Attacking the EV charging stack

My MSc dissertation at the University of Manchester, From Plug to Backend: Investigating the Attack Surface of the EV Charging Stack.

Before a car and a charger exchange a single byte of charging logic, they have to find each other on the power line. SLAC (Signal Level Attenuation Characterization) is the protocol that handles this pairing, and every implementation of it is a parser exposed to whatever is on the other end of the cable.

What I built

• An automated penetration-testing framework, written in Python, that drives SLAC implementations through malformed and out-of-order messages.
• Detection for buffer and stack overflows/underflows and illegal state transitions in the protocol state machine.
• Bulk reporting, so many targets and runs can be compared side by side.
• A test bench of open-source SLAC implementations written in C, C++, Python and Java.