{'fraction_non_alphanumeric': 0.0233592478756102, 'fraction_numerical': 0.0069667932260591816, 'mean_word_length': 5.155204392017212, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Investigating the Security of EV Charging Mobile Applications As an Attack Surface

The adoption rate of EVs has witnessed a significant increase in recent years driven by multiple factors, chief among which is the increased flexibility and ease of access to charging infrastructure. To improve user experience, increase system flexibility and commercialize the charging process, mobile applications have been incorporated into the EV charging ecosystem. EV charging mobile applications allow consumers to remotely trigger actions on charging stations and use functionalities such as start/stop charging sessions, pay for usage, and locate charging stations, to name a few. In this paper, we study the security posture of the EV charging ecosystem against remote attacks, which exploit the insecurity of the EV charging mobile applications as an attack surface. We leverage a combination of static and dynamic analysis techniques to analyze the security of widely used EV charging mobile applications. Our analysis of 31 widely used mobile applications and their interactions with various components such as the cloud management systems indicate the lack of user/vehicle verification and improper authorization for critical functions, which lead to remote (dis)charging session hijacking and Denial of Service (DoS) attacks against the EV charging station. Indeed, we discuss specific remote attack scenarios and their impact on the EV users. More importantly, our analysis results demonstrate the feasibility of leveraging existing vulnerabilities across various EV charging mobile applications to perform wide-scale coordinated remote charging/discharging attacks against the connected critical infrastructure (e.g., power grid), with significant undesired economical and operational implications. Finally, we propose counter measures to secure the infrastructure and impede adversaries from performing reconnaissance and launching remote attacks using compromised accounts.


