Physical-Layer Signal Injection Attacks on EV Charging Ports: Bypassing Authentication via Electrical-Level Exploits
Pith reviewed 2026-05-19 08:38 UTC · model grok-4.3
The pith
A compact device inserted into EV charger ports can spoof unauthenticated electrical signals to disrupt charging across major standards.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The paper claims that by inserting a compact malicious device into the charger connector, attackers can inject fraudulent signals to sabotage the charging process, leading to denial of service, vehicle-induced charger lockout, and damage to the chargers or the vehicle's charge management system. Evaluation with the PORTulator proof-of-concept on multiple real-world chargers identified seven vulnerable charging standards used by twenty charger piles. The root cause is that chargers use simple physical signals for authentication and control, making them easily spoofed by attackers.
What carries the argument
A compact malicious device inserted into the charger connector that spoofs physical electrical control signals at the authentication layer.
If this is right
- Attackers gain the ability to cause denial of service on public and private charging stations through physical port access.
- Specific vehicles can be locked out from chargers via spoofed signals that mimic legitimate states.
- Equipment damage becomes possible to both chargers and vehicle charge management systems.
- The seven standards covering twenty tested charger piles become practical targets for such physical attacks.
- Adding non-resistive memory components and dynamic high-frequency PWM signals would raise the bar against spoofing.
Where Pith is reading between the lines
- Public charging networks could face reduced reliability if physical port access becomes a common entry point for disruptions.
- Other systems using unauthenticated electrical interfaces for control, such as industrial sensors, may share similar exposure.
- Connector redesigns that embed cryptographic checks directly at the physical interface could prevent insertion-based spoofing.
- Widespread testing of existing charger fleets would reveal the full scope of affected installations beyond the twenty piles examined.
Load-bearing premise
Chargers rely on simple, unauthenticated physical signals for control and authentication that can be directly spoofed by an inserted device without detection or cryptographic protection.
What would settle it
Inserting the described device into a charger using one of the seven identified standards and confirming that the injected signals trigger charging failure, lockout, or damage without any built-in detection.
Figures
read the original abstract
The proliferation of electric vehicles in recent years has significantly expanded the charging infrastructure while introducing new security risks to both vehicles and chargers. In this paper, we investigate the security of major charging protocols such as SAE J1772, CCS, IEC 61851, GB/T 20234, and NACS, uncovering new physical signal spoofing attacks in their authentication mechanisms. By inserting a compact malicious device into the charger connector, attackers can inject fraudulent signals to sabotage the charging process, leading to denial of service, vehicle-induced charger lockout, and damage to the chargers or the vehicle's charge management system. To demonstrate the feasibility of our attacks, we propose PORTulator, a proof-of-concept (PoC) attack hardware, including a charger gun plugin device for injecting physical signals and a wireless controller for remote manipulation. By evaluating PORTulator on multiple real-world chargers, we identify 7 charging standards used by 20 charger piles that are vulnerable to our attacks. The root cause is that chargers use simple physical signals for authentication and control, making them easily spoofed by attackers. To address this issue, we propose enhancing authentication circuits by integrating non-resistive memory components and utilizing dynamic high-frequency Pulse Width Modulation (PWM) signals to counter such physical signal spoofing attacks.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper claims that attackers can bypass authentication in EV charging protocols (SAE J1772, CCS, IEC 61851, GB/T 20234, NACS) by inserting a compact malicious device (PORTulator) into the charger connector to inject fraudulent physical signals on control lines, resulting in denial of service, vehicle-induced charger lockout, and damage to chargers or vehicle charge management systems. It reports a proof-of-concept hardware implementation with wireless remote control, evaluates it successfully on 20 real-world charger piles spanning 7 standards, identifies the root cause as reliance on simple unauthenticated physical signals, and proposes countermeasures using non-resistive memory components and dynamic high-frequency PWM signals.
Significance. If the empirical demonstrations hold under controlled conditions, the work has practical significance for EV charging infrastructure security by showing how physical-layer signal injection can disrupt widely deployed systems. The real-world testing across multiple standards and chargers provides concrete evidence of feasibility that could inform standards updates and hardware hardening, though the framing of results as 'bypassing authentication' rather than safety interlock manipulation requires precise qualification to avoid overstating protocol-level impacts.
major comments (2)
- [Abstract] Abstract: The central claim that the attacks 'bypass authentication mechanisms' and produce 'damage to the chargers or the vehicle's charge management system' rests on an unverified causal leap. SAE J1772 and IEC 61851 define CP PWM and PP resistive signals strictly for state signaling and proximity detection (safety interlocks), while cryptographic authentication occurs in separate layers (ISO 15118, OCPP). If PORTulator only manipulates these analog lines, the authentication-bypass and damage assertions are not demonstrated as protocol violations.
