pith. sign in

arxiv: 2506.16400 · v1 · submitted 2025-06-19 · 💻 cs.CR

Physical-Layer Signal Injection Attacks on EV Charging Ports: Bypassing Authentication via Electrical-Level Exploits

Pith reviewed 2026-05-19 08:38 UTC · model grok-4.3

classification 💻 cs.CR
keywords EV charging securityphysical layer attackssignal spoofingauthentication bypassSAE J1772CCS protocolPORTulatordenial of service
0
0 comments X

The pith

A compact device inserted into EV charger ports can spoof unauthenticated electrical signals to disrupt charging across major standards.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that electric vehicle chargers depend on basic physical electrical signals for authentication and control in protocols including SAE J1772, CCS, IEC 61851, GB/T 20234, and NACS. These signals lack cryptographic protection, allowing a small malicious device plugged into the connector to inject fraudulent versions that sabotage the process. The authors built and tested PORTulator, a hardware tool with a plugin injector and wireless remote, on twenty real charger piles and found seven standards vulnerable. If correct, this shows physical access to the port alone suffices to trigger denial of service, vehicle lockouts, or equipment damage. The work proposes adding non-resistive memory and dynamic high-frequency PWM signals as a fix.

Core claim

The paper claims that by inserting a compact malicious device into the charger connector, attackers can inject fraudulent signals to sabotage the charging process, leading to denial of service, vehicle-induced charger lockout, and damage to the chargers or the vehicle's charge management system. Evaluation with the PORTulator proof-of-concept on multiple real-world chargers identified seven vulnerable charging standards used by twenty charger piles. The root cause is that chargers use simple physical signals for authentication and control, making them easily spoofed by attackers.

What carries the argument

A compact malicious device inserted into the charger connector that spoofs physical electrical control signals at the authentication layer.

If this is right

  • Attackers gain the ability to cause denial of service on public and private charging stations through physical port access.
  • Specific vehicles can be locked out from chargers via spoofed signals that mimic legitimate states.
  • Equipment damage becomes possible to both chargers and vehicle charge management systems.
  • The seven standards covering twenty tested charger piles become practical targets for such physical attacks.
  • Adding non-resistive memory components and dynamic high-frequency PWM signals would raise the bar against spoofing.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Public charging networks could face reduced reliability if physical port access becomes a common entry point for disruptions.
  • Other systems using unauthenticated electrical interfaces for control, such as industrial sensors, may share similar exposure.
  • Connector redesigns that embed cryptographic checks directly at the physical interface could prevent insertion-based spoofing.
  • Widespread testing of existing charger fleets would reveal the full scope of affected installations beyond the twenty piles examined.

Load-bearing premise

Chargers rely on simple, unauthenticated physical signals for control and authentication that can be directly spoofed by an inserted device without detection or cryptographic protection.

What would settle it

Inserting the described device into a charger using one of the seven identified standards and confirming that the injected signals trigger charging failure, lockout, or damage without any built-in detection.

Figures

Figures reproduced from arXiv: 2506.16400 by Hetian Shi, Jian Mao, Jianwei Zhuge, Shangru Song, Yi He.

Figure 1
Figure 1. Figure 1: Overview of PORTulator Attack Vectors on EV Charging Infrastructure [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Charging Gun Standards (Signals from the ports, highlighted in red circles, confirm the [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Wireless Signal for ”Open Lid” Using Universal Radio Hacker (URH), we replayed this signal on multiple EV models, including Tesla Model S/Y and Volkswagen ID.4. In every case, the charging port lid opened [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Automatic Triggering of High-Temperature Protection Switch [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Falsified Signal Attack Exploiting Weak Authentication in Charging Protocols [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Comparison of Slow and Fast Charging Gun Authentication Circuits [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Design of PORTulator for Resistor Spoofing & Signal Injection pin synthesizes the CP signal to reflect various charging states. To allow for remote-controlled behavior, the hardware integrates a 433MHz wireless receiver (GC433-TC007) that accepts ˙ over-the-air commands from an Arduino-based controller. This setup enables dynamic payload delivery, such as adjusting resistance values or toggling CP duty cyc… view at source ↗
Figure 8
Figure 8. Figure 8: Physical Prototype of the PORTulator Attack Device our system mimics legitimate interactions by matching impedance and PWM behaviors expected during the communication phase. PE PE +5V +5V 330Ω 330Ω 2.7kΩ 2.7kΩ 330Ω 150Ω 150Ω Detection Point Button Unpressed Equivalent circuit Button Pressed Equivalent circuit Charging Pile Side Car Side 5.0 V Open Cable Charging Gun Connected and Button Pressed Charging Gu… view at source ↗
Figure 9
Figure 9. Figure 9: Parameter Values and Logical State Determinations at the CC Port (a) and CP Port (b) [PITH_FULL_IMAGE:figures/full_fig_p015_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: DoS Attacks on CC and CP Lines in EV Charging Systems [PITH_FULL_IMAGE:figures/full_fig_p018_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Deadlock Attack and NFC-Triggered Ransom Scenario [PITH_FULL_IMAGE:figures/full_fig_p019_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: CAN Bus Signal Injection Attack Overview [PITH_FULL_IMAGE:figures/full_fig_p020_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Solution-I: Memory Elements on Charging Gun Side [PITH_FULL_IMAGE:figures/full_fig_p023_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Solution-II: Dynamic Power Source on EV Side [PITH_FULL_IMAGE:figures/full_fig_p024_14.png] view at source ↗
read the original abstract