INTRODUCTION
As the climate change and increased greenhouse gas emissions drive the embrace of the green technology mindset, countries are shifting from a traditional transportation system to a smarter one by utilizing Electric Vehicles (EVs). Many countries have already implemented policies to reach carbon neutrality by adopting EVs with an aim to reach 30% market share by 2030. For instance, China's plan to reach carbon neutrality resulted in a significant 141% increase in the deliveries of EVs in October 2021 [1]. Similarly, multiple federal/provincial governments in North America along with various European countries have set policies to increase the EV adoption in the next decade while banning the sales of new gasoline-powered passenger cars in the near future [2,3].
Consequently, there is a rapid deployment of EV Charging Stations (EVCSs) to match the EV adoption. Furthermore, governments from all around the world are actively investing sums of money to address the lack of charging and refueling stations with respect to the increasing demand by the shift towards electric vehicles [4].
The automotive leading companies are investing in incorporating advanced technological features in electric vehicles and the Cyber-Physical System (CPS) associated with them, to allow remote management . The cloud management system (CMS) handles all operations of the public EVCS (e.g., device registration, equipment control, operations management, data logging, etc.). As a result of the need to commercialize the EV charging ecosystem and to drive the adoption of EV technologies, the EV charging mobile application established itself as a core component of the EV ecosystem [5]. Mobile applications are used by EV consumers to remotely control EVCS and manage charging operations (e.g., start and stop charging sessions). They also provide various online functionalities such as checking availability, and handling payments, to name a few. The importance of studying this component in a fine-grained manner lies within its ability to control the EVCSs and its wide distribution among customers. The existence of multiple vendors, along with minimal efforts to standardize the development and deployment of EVCS components has led to the exposure of the ecosystem and the interconnected critical infrastructure (e.g., power grid) to a wide range of remote attacks [6,7]. Moreover, the massive adoption of EVs caused a compelling change in the transportation system and the power grid utilities, not only increasing the load on it, but also increasing the complexity of the ecosystem as a whole [8]. This adoption led to the rapid deployment of Internet-enabled charging stations along with various supporting EV charging mobile applications. Moreover, the number of product and cross-product applications is increasing tremendously where one mobile application might have access to more than one EVCS network (e.g., flo, Blink, and EVgo), thus, amplifying the impact by exposing more products and users simultaneously. It is worth highlighting that such extended remote functionalities might provide adversaries with a new attack surface, which could be utilized to compromise vulnerable mobile application and thus, exploiting the underlying EVCS and its operations.
A number of studies focused on the security of the EV ecosystem by exploring the security of the firmware, the installed management systems, and the communication link [7,[9][10][11][12]. For instance, Nasr et al. [7] studied the security of the EVCS firmware and management systems and discovered 13 severe vulnerabilities. Furthermore, Antoun et al. [12] presented a detailed security analysis of the ecosystem while assuming a highly privileged attacker that can fake, intercept, inject, and modify messages. Whereas Alcaraz et al. [9] studied the security posture of the OCPP protocol, which is the main protocol used to control charging stations and discovered its susceptibility to Man-In-the-Middle attacks. Despite such effort to explore the security of various components within the EV charging ecosystem, there is a lack of knowledge about the security posture of the existing EV charging ecosystem against remote attacks, especially, when utilizing the EV charging mobile applications as an entry point. Moreover, there is a lack of understanding about the extended attacker capabilities and attack implications when leveraging vulnerabilities across widely used mobile applications to perform large-scale coordinated attacks against various stakeholders and components within the EV charging ecosystem.
In this study we focus on investigating the security posture of the EV charging mobile applications as an attack surface on the EV charging ecosystem and the underlying infrastructure. We use a multi-layered approach to systematically analyze most widely used EV charging mobile applications that are utilized to manage charging stations across various geographical locations. We utilize reverse engineering and code analysis techniques to get insight into the functionalities instilled on the EV charging mobile applications, along with the security measure implemented by these application (e.g., bot detection libraries). Consequently, guided by the static analysis, we perform dynamic functionality analysis to test the interactions of these applications with other components while identifying their main implemented EV charging-related functionalities that can be triggered remotely (e.g., remote start and stop). Furthermore, we analyze the traffic exchanged between the EV charging mobile application and the supporting cloud services to understand the interactions and exchanged information by breaking SSL using Man-In-The-Middle (MITM) monitoring to unravel encrypted interactions. Along with that, we also utilize our understanding of related work to complement our analysis of the EVCS-Cloud communication [7,9,13,14].
Our analysis of the exchanged traffic/interactions inferred state transitions between the mobile application and other entities in the EV charging ecosystem. We found that the analyzed mobile applications lack adequate EV ownership verification. Moreover, most applications implement improper authorization for initiating critical functions (e.g., start charging), which only binds users with charging stations without binding/authenticating users to the EVs. This is closely related to the lack of adequate EV ownership, which allows insecure initiation of a critical function such as EV charging/discharging. Indeed, we found that the lack of proper ownership checking and granular access control mechanisms can enable triggering unauthorized charging actions, even when vehicles are not connected to the charging station. This in fact provides adversaries with the capability to initiate unauthorized actions, which impact the availability of EV charging resources and lead to possible Distributed Denial of Service (DDoS) attacks against EV charging mobile application users. While such vulnerabilities demonstrate the insecurity of the EV charging ecosystem, it also highlights the immaturity of the deployed software components, which hinders the advancement to reach the goals set by the industry.
Furthermore, 29 of the 31 studied mobile platforms are susceptible to remote charging session hijacking, while enabling mass (dis)charging attacks. Additionally, our analysis illustrates that 16 of the vulnerable EV charging mobile application platforms can be exploited to perform large-scale oscillatory load attacks on the connected infrastructure through the unauthorized remote start/stop charging capabilities. Consequently, we study the feasibility of synchronized remote charging attacks and their impact on EV user and the underlying infrastructure by studying transmission losses, generation costs, along with overloading and transmission line tripping and power grid stability. Finally, we provide recommendations to prevent remote attacks utilizing the EV charging mobile application.
To this end, we frame the main contributions of this work as follows: • To the best of our knowledge, we are among the first to study the security posture of the EV charging mobile applications as an attack surface against the various stakeholders (e.g., user and power grid) by studying its interaction with different components. Our findings demonstrate the insecurity of such mobile applications, while highlighting design and implementation weaknesses that can be exploited to exploit the EV charging mobile applications and perform unauthorized operations on the underlying EVCSs. • We leverage static and dynamic analysis techniques to analyze the implementation of the EV charging mobile applications and their interactions with various components within the ecosystem. We utilize Finite State Machines to provide an abstract representation and model the interactions of the mobile applications with the cloud management system and the EVCS counterparts. Our analysis indicates several vulnerable interactions due to unverified user/vehicle ownership, improper authorization for critical functions, and lack of granular access control. • Given the feasibility of the identified vulnerabilities across widely used EV charging mobile applications, we investigate the implications of wide-scale remote attack scenarios by constructing synchronized botnet attacks that utilize the mobile applications as a recon to perform various unauthorized charging operations including large-scale voltage/frequency instability attacks on the power grid. We discuss practical attack implications against the stakeholders, precisely, the users, and the connected critical power grid infrastructure. Finally, we propose design/implementation countermeasures to mitigate such attacks in the future.
The remainder of this paper is organized as follows. In Section 2, we present background information and basic concepts related to the EV ecosystem. In Section 3, we discuss the analysis methodology. In Section 4, we detail our findings in terms of identified interactions and vulnerabilities, along with attack feasibility. We discuss detailed attack implications against various stakeholders in Section 5. In Section 6, we discuss a mitigation framework along with security measures that will help defend against such exploitation. A summary of related work is presented in Section 7 before concluding the paper in Section 8.

