unauthorized remote commands to charging stations, or communication with known C2 infrastructure used in OT targeting.
• Affected Systems: EV charging stations running outdated OCPP 1.6 (vs. 1.6j with security extensions), and any CPMS exposed to the internet without proper network segmentation.

Defense

Segment EV charging infrastructure from corporate IT networks, enforce mutual TLS for OCPP communications, and apply vendor firmware patches immediately. Treat these endpoints like any other critical OT asset—don't let convenience override security.

Source: https://flare.io/learn/resources/blog/growing-cybersecurity-threat-ev-charging-infrastructure