The proliferation of electric vehicles in recent years has significantly expanded the charging infrastructure while introducing new security risks to both vehicles and chargers. In this paper, we investigate the security of major charging protocols such as SAE J1772, CCS, IEC 61851, GB/T 20234, and NACS, uncovering new physical signal spoofing attacks in their authentication mechanisms. By inserting a compact malicious device into the charger connector, attackers can inject fraudulent signals to sabotage the charging process, leading to denial of service, vehicle-induced charger lockout, and damage to the chargers or the vehicle's charge management system. To demonstrate the feasibility of our attacks, we propose PORTulator, a proof-of-concept (PoC) attack hardware, including a charger gun plugin device for injecting physical signals and a wireless controller for remote manipulation. By evaluating PORTulator on multiple real-world chargers, we identify 7 charging standards used by 20 charger piles that are vulnerable to our attacks. The root cause is that chargers use simple physical signals for authentication and control, making them easily spoofed by attackers. To address this issue, we propose enhancing authentication circuits by integrating non-resistive memory components and utilizing dynamic high-frequency Pulse Width Modulation (PWM) signals to counter such physical signal spoofing attacks.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper claims that attackers can bypass authentication in EV charging protocols (SAE J1772, CCS, IEC 61851, GB/T 20234, NACS) by inserting a compact malicious device (PORTulator) into the charger connector to inject fraudulent physical signals on control lines, resulting in denial of service, vehicle-induced charger lockout, and damage to chargers or vehicle charge management systems. It reports a proof-of-concept hardware implementation with wireless remote control, evaluates it successfully on 20 real-world charger piles spanning 7 standards, identifies the root cause as reliance on simple unauthenticated physical signals, and proposes countermeasures using non-resistive memory components and dynamic high-frequency PWM signals.

Significance. If the empirical demonstrations hold under controlled conditions, the work has practical significance for EV charging infrastructure security by showing how physical-layer signal injection can disrupt widely deployed systems. The real-world testing across multiple standards and chargers provides concrete evidence of feasibility that could inform standards updates and hardware hardening, though the framing of results as 'bypassing authentication' rather than safety interlock manipulation requires precise qualification to avoid overstating protocol-level impacts.

major comments (2)
  1. [Abstract] Abstract: The central claim that the attacks 'bypass authentication mechanisms' and produce 'damage to the chargers or the vehicle's charge management system' rests on an unverified causal leap. SAE J1772 and IEC 61851 define CP PWM and PP resistive signals strictly for state signaling and proximity detection (safety interlocks), while cryptographic authentication occurs in separate layers (ISO 15118, OCPP). If PORTulator only manipulates these analog lines, the authentication-bypass and damage assertions are not demonstrated as protocol violations.
  2. [Abstract] Evaluation description (as summarized in Abstract): The report of successful attacks on 20 chargers across 7 standards provides no details on exact test conditions, measurement methods, environmental controls, or verification that spoofed signals actually triggered the claimed harms (e.g., lockout or damage) rather than transient state changes. This undermines verifiability of the feasibility claim.
minor comments (2)
  1. [Abstract] The abstract and root-cause statement use 'authentication' for physical signals without distinguishing them from cryptographic mechanisms; add a short clarification paragraph early in the introduction.
  2. Consider adding a table summarizing which specific signals (pilot, proximity, etc.) were targeted per standard and the observed outcomes for each of the 20 chargers.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback on our manuscript. We appreciate the emphasis on precise terminology and experimental verifiability. Below we respond to each major comment and indicate the revisions we will make.

read point-by-point responses
  1. Referee: [Abstract] Abstract: The central claim that the attacks 'bypass authentication mechanisms' and produce 'damage to the chargers or the vehicle's charge management system' rests on an unverified causal leap. SAE J1772 and IEC 61851 define CP PWM and PP resistive signals strictly for state signaling and proximity detection (safety interlocks), while cryptographic authentication occurs in separate layers (ISO 15118, OCPP). If PORTulator only manipulates these analog lines, the authentication-bypass and damage assertions are not demonstrated as protocol violations.

