The adoption rate of EVs has witnessed a significant increase in recent years
driven by multiple factors, chief among which is the increased flexibility and
ease of access to charging infrastructure. To improve user experience, increase
system flexibility and commercialize the charging process, mobile applications
have been incorporated into the EV charging ecosystem. EV charging mobile
applications allow consumers to remotely trigger actions on charging stations
and use functionalities such as start/stop charging sessions, pay for usage,
and locate charging stations, to name a few. In this paper, we study the
security posture of the EV charging ecosystem against remote attacks, which
exploit the insecurity of the EV charging mobile applications as an attack
surface. We leverage a combination of static and dynamic analysis techniques to
analyze the security of widely used EV charging mobile applications. Our
analysis of 31 widely used mobile applications and their interactions with
various components such as the cloud management systems indicate the lack of
user/vehicle verification and improper authorization for critical functions,
which lead to remote (dis)charging session hijacking and Denial of Service
(DoS) attacks against the EV charging station. Indeed, we discuss specific
remote attack scenarios and their impact on the EV users. More importantly, our
analysis results demonstrate the feasibility of leveraging existing
vulnerabilities across various EV charging mobile applications to perform
wide-scale coordinated remote charging/discharging attacks against the
connected critical infrastructure (e.g., power grid), with significant
undesired economical and operational implications. Finally, we propose counter
measures to secure the infrastructure and impede adversaries from performing
reconnaissance and launching remote attacks using compromised accounts