I Just Wanted to Charge the Car

The speaker wanted to route surplus solar energy from a home battery into an electric car instead of selling it back to the grid. The battery vendor's gateway included a smart relay able to switch heavy loads, so the plan depended on learning how the vendor's phone app talked to that gateway. Starting from an Android build of the app, he decompiled the code, used an HTTP proxy to watch traffic, and traced the calls that drove the relay.

The investigation turned up hard-coded demo credentials, an exposed Swagger endpoint with documentation, and a shared MQTT message broker with no authorization or isolation. Login tokens were deterministic and could not be revoked, and a wildcard subscription exposed every message on the bus. He worked through disclosure with the EFF and struggled to find a security contact at the vendor. The vendor later patched by moving traffic to an HTTP endpoint with topic checks, which broke his setup until he updated it.

The takeaway is that a basic review would have caught these flaws, and that the gateway likely still runs an unisolated broker, so a deeper fix would need more than an API change. He shares working code and a Rust wrapper for the API, and suggests that vendors and researchers both need better disclosure channels.