Mastodawn

✧✦Catherine✦✧Oct 22

hey wanna read some horrors? https://www.w3.org/TR/exi/

Efficient XML Interchange (EXI) Format 1.0 (Second Edition)

@whitequark
The real horror is that #EXI is used in an ISO 15118 sandwich on top of HomePlug AV (with broken encryption) and TCP (mostly with no encryption, but sometimes mixed with a wild PKI) to real-time control up to a Megawatt of electric power flowing into a car.

#PowerLine #V2G #EV

✧✦Catherine✦✧Oct 23

@ge0rg aaahhhh

@whitequark
And to add to the horror, all of the cars and chargers are in the same physical powerline broadcast domain, so when another car is plugged in, it needs to broadcast ping and measure the response signal strength(*) to find out which charger it's connected to...

And once the data channel is up, you authorize the payment with the absolutely unforgeable and secret... *checks notes* serial number of your RFID card!

(*) SLAC (Signal Level Attenuation Characterization)

✧✦Catherine✦✧Oct 23

@ge0rg I would rhetorically ask "are these people on drugs?" however I've known many, _many_ drug addicts and most of them designed vastly better architecture that whatever the fuck this is

@whitequark
Designed by electrical engineers!

✧✦Catherine✦✧Oct 23

@ge0rg See, this unfortunately makes an amount of sense I wish it didn't

KeithTheEE Oct 23

@whitequark @ge0rg

... Yeah I gotta agree, uncomfortably that answer makes sense.

@whitequark @ge0rg in the same way that digital protocols designed by RF (and/or telecoms) engineers tend to, I’d guess

F4GRX SÃ©bastien Oct 23

@ge0rg @whitequark and a ketaminated bufoon, apparently.

✧✦Catherine✦✧Oct 23

@f4grx @ge0rg i have done a lot of ketamine. it doesn't make you Like That

@whitequark @f4grx @ge0rg can confirm for both this and other compounds

The Drug Alone ain't the whole story

F4GRX SÃ©bastien Oct 23

@ge0rg @whitequark what
The
Fuck

AliveDevil Oct 23

@ge0rg @whitequark
Just to confirm my slightest hope here:
When my car isn’t premium enough to have ISO 15118 charging … I‘m better off? Or is the communication between charging station and eg provider app equally cursed?

@AliveDevil
How cursed is XML-RPC? 😈

The charger is connected to its backend via OCPP. Luckily, they are phasing out OCPP-X (XML-RPC) in favor of OCPP-J (JSON over WebSockets). Sometimes they even deploy HTTPS on their custom mobile APNs!

When charging with an RFID card, the serial number (UID) sentiment remains. When charging with an app, they should be using whatever custom API your provider made, and OCPI (if I remember right) to the provider of the charger!

@AliveDevil @ge0rg @whitequark So basically all of the EV charging plugs allow encapsulation of arbitrary IEEE 802.* protocols.

I’m shocked we haven’t seen a ransomware incident spread from a public charger to cars yet.

@bob_zim
Luckily, the current generation of car-side controllers are minimal, well-shielded, commercial embedded TCP stacks, limited to the task at hand. They are not supposed to fully bridge into car side networks, only interfacing to CAN. However, it's going to be interesting when/if the manufacturers implement ISO 15118-20 certificate provisioning though the charger, and I'm eager to see malformed certificates breaking the infotainment like https://arstechnica.com/cars/2022/02/radio-station-snafu-in-seattle-bricks-some-mazda-infotainment-systems/
@AliveDevil @whitequark

Radio station snafu in Seattle bricks some Mazda infotainment systems

The problem was a broadcast containing image files with no extensions.

Ars Technica

@ge0rg @whitequark I'm sorry, THEY'RE IN THE SAME BROADCAST DOMAIN AND THEY DO WHAT???

@robot
You know, powerline is essentially a high frequency radio protocol using power lines as antennas, and there is _quite_ a bunch of power lines in an EV charging park.

https://www.sstic.org/media/SSTIC2019/SSTIC-actes/v2g_injector_playing_with_electric_cars_and_chargi/SSTIC2019-Article-v2g_injector_playing_with_electric_cars_and_charging_stations_via_powerline-dudek.pdf §3.2 has a nice write-up of that protocol. Bring booze.
@whitequark

@ge0rg @whitequark i just assumed there was some attempt at isolation, thanks for the article. I definitely am going to read it.

