DCeption: Real-world Wireless Man-in-the-Middle Attacks Against CCS EV Charging

TL;DR

This work addresses the critical risk of wireless access to the CCS charging protocol used by most EVs. It presents a real-time SDR implementation of HomePlug Green PHY, enabling end-to-end MitM on actual devices, and analyzes 2,750 charging sessions to quantify timing constraints for hijacking. The authors demonstrate TLS downgrades, protocol-version manipulation, and power-delivery tampering, including overcharge and reporting-discrepancy attacks, across multiple charger and vehicle brands. They also propose a downgrade-resistant countermeasure leveraging a parallel signaling channel to securely disseminate NMK, aiming for backward compatibility. The findings expose practical vulnerabilities in CCS and underscore the need for hardware- and standard-level mitigations to protect safety-critical power delivery and payments in EV charging infrastructures.

Abstract

The adoption of Electric Vehicles (EVs) is happening at a rapid pace. To ensure fast and safe charging, complex communication is required between the vehicle and the charging station. In the globally used Combined Charging System (CCS), this communication is carried over the HomePlug Green PHY (HPGP) physical layer. However, HPGP is known to suffer from wireless leakage, which may expose this data link to nearby attackers. In this paper, we examine active wireless attacks against CCS, and study the impact they can have. We present the first real-time Software-Defined Radio (SDR) implementation of HPGP, granting unprecedented access to the communications within the charging cables. We analyze the characteristics of 2,750 real-world charging sessions to understand the timing constraints for hijacking. Using novel techniques to increase the attacks' reliability, we design a robust wireless Man-in-the-Middle evaluation framework for CCS. We demonstrate full control over TLS usage and CCS protocol version negotiation, including TLS stripping attacks. We investigate how real devices respond to safety-critical MitM attacks, which modify power delivery information, and found target vehicles to be highly permissive. First, we caused a vehicle to display charging power exceeding 900 kW on the dashboard, while receiving only 40 kW. Second, we remotely overcharged a vehicle, at twice the requested current for 17 seconds before the vehicle triggered the emergency shutdown. Finally, we propose a backwards-compatible, downgrade-proof protocol extension to mitigate the underlying vulnerabilities.

Figures (13)

• Figure 1: Simplified view of the CCS protocol, highlighting important values that an attacker may extract or control.
• Figure 2: Security negotiation in the SDP process. (a) Two secure devices connecting. (b) A vehicle requesting an unencrypted session. (c) A charger causing a downgrade. (d) An MitM attacker exploiting legitimate behavior to downgrade the connection between two TLS capable devices. To both parties, the observed behavior is identical to the benign cases in (b) and (c).
• Figure 3: SDP hijacking by racing the responses. The attacker can augment their chances by sending various attacks to the charger before the legitimate SDP response is sent.
• Figure 4: Speed of SDP responses in real charging sessions, extracted from the dataset in szakaly2025current. The results show that First exchanges are consistently slower.
• Figure 5: The SDP pre-hijacking attack, applicable against chargers which ignore SDP requests after the connection has been established.