Kuan Yu Chen, National Taiwan University of Science and Technology; Md Hasan Shahriar, Virginia Tech; Wen Wei Li and Shi Cho Cha, National Taiwan University of Science and Technology; Wenjing Lou, Virginia Tech
Electric vehicle (EV) charging infrastructures continue to depend heavily on the legacy DIN 70121 protocol, which lacks cryptographic authentication and exposes critical control messages in plaintext. Although prior studies have noted conceptual weaknesses, the feasibility and impact of practical, end-to-end attacks against real charging ecosystems remain insufficiently understood. We present HotWire, a systematic security analysis of DIN 70121 and the first demonstration of two practical, production-grade exploits: (i) unauthorized Autocharge activation via identifier impersonation, and (ii) unauthorized energy extraction through protocol-driven battery-state manipulation. In the first attack, an adversary replays a captured EV identifier (EVCCID) to initiate fraudulent Autocharge sessions on commercial networks using a low-cost hardware toolkit. Our experiments show that attackers can repeatedly obtain full charging sessions commonly valued at 35–45 without triggering existing fraud-detection mechanisms. In the second attack, we exploit insecure battery management system (BMS) state transitions by injecting protocol-compliant voltage claims, inducing controlled forced discharge, and enabling persistent energy loss. Furthermore, we validate these attacks across production vehicles and multiple public charging networks using a physical hardware-in-the-loop testbed, revealing widespread trust in protocol state over physical verification. We release open-source auditing tools and describe responsible disclosure outcomes, which have already prompted firmware updates and additional authentication safeguards by several vendors.