@robot
The isolation happens by creating a logical powerline network between the EV and its charger, after the attenuation measurement, by exchanging the network encryption key in cleartext.
@whitequark

@ge0rg @whitequark I mean, i'm aware of that vulnerability, I was assuming there was at least some attempt at electrical isolation somehow rather than just logical (even if ultimately moot). but i guess i hoped too much.

miniBill (Leonardo)Oct 24

@ge0rg @robot @whitequark aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Vincent Sparks Oct 24

@ge0rg @robot @whitequark you're kidding.

@AVincentInSpace @ge0rg @whitequark they aren't

Vincent Sparks Oct 24

@robot @ge0rg @whitequark no. i refuse to believe it. there is no way the people designing critical EV charging/V2G systems are this catastrophically bad at their jobs

@AVincentInSpace @ge0rg @whitequark they didn't design the powerline communication standard. watch the talk posted elsewhere in the thread or read the (different but related) pdf

@ge0rg there is one charging provider in aus that does autocharge based on vehicle mac address. im sure that could be spoofed easily enough.

@redback
I guess that the issue with spoofing the MAC for Autocharge is that you either need to MitM the connection in real-time from the outside, or you need to get physical access to the EV side charging controller to change the MAC stored in its flash. This is orders of magnitude harder than reading and spoofing somebody's RFID card UID.

@ge0rg *wanders round Everything Electric show with RFID reader*

Aris Adamantiadis

💲Paid Oct 24

@ge0rg @redback my EV also requires being unlocked to get access to the power plug, which would be required to get the MAC address. Unless they show it on screen somewhere.

@aris obtaining your MAC address is really easy. I just have to sniff the powerline network while you are charging. I can do that with a wire wrapped around my own charger cable or maybe even with an SDR from a parking lot close-by.
@redback

Jakob (Jack/Jackie)Oct 24

@ge0rg @whitequark welll... Strictly speaking they shouldn't be connected. But the devs knew that powerline can easily couple over a few meters of distance ^^'
The mind boggling part is that the car trusts the signal strength reported by the charger for selection so man in the middle attacks are *stupidly* simple the moment you can couple into the powerline network (that uses a static, well known key during handshake and they don't do a proper key exchange but just send the new key in plain!)

@ge0rg secure industrial control systems are an unsolved problem by computer science.

Christian Vogel Oct 26

@ge0rg @whitequark yeah, I think one alternative had been “single wire CAN” over the control pilot pin, as used by Tesla Superchargers back then. 83kbps, bidirectional, the basics known by everyone in the industry, a pragmatic and completely sane solution for the problem of charging cars, with much future expandability to spare. Pretty much on point.

But then we came into the “design by committee” phase of EV charging, and now we have this fucking thing.

@vogelchr
But you can't do TLS PKI over 83kbit/s CAN!!111
@whitequark

✧✦Catherine✦✧Oct 26

@ge0rg @vogelchr you can't?

@whitequark
This is not a question of technical feasibility.
@vogelchr

✧✦Catherine✦✧Oct 26

@ge0rg @vogelchr let me rephrase: I'm curious what the argument presented against it was

@vogelchr @ge0rg @whitequark Yeah, that's the part about EV charging that I never understood: What decisions resulted int using a standard derived from residential power line communications being used for vehicle-to-charger communications since
- It's not even powerline with the physical layer impairments that come with it
- They could have used CAN or single-pair ethernet

Was someone on that committee really destined to find new markets for their existing powerline communications protocol?

It's interesting how the DC charge protocols for cars and phones both have their roots in powerline communications, but shed the powerline part by the time they got widely implemented. Leaving us with PHYs that seem inappropriate for their current use.

@vogelchr @ge0rg @whitequark

F4GRX SÃ©bastien Oct 23

@ge0rg @whitequark What the fuck

Daniel Silverstone Oct 24

@ge0rg @whitequark ISO15118 is one of the banes of my life. It's so frustrating that we still let XML related crap into our standards, and that as you say megawatts of power are under the control of all this.

*sobs in incomplete copies of a specification he can't afford*

@kinnison
Having to pay for standards is the parasitic incest brother of commercial academic publishing. I hope that Open Access and https://www.kothes.com/en/blog/eu-standards are going to kill them, but I'm not taking bets on how many years it'll take.
@whitequark

EU standards must be accessible free of charge

Groundbreaking decision for product standards in Europe: EU standards must be accessible free of charge.

kothes