- [Abstract] Evaluation description (as summarized in Abstract): The report of successful attacks on 20 chargers across 7 standards provides no details on exact test conditions, measurement methods, environmental controls, or verification that spoofed signals actually triggered the claimed harms (e.g., lockout or damage) rather than transient state changes. This undermines verifiability of the feasibility claim.
minor comments (2)
- [Abstract] The abstract and root-cause statement use 'authentication' for physical signals without distinguishing them from cryptographic mechanisms; add a short clarification paragraph early in the introduction.
- Consider adding a table summarizing which specific signals (pilot, proximity, etc.) were targeted per standard and the observed outcomes for each of the 20 chargers.
Simulated Author's Rebuttal
We thank the referee for the constructive feedback on our manuscript. We appreciate the emphasis on precise terminology and experimental verifiability. Below we respond to each major comment and indicate the revisions we will make.
read point-by-point responses
-
Referee: [Abstract] Abstract: The central claim that the attacks 'bypass authentication mechanisms' and produce 'damage to the chargers or the vehicle's charge management system' rests on an unverified causal leap. SAE J1772 and IEC 61851 define CP PWM and PP resistive signals strictly for state signaling and proximity detection (safety interlocks), while cryptographic authentication occurs in separate layers (ISO 15118, OCPP). If PORTulator only manipulates these analog lines, the authentication-bypass and damage assertions are not demonstrated as protocol violations.
Authors: We agree that the phrasing 'bypass authentication mechanisms' risks conflating physical-layer signaling with higher-layer cryptographic authentication. In the manuscript we use the term to describe the physical signals (CP PWM duty cycle and PP resistance) that the standards rely upon to establish connection state and authorize power delivery; these signals function as the initial, unauthenticated gate for the charging session. Our attacks show that spoofing them allows an attacker to induce incorrect states that the charger accepts as legitimate. We will revise the abstract, introduction, and discussion to replace 'bypass authentication' with 'manipulate unauthenticated physical-layer control signals' and to explicitly distinguish these from ISO 15118 / OCPP mechanisms. On damage, the experiments recorded charger lockouts and abnormal current/voltage behavior that, if sustained, can stress components; we will add concrete observations and clarify that we demonstrate potential for damage rather than guaranteed hardware failure. revision: partial
-
Referee: [Abstract] Evaluation description (as summarized in Abstract): The report of successful attacks on 20 chargers across 7 standards provides no details on exact test conditions, measurement methods, environmental controls, or verification that spoofed signals actually triggered the claimed harms (e.g., lockout or damage) rather than transient state changes. This undermines verifiability of the feasibility claim.
Authors: We accept that the abstract is too terse. The full manuscript contains an evaluation section that describes the 20 chargers, the seven standards, and the observed outcomes, but it does not summarize the test environment or verification steps at the abstract level. We will expand the abstract with a concise description of the controlled laboratory setting, the instruments used (oscilloscope for PWM/PP waveform capture, multimeter for resistance checks), and the verification procedure (monitoring charger status indicators, vehicle-side responses, and log outputs to confirm sustained lockout rather than transient glitches). Expanded methodological details will also be added to the evaluation section. revision: yes
Circularity Check
No circularity: empirical attack demonstration grounded in external testing and standards
full rationale
The paper is an empirical security study demonstrating physical signal injection attacks via a custom PORTulator hardware PoC, evaluated on 20 real-world charger piles across 7 standards. No equations, fitted parameters, predictions, or derivation chains appear in the provided text. Claims rest on direct experimental observation of SAE J1772/IEC 61851 control signals and external protocol references rather than self-referential reductions or load-bearing self-citations. The root-cause statement and mitigation suggestions follow from the observed hardware behavior without internal loops.
Axiom & Free-Parameter Ledger
axioms (1)
- domain assumption Major charging protocols authenticate and control via simple, directly observable physical signals that lack cryptographic or hardware-level protections against spoofing.
