EV Charging Station Vulnerability

Anyone else read this article about the bug in a Schneider product?

At its worst, an attacker can force a plugged-in vehicle to stop charging

At its best, an attacker can give away power for free.

That’s basically it. A hardcoded password meant the power could be disabled, although really that means it could be enabled again too. Breaking news: a switch installed in public places could be switched without special switching authorization.

It’s kind of like those air pumps at gas stations that say you need to insert $0.25 when really you just have to push the button, or at least yell at the person in the station booth “hey I need some air here, enable the button so I can push it” and you get air for free.

Breaking news: I got some air for my tires without inserting a quarter. Someone call TechCrunch journalists.

Seriously though, it would be news if someone actually had to pay for a plugged-in tire to start filling.

If a gas station owner insists that you have to pay for air even after you’ve used the pump, stand your ground. If that doesn’t work, here’s the form to report the station to state officials.

That’s right, and speaking of denial of service…an attacker could even run off with a gasoline pump hose (they have safety release mechanisms) or an air hose. Such a brazen attack would leave cars that have tires and gas tanks without services when they pull into a station.

Fuel host disconnects do happen fairly often, by the way. So often there are even videos and lots of news stories about why and where it happens (protip: bad weather is correlated):

And yet TechCrunch wants us to be scared of EV cables being disconnected:

…unlock the cable during the charging by manipulating the socket locking hatch, meaning attackers could walk away with the cable.

Safety first, amiright? Design a breakaway and attackers can walk away with the cable…for safety.

Such a “vulnerability story” as this EV one by TechCrunch makes me imagine a world where the ranking of stories has a CVSS score attached…a world where “news” like this can theoretically never rise above stories with a severity actually worth thinking about.

An attacker could disable or enable a charging point, where charging status is something easily monitored and on a near-continuous basis. Did your car just stop charging? It’s something you and the provider ought to know in the regular course of using a power plug.

This ranks about as low as you can go in terms of security story value…yet a journalist dedicated a whole page to discuss how a public power-plug can be turned on and off without strong authentication.

Dust-sized battery-free AI sensor with RF-free wireless

The title of this post is the announcement I just received in a CES invite to assess product security. Well, technically it was a “VIP lounge” invite more than a “please break our product” invite, but I treat them the same if you know what I mean.

Perhaps most infamously when I went to CES many years ago and met with 3Com to review their brand new wifi access points (first to market), I immediately pointed out that hard-wired WEP keys was a VBI (very bad idea). 3Com product managers were unapologetic, citing usability as their ace card. “Nobody will use wifi if we make key management hard” they said like a blackjack player scooping all the chips into their lap. We both were right, but they no longer exist (acquired 2010 by HP and never heard from again).

I suppose today what stands out to me most about this new announcement is the “dust-sized” marketing.

Some may remember I have presented in by “big data security” talks specifically on the paranoia that should accompany any developments in dust level of tracking devices, as well as the ironic fact that if you walk in an obfuscating level of dust (more probably sand) it leaves obvious tracks.

Cretaceous period (127m year old) dust printsCretaceous period (127m year old) dust print

I’m looking forward to breaking this new product to point out the VBIs, and maybe even coming up with something like “sweep deprivation” models.

IBM Watson Sued by LA County for Secretly Tracking Users

Let’s get one thing out of the way. IBM’s Watson was instrumental to the Nazi Holocaust as he and his direct assistants worked with Adolf Hitler to help ensure genocide ran on IBM equipment.

When IBM’s director of worldwide media relations, John Bukovinsky, was asked about the disclosures in 2001 and 2002 of the company’s involvement in facilitating the extermination of millions of Jews, Gypsies and others, he replied, “That was six years ago [sic].” When a reporter pointed out that the Holocaust itself was some 60 years ago, Bukovinsky quipped, “So what. What is the point?”

The idea that IBM would want to market their big data system after the man notorious for meeting with Nazi leaders to deliver counting machines for genocide…it’s a pretty big sign that the evils of Watson are something to keep an eye out for even in the present day.

