Physical-Layer Exploits on EV Chargers: Authentication and Systemic Protocol Weaknesses

The proliferation of electric vehicles in recent years has significantly expanded the charging infrastructure while introducing new security risks to both vehicles and chargers. In this paper, we investigate the security of major charging protocols, including SAE J1772, CCS, IEC 61851, GB/T 20234, and NACS, and uncover new physical signal spoofing attacks in their authentication mechanisms. By inserting a compact malicious device into the charger connector, attackers can inject fraudulent signals to disrupt the charging process, resulting in denial-of-service, vehicle-induced charger lockout, and damage to the chargers or the vehicle’s charge management system. To demonstrate the feasibility of our attacks, we propose PORTulator, a proof-of-concept (PoC) attack hardware, including a charger gun plugin device for injecting physical signals and a wireless controller for remote manipulation. By evaluating PORTulator on multiple real-world chargers, we identify 7 charging standards used by 20 charger piles that are vulnerable to our attacks. These attack primitives are not merely protocol flaws, but practical cyber-physical threats that can be leveraged for service disruption, extortion, and targeted sabotage in public or fleet-dependent charging environments. The root cause is that chargers use simple physical signals for authentication and control, making them easily spoofed by attackers. To address this issue, we propose enhancing authentication circuits by integrating non-resistive memory components and utilizing dynamic high-frequency Pulse Width Modulation (PWM) signals to counter such physical signal spoofing attacks.