invented entities (1)
-
PORTulator
no independent evidence
Reference graph
Works this paper leans on
-
[1]
Definition and implementation of a global ev park charge,
“Definition and implementation of a global ev park charge,” accessed: 2023-10-05. [Online]. Available: https: //www.yumpu.com/en/document/read/39489467/definition-and-implementation-of-a-global-ev-park-charge
-
[2]
Iec 61851-1 standard document,
“Iec 61851-1 standard document,” accessed: 2023-10-05. [Online]. Available: http://www.msi-automation.com/Download/ jishujiaoliu/IEC61851-1-2010-%E6%8E%A7%E5%88%B6%E5%AF%BC%E5%BC%95%E7%94%B5%E8%B7%AF% E7%9B%B8%E5%85%B3%E5%86%85%E5%AE%B9.pdf
work page 2023
-
[3]
Physical connection of dc charging process,
“Physical connection of dc charging process,” accessed: 2023-10-05. [Online]. Available: https://wattsaving.com/blogs/ knowledge-base/physical-connection-of-dc-charging-process 30
work page 2023
-
[4]
Specifications iec 309-2 charging concept,
“Specifications iec 309-2 charging concept,” accessed: 2023-10-05. [Online]. Available: https://www.yumpu.com/en/ document/view/39489470/specifications-iec-309-2-charging-concept-park-charge
-
[5]
Reverse Engineering an EV Charger,
“Reverse Engineering an EV Charger,” https://news.ycombinator.com/item?id=33564088, 2023, accessed: 2023-11-10
work page 2023
-
[6]
Demo: Ransom Vehicle through Charging Pile,
Anonymous, “Demo: Ransom Vehicle through Charging Pile,” in Proceedings of the 2023 Inaugural Symposium on Vehicle Security and Privacy , ser. VehicleSec ’23, 2023
work page 2023
-
[7]
Losing the car keys: Wireless {PHY-Layer} insecurity in {EV} charging,
R. Baker and I. Martinovic, “Losing the car keys: Wireless {PHY-Layer} insecurity in {EV} charging,” in 28th USENIX Security Symposium (USENIX Security 19) , 2019, pp. 407–424
work page 2019
-
[8]
An analysis of atm and point-of-sale skimming,
J. Ciaccio and I. Onat, “An analysis of atm and point-of-sale skimming,” Policy, 2025
work page 2025
-
[9]
Evexchange: A relay attack on electric vehicle charging system,
M. Conti, D. Donadel, R. Poovendran, and F. Turrin, “Evexchange: A relay attack on electric vehicle charging system,” in European Symposium on Research in Computer Security . Springer, 2022, pp. 488–508
work page 2022
-
[10]
W. contributors. Combined charging system. [Online]. Available: https://en.wikipedia.org/wiki/Combined Charging System
-
[11]
V2g injector: Whispering to cars and charging units through the power-line,
S. Dudek, J.-C. Delaunay, and V . Fargues, “V2g injector: Whispering to cars and charging units through the power-line,” in Proceedings of the SSTIC (Symposium sur la s ´ecurit´e des technologies de l’information et des communications), Rennes, France, 2019, pp. 5–7
work page 2019
-
[12]
C. Hille and M. Allhoff, “Ev charging: Mapping out the cyber security threats and solutions for grids and charging infrastructure,” UtiliNet Europe, 2018
work page 2018
-
[13]
Spoofing attack using bus-off attacks against a specific ecu of the can bus,
K. Iehira, H. Inoue, and K. Ishida, “Spoofing attack using bus-off attacks against a specific ecu of the can bus,” in 2018 15th IEEE annual consumer communications & networking conference (CCNC) . IEEE, 2018, pp. 1–4
work page 2018
-
[14]
Electric vehicle charging cybersecurity vulnerabilities,
S. R. Institute, “Electric vehicle charging cybersecurity vulnerabilities,” https://www.swri.org/press-release/ electric-vehicle-charging-cybersecurity-vulnerabilities, 2024, accessed: 2024-07-25
work page 2024
-
[15]
Electric vehicle cybersecurity services,
——, “Electric vehicle cybersecurity services,” https://www.swri.org/industry/automotive-software-electronics/ electric-vehicle-cybersecurity-services, 2024, accessed: 2024-07-25
work page 2024
-
[16]
Cybersecurity for electric vehicle charging infrastructure,
J. Johnson, B. Anderson, B. Wright, J. Quiroz, T. Berg, R. Graves, J. Daley, K. Phan, M. Kunz, R. Pratt et al., “Cybersecurity for electric vehicle charging infrastructure,” Sandia National Lab.(SNL-NM), Albuquerque, NM (United States), Tech. Rep., 2022
work page 2022
-
[17]
Self-sovereign identity for electric vehicle charging,
A. Kailus, D. Kern, and C. Krauß, “Self-sovereign identity for electric vehicle charging,” in International Conference on Applied Cryptography and Network Security . Springer, 2024, pp. 137–162
