Your next roadtrip free - vulnerable EV charging points

In this talk at the DEF CON 27 IoT Village, M. Can Kurnaz presents his vulnerability research into commercial Electric Vehicle (EV) charging stations widely deployed across Europe. He opens at 02:00 by explaining how EV charging infrastructure sits at the critical intersection of IoT and industrial SCADA systems, managing high-voltage electricity and financial billing. At 04:00, he reveals that internet reconnaissance via Shodan uncovered hundreds of public charging stations with their administrative web interfaces directly exposed to the internet.

Can details his web application assessment at 06:00, demonstrating how forced browsing and path traversal allowed unauthenticated visitors to view restricted management pages and device configurations. At 08:00, he illustrates the practical impact of these flaws, showing how an unauthorized remote user could start or stop vehicle charging sessions, alter electricity metering logs, or take charging stations completely offline to strand motorists.

At 10:00, he investigates the internal Java management backend on the charging controller, identifying a remote command injection vulnerability at 12:00 where unescaped backtick commands executed in a shell context. This allowed him to drop directly into an unauthenticated root shell at 14:00, granting full control over the embedded Linux system and network interfaces. He concludes by stressing the urgency of hardening EV charging infrastructure against cyber threats as mass adoption grows. (AI summary — Gemini Flash)