High Voltage Heist - Turning Your EV into my Power Bank

The talk opens with how an electric vehicle and its charger communicate during DC charging. The speakers, from an embedded security testing team, walk through the control pilot signalling, the power line communication sounding step that pairs a car with its charger, and the network discovery that follows. They then cover the ISO 15118 and older DIN session sequence, from protocol negotiation and pre-charge through current demand loops to welding detection at the end. They note that the network management key is sent in plaintext early in the exchange, so it adds little protection against a man-in-the-middle.

The core question was whether the vehicle's battery management system believes what the charger reports. To test this, the team built ChargeSploit, a software and hardware toolkit that can simulate a vehicle or charger, sit in the middle of a live session, and manipulate control pilot and proximity pilot signals. Their rig also included a programmable load and an adjustable high-voltage supply for the DC pins. Against a Tesla Model 3, the car measured voltage only during pre-charge and then accepted false voltage and current figures. With a bank of kettles giving roughly 12 to 15 kilowatts of load, the team drained the traction battery, and a phone was charged from a locked car in the demo.

For practitioners, the takeaway is that the vehicle trusts charger-supplied values once the session is running. The speakers described possible harm beyond unauthorized power: permanent battery damage if discharge goes far below normal limits, and denial of service through a short circuit on the pins. They released a restricted version of the tooling and stressed that the voltages involved are lethal.