    Authors: We agree that the phrasing 'bypass authentication mechanisms' risks conflating physical-layer signaling with higher-layer cryptographic authentication. In the manuscript we use the term to describe the physical signals (CP PWM duty cycle and PP resistance) that the standards rely upon to establish connection state and authorize power delivery; these signals function as the initial, unauthenticated gate for the charging session. Our attacks show that spoofing them allows an attacker to induce incorrect states that the charger accepts as legitimate. We will revise the abstract, introduction, and discussion to replace 'bypass authentication' with 'manipulate unauthenticated physical-layer control signals' and to explicitly distinguish these from ISO 15118 / OCPP mechanisms. On damage, the experiments recorded charger lockouts and abnormal current/voltage behavior that, if sustained, can stress components; we will add concrete observations and clarify that we demonstrate potential for damage rather than guaranteed hardware failure. revision: partial

  2. Referee: [Abstract] Evaluation description (as summarized in Abstract): The report of successful attacks on 20 chargers across 7 standards provides no details on exact test conditions, measurement methods, environmental controls, or verification that spoofed signals actually triggered the claimed harms (e.g., lockout or damage) rather than transient state changes. This undermines verifiability of the feasibility claim.

    Authors: We accept that the abstract is too terse. The full manuscript contains an evaluation section that describes the 20 chargers, the seven standards, and the observed outcomes, but it does not summarize the test environment or verification steps at the abstract level. We will expand the abstract with a concise description of the controlled laboratory setting, the instruments used (oscilloscope for PWM/PP waveform capture, multimeter for resistance checks), and the verification procedure (monitoring charger status indicators, vehicle-side responses, and log outputs to confirm sustained lockout rather than transient glitches). Expanded methodological details will also be added to the evaluation section. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical attack demonstration grounded in external testing and standards

full rationale

The paper is an empirical security study demonstrating physical signal injection attacks via a custom PORTulator hardware PoC, evaluated on 20 real-world charger piles across 7 standards. No equations, fitted parameters, predictions, or derivation chains appear in the provided text. Claims rest on direct experimental observation of SAE J1772/IEC 61851 control signals and external protocol references rather than self-referential reductions or load-bearing self-citations. The root-cause statement and mitigation suggestions follow from the observed hardware behavior without internal loops.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The central claim rests on the domain assumption that existing charging protocols use unauthenticated simple physical signals; no free parameters or invented entities beyond the proposed PORTulator hardware are introduced.

axioms (1)
  • domain assumption Major charging protocols authenticate and control via simple, directly observable physical signals that lack cryptographic or hardware-level protections against spoofing.
    Explicitly stated as the root cause enabling the attacks.
invented entities (1)
  • PORTulator no independent evidence
    purpose: Proof-of-concept hardware for injecting physical signals and remote control of attacks.
    New device constructed for the demonstration; no independent evidence outside the paper's tests is provided.

pith-pipeline@v0.9.0 · 5769 in / 1329 out tokens · 50414 ms · 2026-05-19T08:38:52.938593+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

33 extracted references · 33 canonical work pages

  1. [1]

    Definition and implementation of a global ev park charge,

    “Definition and implementation of a global ev park charge,” accessed: 2023-10-05. [Online]. Available: https: //www.yumpu.com/en/document/read/39489467/definition-and-implementation-of-a-global-ev-park-charge

  2. [2]

    Iec 61851-1 standard document,

    “Iec 61851-1 standard document,” accessed: 2023-10-05. [Online]. Available: http://www.msi-automation.com/Download/ jishujiaoliu/IEC61851-1-2010-%E6%8E%A7%E5%88%B6%E5%AF%BC%E5%BC%95%E7%94%B5%E8%B7%AF% E7%9B%B8%E5%85%B3%E5%86%85%E5%AE%B9.pdf

  3. [3]

    Physical connection of dc charging process,

    “Physical connection of dc charging process,” accessed: 2023-10-05. [Online]. Available: https://wattsaving.com/blogs/ knowledge-base/physical-connection-of-dc-charging-process 30

  4. [4]

    Specifications iec 309-2 charging concept,

    “Specifications iec 309-2 charging concept,” accessed: 2023-10-05. [Online]. Available: https://www.yumpu.com/en/ document/view/39489470/specifications-iec-309-2-charging-concept-park-charge

