hi there
thanks for attending our talk um our
talk today is
remote routine charging station for fun
and profit
and you will be presented by me and my
teammates bucket
and we're going to share our back
counting experience for
schneider at triple charging station
evading
okay so who we are i'm kevin to 600
a security researcher and i love
breaking stuff
and this is my teammate but he's a
security engineer
he's also the founder of wrapped dns.io
for the past few years we have focused
on vehicle security
for example we have successfully demoed
the
nyc nfc key fob relay attack for tesla
model 3 last year
and for this year we have found three
bucks for schneider
at electrical evidence charging station
and one of them is scored as the most
critical part
so here are the contents for today um
first i'm going to do a charging station
101
i will be introduced how does it work
and why do we need to concern
its security and then i will walk
through some of the interesting case
studies
from the other skill researchers
and eventually but he will share the
whole story
on how we got rc on the ev link and what
the impact
can be can can it be
once we got in okay so china station 101
so why charging stations right
um a lot of people talking about vehicle
security nowadays
um they usually refer to car itself
for example they were talking about how
to reverse engineer cam protocols
or can we sniff in the tpns
tpms for tires and
if we can hack the key fob systems and
getting
vehicles but let's not forget there's
something called we to act communication
and it's also played a very big part in
the vehicle network
and the x v to x the x
uh can means many things for example
we're called to vehicle
with v and we're equal to infrastructure
which
i and also for the charging station
we took great weight to g okay
so for v2g they usually refer to
connection
between the car and charging stations so
when you go to charge station you're
usually talking about
um you you to interactive with the uh
the scada system behind me or something
like that
okay so i think we
we where nowadays won't feel any strange
to see a charging station
around you because they are everywhere
now
and this is just a map to show how many
charging stations are around the
chinatown area
in vancouver canada see i took this
picture from the
open source open charge map io
and you see we already see many menus
all right
and also this one gets from charging
point map
and can you see how many of them are in
a state right now
amazing right so many
and they not only in exist in their
rewards
we can find lawton exposed to internet
too
as you can see we can use user easily
find the fund find a loved one
through some search engines so for
example
with the help from student we can easily
spot a tesla
power pack system um yeah let's see
not many but there's they are exist
also if we were searching for ocpp
which is the protocol specially designed
for communicating
between the charging station and the
back-end server
we can spot many of them on the internet
too
so this is what charging station looks
like in the real life
see as you can see it can it can be
different forms and sizes but
for example this one is for uh usually
for the
a small residential area and this can be
uh for just
like commercial use okay
but regardless of the size of forms they
all got
plug connectors however each country
each country
has used its own standard even for
company like
tesla has even implemented their own
version of connectors
and charging station usually use cam
protocol to communicate with bns
system on a record which is for stand
for natural management system
but in europe they're using plc
power line communication to talk to the
bms with tcp so
yeah they got they actually got iphs
right pretty cool right hackers
and there are network servers in the
back end right
so to take care of like payments is
payments or any other service the
customer may
they may need to dealing with right so
it's
actually a whole lot of the uh
it looks like it is you look like a
actual iot network
but it's bigger right
okay as i mentioned earlier
charging station can use ocpp protocol
to talk to the backend server
and the latest version of ocpp relies on
jason from messenger and this is great
place
for uh for for us to do the forcing
attack
right so maybe we can force in some um
specific uh area to find if there's any
bug
okay since the charging
station is just embedded assistant so
and has provided many services
so the servers they provide more
possibility
we can attack them so here are sounds
for the tech matters
i can i think we can try it on so first
we can try to reverse engineer
their application app applications
to try to find if there's any api
interface exposable
also since there they have the
cloud back-end server maybe we can try
that on too
and like i said there the charging
station itself is a
most likely an embedded system they
they probably have the running on ubuntu
or other linux system
so yeah the next system we can try
um also if we we can take in part
we may find some debugging port um
accessible like jtag or uart
right and usually the the charging
station has