work page 2024
-
[18]
Brokenwire: Wireless disruption of ccs electric vehicle charging,
S. K ¨ohler, R. Baker, M. Strohmeier, and I. Martinovic, “Brokenwire: Wireless disruption of ccs electric vehicle charging,” arXiv preprint arXiv:2202.02104 , 2022
-
[19]
Rcid: Fingerprinting passive rfid tags via wideband backscatter,
J. Li, A. Li, D. Han, Y . Zhang, T. Li, and Y . Zhang, “Rcid: Fingerprinting passive rfid tags via wideband backscatter,” in IEEE INFOCOM 2022-IEEE Conference on Computer Communications . IEEE, 2022, pp. 700–709
work page 2022
-
[20]
Enhanced proof-of-benefit: A secure blockchain-enabled ev charging system,
C. Liu, K. K. Chai, X. Zhang, and Y . Chen, “Enhanced proof-of-benefit: A secure blockchain-enabled ev charging system,” in 2019 IEEE 90th Vehicular Technology Conference (VTC2019-Fall) . IEEE, 2019, pp. 1–6
work page 2019
-
[21]
Chademo-conformity high-power charger connector assembly for over 100 kw-class ev charge,
T. Nakanishi, H. Zaitsu, T. Kikuta, S. Tsuda, H. Nii, and S. Kodama, “Chademo-conformity high-power charger connector assembly for over 100 kw-class ev charge,” SEI Tech Rev, vol. 88, pp. 49–54, 2019
work page 2019
-
[22]
T. Nasr, S. Torabi, E. Bou-Harb, C. Fachkha, and C. Assi, “Chargeprint: A framework for internet-scale discovery and security analysis of ev charging management systems.” in NDSS, 2023
work page 2023
-
[23]
Raspberry Pi Foundation, “RP2040 Hardware Design,” https://datasheets.raspberrypi.com/rp2040/ hardware-design-with-rp2040.pdf, 2024, accessed: 2024-04-27
work page 2024
-
[24]
Fear the reaper: Characterization and fast detection of card skimmers,
N. Scaife, C. Peeters, and P. Traynor, “Fear the reaper: Characterization and fast detection of card skimmers,” in 27th USENIX Security Symposium (USENIX Security 18) , 2018, pp. 1–14. 31
work page 2018
-
[25]
Laser-based command injection attacks on voice-controlled microphone arrays,
H. Shi, Y . He, Q. Wang, J. Zhuge, Q. Li, and X. Liu, “Laser-based command injection attacks on voice-controlled microphone arrays,” IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) , vol. 2024, no. 2, pp. 654–676, 2024
work page 2024
-
[26]
Light commands: {Laser-Based} audio injection attacks on {V oice-Controllable} systems,
T. Sugawara, B. Cyr, S. Rampazzi, D. Genkin, and K. Fu, “Light commands: {Laser-Based} audio injection attacks on {V oice-Controllable} systems,” in 29th USENIX Security Symposium (USENIX Security 20) , 2020, pp. 2631–2648
work page 2020
- [27]
-
[28]
G. Vailoces, A. Keith, A. Almehmadi, and K. El-Khatib, “Securing the electric vehicle charging infrastructure: An in-depth analysis of vulnerabilities and countermeasures,” in Proceedings of the Int’l ACM Symposium on Design and Analysis of Intelligent Vehicular Networks and Applications , 2023, pp. 31–38
work page 2023
-
[29]
R. Varriale, R. Crawford, and M. Jaynes, “Risks of electric vehicle supply equipment integration within building energy management system environments: A look at remote attack surface and implications,” in National Cyber Summit (NCS) Research Track 2021. Springer, 2022, pp. 163–173
work page 2021
-
[30]
Enhancing communication security an in-vehicle wireless sensor network,
A. Ven ˇckauskas, M. Taparauskas, ˇS. Grigali ¯unas, and R. Br ¯uzgien˙e, “Enhancing communication security an in-vehicle wireless sensor network,” Electronics, vol. 13, no. 6, p. 1003, 2024
work page 2024
-
[31]
Ghosttalk: Interactive attack on smartphone voice system through power line,
Y . Wang, H. Guo, and Q. Yan, “Ghosttalk: Interactive attack on smartphone voice system through power line,” arXiv preprint arXiv:2202.02585, 2022
-
[32]
Safeguarding the future: A comprehensive analysis of security measures for smart grids,
S. A. Wasumwa, “Safeguarding the future: A comprehensive analysis of security measures for smart grids,” World Journal of Advanced Research and Reviews , vol. 19, no. 1, pp. 847–871, 2023
work page 2023
-
[33]
Sae j1772 — Wikipedia, the free encyclopedia,
Wikipedia contributors, “Sae j1772 — Wikipedia, the free encyclopedia,” 2024, [Online; accessed 18-April-2024]. [Online]. Available: https://en.wikipedia.org/wiki/SAE J1772
work page 2024
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.