  5. [5]

    Reverse Engineering an EV Charger,

    “Reverse Engineering an EV Charger,” https://news.ycombinator.com/item?id=33564088, 2023, accessed: 2023-11-10

  6. [6]

    Demo: Ransom Vehicle through Charging Pile,

    Anonymous, “Demo: Ransom Vehicle through Charging Pile,” in Proceedings of the 2023 Inaugural Symposium on Vehicle Security and Privacy , ser. VehicleSec ’23, 2023

  7. [7]

    Losing the car keys: Wireless {PHY-Layer} insecurity in {EV} charging,

    R. Baker and I. Martinovic, “Losing the car keys: Wireless {PHY-Layer} insecurity in {EV} charging,” in 28th USENIX Security Symposium (USENIX Security 19) , 2019, pp. 407–424

  8. [8]

    An analysis of atm and point-of-sale skimming,

    J. Ciaccio and I. Onat, “An analysis of atm and point-of-sale skimming,” Policy, 2025

  9. [9]

    Evexchange: A relay attack on electric vehicle charging system,

    M. Conti, D. Donadel, R. Poovendran, and F. Turrin, “Evexchange: A relay attack on electric vehicle charging system,” in European Symposium on Research in Computer Security . Springer, 2022, pp. 488–508

  10. [10]

    contributors

    W. contributors. Combined charging system. [Online]. Available: https://en.wikipedia.org/wiki/Combined Charging System

  11. [11]

    V2g injector: Whispering to cars and charging units through the power-line,

    S. Dudek, J.-C. Delaunay, and V . Fargues, “V2g injector: Whispering to cars and charging units through the power-line,” in Proceedings of the SSTIC (Symposium sur la s ´ecurit´e des technologies de l’information et des communications), Rennes, France, 2019, pp. 5–7

  12. [12]

    Ev charging: Mapping out the cyber security threats and solutions for grids and charging infrastructure,

    C. Hille and M. Allhoff, “Ev charging: Mapping out the cyber security threats and solutions for grids and charging infrastructure,” UtiliNet Europe, 2018

  13. [13]

    Spoofing attack using bus-off attacks against a specific ecu of the can bus,

    K. Iehira, H. Inoue, and K. Ishida, “Spoofing attack using bus-off attacks against a specific ecu of the can bus,” in 2018 15th IEEE annual consumer communications & networking conference (CCNC) . IEEE, 2018, pp. 1–4

  14. [14]

    Electric vehicle charging cybersecurity vulnerabilities,

    S. R. Institute, “Electric vehicle charging cybersecurity vulnerabilities,” https://www.swri.org/press-release/ electric-vehicle-charging-cybersecurity-vulnerabilities, 2024, accessed: 2024-07-25

  15. [15]

    Electric vehicle cybersecurity services,

    ——, “Electric vehicle cybersecurity services,” https://www.swri.org/industry/automotive-software-electronics/ electric-vehicle-cybersecurity-services, 2024, accessed: 2024-07-25

  16. [16]

    Cybersecurity for electric vehicle charging infrastructure,

    J. Johnson, B. Anderson, B. Wright, J. Quiroz, T. Berg, R. Graves, J. Daley, K. Phan, M. Kunz, R. Pratt et al., “Cybersecurity for electric vehicle charging infrastructure,” Sandia National Lab.(SNL-NM), Albuquerque, NM (United States), Tech. Rep., 2022

  17. [17]

    Self-sovereign identity for electric vehicle charging,

    A. Kailus, D. Kern, and C. Krauß, “Self-sovereign identity for electric vehicle charging,” in International Conference on Applied Cryptography and Network Security . Springer, 2024, pp. 137–162

  18. [18]

    Brokenwire: Wireless disruption of ccs electric vehicle charging,

    S. K ¨ohler, R. Baker, M. Strohmeier, and I. Martinovic, “Brokenwire: Wireless disruption of ccs electric vehicle charging,” arXiv preprint arXiv:2202.02104 , 2022

  19. [19]

    Rcid: Fingerprinting passive rfid tags via wideband backscatter,

    J. Li, A. Li, D. Han, Y . Zhang, T. Li, and Y . Zhang, “Rcid: Fingerprinting passive rfid tags via wideband backscatter,” in IEEE INFOCOM 2022-IEEE Conference on Computer Communications . IEEE, 2022, pp. 700–709

  20. [20]