some wireless connection uh with it like
uh ble wifi of like 4g
5g and when talking about the payment
they're probably using rfid and yeah
rfid
is it's also hackable too and as i
mentioned
the the vehicle we're using can or plc
to talk
to the uh charging stations um
maybe there's a way to to hack it as
well
right so back as question we asked in
the very beginning
why charging stations right because i
think they are
already everywhere and they're less
expensive than cars
so buy a car it's usually cost a lot of
money
but it's much cheaper if we're just
targeting
charging stations we can buy a brand new
one and start from there
and right now i i when i do
when we do the research we didn't
there's a few but not many people
focus on this area so less attention
maybe that means there's a lot of bug
for us to
just waiting for us to discover so yeah
more functions
more tech betters right
so charging station case studies um
so for the first one this first one is
uh um
the one from uh third control company
called sir control
the report name circle car life
um this is not new but rather
years old however we still can find lots
of them
online you see when i when we simply
search for
server circle car life we we find 2932
of them already are still exposable
online
right so currently there are multiple
cvs
under uh circle car life charging
stations
for example it will leak username and
password information like here
from a log file without any
authentications
so this is um not acceptable right so
many years and
they still not fix it okay
on case number two there's multiple
devices
made by us sorry there's a main
innovator device
made by a secure researcher and it can
be used for sniffing
and inject package between cars and
charging station through plc
i think this is pretty cool he has also
released a tool to help us to decode
pockets
so if you're interested to research on
you can try to this
website and even better
he also released another tool called v2g
injector
which can inject pocket into the cars
and charging stations
however this comes from fallout
if you need to you you have to be in an
area like support plc for example you in
most
european countries are supporting them
but if you happen to be in china
um usually you usually face in the uh
the charging station only accept chem
protocols so
you will not able to do this kind of
research
now this is another uh interesting
research
done by tencent blade team they found
this design flaw
seeing a charging station payment
mechanism the way this payment mechanism
work
is the first our car
like for example bms will transmit we
call win
number two to the charge station and the
transformation will transmit
this win number uh
all the way back to the chat uh the
back-end server
and they do that do the background check
on there and then
once they all slide you they will send
back their
credentials banned following
with number all right and once they they
they they know you are a legit user
they will start charging on the payments
uh recordingly okay now this is uh
like this is a thing called a plugin
charge
so as i i mentioned
since the vehicle in china using cam
proco to communicate
with a charging station so the bulletin
what they did
is they built a cam made in the metal
device
called x charger so basically they
they build one device based on a
raspberry pi they can sniff
the the chem protocols in between the
main middle attack
again but for the cat protocol this time
so with help from this device they can
capture
out of canned traffic between car and
stations
now um
what they have found is that some other
station in china using
as i mentioned earlier they're using
wind number to authenticate the user for
the payment
purpose now however this win number
is easily replaceable during the whole
process
so they can simply replace
the the for the number with different
cars so the other people
will pay the fees for you
so free charge right pretty cool and
also
like nicely they have done research on
the tesla
now they found the tesla charging
station actually using their private
protocols
so we still need to have to re find a
way to reverse engineer
the entire private protocols um
if so it's pretty i think this is a
pretty good
area to thinking more now
the last case case for this is an
interesting case found by
us the story um
is we know that one of the particular
charging station companies called
charging points
they predict that in by 2025
there will be 2.5 mil uh every charging
station spot
banned by then right i think this is a
very
popular one in vancouver and across the
country
in the state as well so
the story is very simple actually one
day which we choose to reverse engineer
their mobile the mobile application from
them
we have found a simple uh reflected
cross-site scripting pack for their
back-end server
um because they are using some kind of
waft system but however we find a way to
bypass
it um and we
right away as a uh ethical hacker we
report them back to the to to the
company and
with the full details discouraging so
any stories right
no turns out the charge point security
team takes security very seriously
they have rewarded us a one thousand
