Mastodawn

hey wanna read some horrors? https://www.w3.org/TR/exi/

Efficient XML Interchange (EXI) Format 1.0 (Second Edition)

@whitequark
The real horror is that #EXI is used in an ISO 15118 sandwich on top of HomePlug AV (with broken encryption) and TCP (mostly with no encryption, but sometimes mixed with a wild PKI) to real-time control up to a Megawatt of electric power flowing into a car.

@ge0rg aaahhhh

@whitequark
And to add to the horror, all of the cars and chargers are in the same physical powerline broadcast domain, so when another car is plugged in, it needs to broadcast ping and measure the response signal strength(*) to find out which charger it's connected to...

And once the data channel is up, you authorize the payment with the absolutely unforgeable and secret... *checks notes* serial number of your RFID card!

(*) SLAC (Signal Level Attenuation Characterization)

Show thread

AliveDevil Oct 23

@ge0rg @whitequark
Just to confirm my slightest hope here:
When my car isn’t premium enough to have ISO 15118 charging … I‘m better off? Or is the communication between charging station and eg provider app equally cursed?

Show thread

Zimmie Oct 23

@AliveDevil @ge0rg @whitequark So basically all of the EV charging plugs allow encapsulation of arbitrary IEEE 802.* protocols.

I’m shocked we haven’t seen a ransomware incident spread from a public charger to cars yet.

Show thread

Ge0rG

@bob_zim
Luckily, the current generation of car-side controllers are minimal, well-shielded, commercial embedded TCP stacks, limited to the task at hand. They are not supposed to fully bridge into car side networks, only interfacing to CAN. However, it's going to be interesting when/if the manufacturers implement ISO 15118-20 certificate provisioning though the charger, and I'm eager to see malformed certificates breaking the infotainment like https://arstechnica.com/cars/2022/02/radio-station-snafu-in-seattle-bricks-some-mazda-infotainment-systems/
@AliveDevil @whitequark

Radio station snafu in Seattle bricks some Mazda infotainment systems

The problem was a broadcast containing image files with no extensions.

Ars Technica