As Edwin Black wrote in “IBM and the Holocaust: The Strategic Alliance between Nazi Germany and America’s Most Powerful Corporation“:

Thomas Watson was more than just a businessman selling boxes to the Third Reich. For his Promethean gift of punch card technology that enabled the Reich to achieve undreamed of efficiencies both in its rearmament program and its war against the Jews, for his refusal to join the chorus of strident anti-Nazi boycotters and isolators and instead open a commercial corridor the Reich could still navigate, for his willingness to bring the world’s commercial summit to Berlin, for his value as a Roosevelt crony, for his glitter and legend, Hitler would bestow upon Thomas Watson a medal — the highest it could confer on any non-German.

Fast-forward to today and IBM’s Watson has been charged with user location tracking using an innocent-sounding weather app.

In a complaint filed Thursday in California state court, the city alleges IBM used detailed location data from users for targeted advertising and to identify consumer trends that might be useful to hedge funds, while at the same time telling consumers their location would only be used to localize weather forecasts. The suit doesn’t allege personally identifiable information was sold.

“Unbeknownst to many users, the Weather Channel App has tracked users’ detailed geolocation data for years,” the complaint alleges, calling the Weather Channel’s actions “unfair and fraudulent.” The complaint also says the Weather Channel profited from the data, “using it and monetizing it for purposes entirely unrelated to weather or the Weather Channel App.”

Again, it’s hard to fathom that IBM would want to name a big data machine Watson. It’s even harder to fathom that someone in IBM thought lying about user location tracking to monetize ill-gotten data was a good move…but then I just go back to them naming their machine Watson.

Arizona Rush to Adopt Driverless Cars Devolves Into Pedestrian War

Look, I’m not saying I have predicted this exact combat scenario for several years as described in my presentations (and sadly it also was my Kiwicon talk proposal for this year), I’m just openly wondering at this point why Arizona’s rabidly pro-gun legislators didn’t argue driverless cars are protected by Waymo’s 2nd Amendment right to bear arms, classifying vehicles as consumer-grade munitions that also carry people or goods inside. AZ Central reports:

People have thrown rocks at Waymos. The tire on one was slashed while it was stopped in traffic. The vehicles have been yelled at, chased and one Jeep was responsible for forcing the vans off roads six times.

Many of the people harassing the van drivers appear to hold a grudge against the company, a division of Mountain View, California-based Alphabet Inc., which has tested self-driving technology in the Chandler area since 2016.

The one or two people operating the tens of thousands of weapons (driverless cars) on public roads are counting on their surveillance capabilities as much as their armored weapons to keep the upper hand in this fight. AZ Central continues:

The self-driving vans use radar, lidar and cameras to navigate, so they capture footage of all interactions that usually is clear enough to identify people and read license plates.

According to police reports, Waymo test drivers rarely pursue charges and arrests are rare. Haselton was charged with aggravated assault and disorderly conduct, and police confiscated his .22-caliber Harrington and Richardson Sportsman revolver.

“Haselton said that his wife usually keeps the gun locked up in fear that he might shoot somebody,” Jacobs wrote in the report. “Haselton stated that he despises and hates those cars (Waymo) and said how Uber had killed someone.”

Let’s be clear here. The grudge being referenced is related to people in a neighborhood being upset about the rollout of armored weaponry.

Tense scene unfolds in Arizona 2018 as locals resist the Waymo rolling displays of unregulated power

Think of the irony that Arizona residents have a grudge against driverless cars because they are in effect weapons being wielded unsafely in a public space, killing people (this is the infamous state that won’t even hear an argument about regulating guns).

Waymo is like someone taking their gun off the gun range and not being able to keep their pistol holstered, let alone rounds unchambered, wandering around waving it in everyone’s face. You think the neighborhood is just going to look the other way while that barrel points at their family and friends?