    Enhanced proof-of-benefit: A secure blockchain-enabled ev charging system,

    C. Liu, K. K. Chai, X. Zhang, and Y . Chen, “Enhanced proof-of-benefit: A secure blockchain-enabled ev charging system,” in 2019 IEEE 90th Vehicular Technology Conference (VTC2019-Fall) . IEEE, 2019, pp. 1–6

  21. [21]

    Chademo-conformity high-power charger connector assembly for over 100 kw-class ev charge,

    T. Nakanishi, H. Zaitsu, T. Kikuta, S. Tsuda, H. Nii, and S. Kodama, “Chademo-conformity high-power charger connector assembly for over 100 kw-class ev charge,” SEI Tech Rev, vol. 88, pp. 49–54, 2019

  22. [22]

    Chargeprint: A framework for internet-scale discovery and security analysis of ev charging management systems

    T. Nasr, S. Torabi, E. Bou-Harb, C. Fachkha, and C. Assi, “Chargeprint: A framework for internet-scale discovery and security analysis of ev charging management systems.” in NDSS, 2023

  23. [23]

    RP2040 Hardware Design,

    Raspberry Pi Foundation, “RP2040 Hardware Design,” https://datasheets.raspberrypi.com/rp2040/ hardware-design-with-rp2040.pdf, 2024, accessed: 2024-04-27

  24. [24]

    Fear the reaper: Characterization and fast detection of card skimmers,

    N. Scaife, C. Peeters, and P. Traynor, “Fear the reaper: Characterization and fast detection of card skimmers,” in 27th USENIX Security Symposium (USENIX Security 18) , 2018, pp. 1–14. 31

  25. [25]

    Laser-based command injection attacks on voice-controlled microphone arrays,

    H. Shi, Y . He, Q. Wang, J. Zhuge, Q. Li, and X. Liu, “Laser-based command injection attacks on voice-controlled microphone arrays,” IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) , vol. 2024, no. 2, pp. 654–676, 2024

  26. [26]

    Light commands: {Laser-Based} audio injection attacks on {V oice-Controllable} systems,

    T. Sugawara, B. Cyr, S. Rampazzi, D. Genkin, and K. Fu, “Light commands: {Laser-Based} audio injection attacks on {V oice-Controllable} systems,” in 29th USENIX Security Symposium (USENIX Security 20) , 2020, pp. 2631–2648

  27. [27]

    [Online]

    Tesla Inc., Tesla Model X Owner’s Manual , 2024, accessed: 2024-04-26. [Online]. Available: http://5491145.s21d-5. faiusrd.com/61/ABUIABA9GAAg2KDH gUoztumpwY .pdf

  28. [28]

    Securing the electric vehicle charging infrastructure: An in-depth analysis of vulnerabilities and countermeasures,

    G. Vailoces, A. Keith, A. Almehmadi, and K. El-Khatib, “Securing the electric vehicle charging infrastructure: An in-depth analysis of vulnerabilities and countermeasures,” in Proceedings of the Int’l ACM Symposium on Design and Analysis of Intelligent Vehicular Networks and Applications , 2023, pp. 31–38

  29. [29]

    Risks of electric vehicle supply equipment integration within building energy management system environments: A look at remote attack surface and implications,

    R. Varriale, R. Crawford, and M. Jaynes, “Risks of electric vehicle supply equipment integration within building energy management system environments: A look at remote attack surface and implications,” in National Cyber Summit (NCS) Research Track 2021. Springer, 2022, pp. 163–173

  30. [30]

    Enhancing communication security an in-vehicle wireless sensor network,

    A. Ven ˇckauskas, M. Taparauskas, ˇS. Grigali ¯unas, and R. Br ¯uzgien˙e, “Enhancing communication security an in-vehicle wireless sensor network,” Electronics, vol. 13, no. 6, p. 1003, 2024

  31. [31]

    Ghosttalk: Interactive attack on smartphone voice system through power line,

    Y . Wang, H. Guo, and Q. Yan, “Ghosttalk: Interactive attack on smartphone voice system through power line,” arXiv preprint arXiv:2202.02585, 2022

  32. [32]

    Safeguarding the future: A comprehensive analysis of security measures for smart grids,

    S. A. Wasumwa, “Safeguarding the future: A comprehensive analysis of security measures for smart grids,” World Journal of Advanced Research and Reviews , vol. 19, no. 1, pp. 847–871, 2023

  33. [33]

    Sae j1772 — Wikipedia, the free encyclopedia,

    Wikipedia contributors, “Sae j1772 — Wikipedia, the free encyclopedia,” 2024, [Online; accessed 18-April-2024]. [Online]. Available: https://en.wikipedia.org/wiki/SAE J1772