dollars
for a bounty through hack one well one
thousand dollars right for
just for uh chris chris
crosby scripting i mean pretty cool
we cannot be hacked here so yeah big
thanks for thumbs up
for for the charging point um
yeah okay so
now my teammate back he will walk
through
the whole journey of [ __ ] hunting of
schneider evading okay
now i'm going to share our journey
of hunting for schneider link
this is my first time please bear with
me
first i like to make it clear our mind
goes carries to god root
until and juices on the target target
and we are lucky we might our goal
and were assigned three series
from schneider in the on also
the reason to trust to research
on ebay link is because
the firmware can be easily
downloaded from slider website
and there are a certain amount amount
of uv link device i exposed to the
internet
so the first step is to do some
recon for our target and as
i said we can download the from web
directly
[Music]
the firmware is a top field top file it
includes files like bootstrap
homage ebay ic based image
file under other binary files
based on on this
files we can find the lights to target
with
our arm based direct device
under from your board file
we can find the body rate
servo ip under some other
configuration information
from homage we know the kernel version
and the untried point device which makes
it
easy for later reverse engineer
work so
now we learned the partition start
structure of our target
and we have tried to crack the root hash
inside the shadow file but
it's failed
when they started to reveal survival
manager
and interface it has many functions
such as the log files open parts
and the form while updating also
the path of a web application on the
ebay ic circle database file
there are some open source components
that every link is using
under interestingly founded two
hardcoded secret accounts
named open and schneider within the
circle file and they have been removed
from the lattice the from map
after we have done the recap time to
hunting box for one hour
we start with the cross first side
script and this guy's
as our first destiny however
this won't help us to guide us so
let's try harder
wait let's move on to reversing the
binary file cgi server
we located some useful keywords
as a ice core and this is useful
for us to distinguish
different functions
we also found some white parts
from cjs05
this may be useful for later fighting
attack
eventually we have located an
interesting function
with insight function we found
a hardcoded cr tokens
and these tokens can be used to bypass
the login author authentication process
continue to analyzing the
login process we found that one's
local size the problem with
parameter meter
we 1 5 3 we will become
true and this is
the same results as using other
coordinated tokens
which confirm the light tokens can be
used
to bypass attack
once manually and by the
security token within our request
we can successfully bypass the logging
awesome
authentication
so now we need to find a way
for rce after we search the
erc savvy we have located the
hard coded epk and
this key is used as signature
verification for firmware
after we read the epk install file
we found that the firmware package can
be
easily forged folded
as long as way build a
installing package with hardcore data
etk
as you can see rebuilding a new firmware
package
is very easy we can put our
own reverse child pilot
into the firmware package
in order to trigger the part we need to
upload the back downwards of the
firmware
as you can see once the payload
triggered
we got ourself a good shot
missing completed
so now we got rc work
let's write a working exploit
the other to do that we first
need to know the process of updating
from life
under some parameters
like final id and we can use
very sharp temperature of light
once we know the
entire updating process
we can draw a flowchart for
developing exploited undercut payload
ready and
of course we need to preview
the second section token
for the cookies request plus
without all the needed information
the exploiter is ready to go
now you may ask what can they do
after god healthy i think
most people will like to get a free
charge
right but there are
there are amount for example
it can be turned to boneless
for the dog's attack house
also it can be a breaking point
for the enterprise nightmare and thus
it hides knight either to be mis
on the right code maybe a way to
surprise rice write some wall
for cars
here are some examples for operating
to a internal network this traveling
station
is also part of the university
network
and on this parking station also running
a building
management application with a different
part is what
has our model functions to
manage the vehicle charging system
so after we found those sparks
we have reported reported them
to schleider they had fixed the
13 packs in total from the eva link
products and released the
advisory advice advisory
last month's month and assigned
us three cves
so we believe
that more trust will bring more
attack vectors vectors
and the charging solution of v2x
has got a huge
pad type potential for split security
researchers
thank you
you