Compare that grudge with some poignant analysis just a year ago that was titled “Arizona is a heaven for test new cars – USA TODAY” (which at some point changed its title to “Why automakers flock to Arizona to test driverless cars”. TL;DR:

  • relatively light regulatory environment of the past two and a half years
  • weather allows for year-round testing of vehicles, and low rainfall means minimal disruptions…low winds and a temperature range that is conducive to completing regulatory tests almost every day of the year
  • desert offers car manufacturers a remote and private testing location that’s away from the prying eyes

Allow me to translate this analysis into technology ethics: lawless and opaque makes for easy hurdles, and low standards means quick money for investors. The desert has no actual environmental risk. Testing in a vacuum chamber means your product is ready for use in a vacuum, not public streets. And testing with zero outside observability/validation of claims means you aren’t anywhere close to ready for deployment.

Desert vehicle development is about as sane as developing moon vehicles and saying it’s the wrong type of planet when they can’t move with earth’s gravity.

To put it another way, the Governor of Arizona scoffed at other states where leaders held human life up as a value worth protecting and preserving. The money hungry Arizona official literally said he is happy to promote profit over safety.

In August 2015, Ducey signed an executive order allowing the testing of autonomous cars on public roads, hoping the cars will fuel “economic growth, bring new jobs, provide research opportunities for the state’s academic institutions and their students and faculty, and allow the state to host the emergence of new technologies.”

It looks like Ducey didn’t think very hard about how selling out human life for a boom in weapons sales might backfire. Nothing in that list of benefits says there is an ounce of care for public safety or health, amiright?

Mo’ money, mo’ problems.

August 2015: regulations are dropped, standards are non-existent. Anyone wanting to develop weapons for public roads is invited to Arizona

December 2017: newspapers describe Arizona as “Heaven” for developing weapons to wave around in public without need of any safety training or controls

Wait for it…

March 2018: “The governor of Arizona has suspended Uber’s ability to test self-driving cars on public roads in the state following a fatal crash last week that killed a 49-year-old pedestrian”

Uber using an automatic weapon to kill one person and getting regulated in Arizona compares oddly to the 68% of all homicides in the state committed with a gun and the nearly 1,000 people killed a year in Arizona by guns that get zero regulation discussion (see above).

Oh, but who could have predicted that removing regulations and allowing weapon development to launch straight to the streets would invite bad corporate behavior? Not only me, giving public presentations about this problem, also internal engineers who documented how “there were a lot of warning signs” yet Arizona’s “Heaven” meant they were neither attended to internally to pass regulations nor exposed to regulators:

“A car was damaged nearly every other day in February,” Miller said. “We shouldn’t be hitting things every 15,000 miles.”

Miller pointed to an incident in November 2017, when an Uber car had a “dangerous behavior” that nearly caused a crash. The driver notified his superiors about the problem, Miller wrote, but the report was ignored. A few days later Miller noticed the report and urged the team to investigate it.

But Miller says his request was ignored—and when he pressed the issue with “several people” responsible for overseeing the program, they “told me incidents like that happen all of the time.” Ultimately, Miller said it was two weeks before “anyone qualified to analyze the logs reviewed them.”

So there you have it. 2015 effort to reduce safety control levels so weapons can flood the market. 2017 weapons entering market are causing harm and at frequent intervals, indicating escalation to wider and more severe conflict.

Doesn’t it seem obvious that this ended with a meek 2018 effort to put the weapon genie back in the bottle…yet any historian can tell you once battle lines have been drawn and people are angry about their clan being attacked, they are going to harbor some hostility.

So with all that in mind the big question now becomes as the weapons manufacturers switch to their all-encompassing surveillance systems to undermine the nascent groups of resistance, whether they also will claim their manufacture and sale of automatic high-power weapons is protected behavior anyway under the 2nd Amendment.

We have seen some of that messaging already, as Uber and Tesla used to be fond of saying their particular brand of automatic weapons will reduce deaths on the streets, much in the same way that totalitarian governments would argue how top-down centrally controlled armored divisions are the way to keep the public safe from itself.

And in that sense, are Arizonans actually crazy if they read the Uber story of deaths for profit and then think of themselves as preventing harm to their fellow citizens by stepping out into the street early to disable the Waymo munitions rolling into and over neighborhoods?