BACKGROUND AND THREAT MODEL
The electric vehicle charging ecosystem represents a cyber-physical system, which is composed of interacting hardware and software components, as shown in Figure 1. In what follows, we provide details about the different components and their interactions.

Overview of the Main Components within the EV Charging Ecosystem and their
Interactions.
The EV charging ecosystem was established to match the demand of electric vehicles and their need to charge. Two types of EVs are dependent on the EV charging ecosystem, which are the main foci when studying the security of the EV charging ecosystem: Plug-in Hybrid Electric Vehicles (PHEVs) and Battery Electric Vehicles [11,15]. Other types of EVs such as Hybrid Electric Vehicles and Fuel Cell Electric Vehicles do not require external charging [16]. Consequently, EVs connect to the charging stations using various standards (SAE J-1772/J-2293/J-2847/J-2836, IEC62196/61851, ISO/IEC 15118, and chAdeMO) [6,7,11] which are a part of the efforts to standardize communication in the EV charging ecosystem. There are several AC and DC chargers for EVs of different levels. Level 1 chargers (slow chargers) are being replaced by Level 2 chargers, which are mostly used commercially as public charging stations. Moreover, a new Level 3 chargers (providing a higher charging rate) are being introduced to improve the user experience and decrease charging times [6]. In this study, we focus on public charging stations deployed by companies, governmental entities (e.g., Circuit Electric and ChargePoint), or private charging stations that are made publicly available by the owner to earn extra income. It is worth highlighting that the EVCSs are also connected to the power grid (critical infrastructure) to draw the needed power for vehicles to charge.
A software component (e.g., management system and mobile application) is coupled with the hardware counterpart, to allow remote monitoring and management of the EVCSs. A mobile application, which is used by the EV owner and is publicly available and distributed through application stores (Google Play and Play Store), allows the user to control charging stations remotely and view charging stations' statuses by sending requests to the cloud management system (CMS). The CMS plays an equally important role in the commercialization of the ecosystem since it provides API endpoints for the mobile application to communicate with the EVCS. The CMS communicates with charging stations using Open Charge Point Protocol (OCPP) [13] and allows the CMS to control the charging rate, update firmware, reset of the charging station, etc.

Overview of EV Charging Mobile Application Platforms
To manage the ever-increasing number of EVCS from different vendors, many companies have put in place a mobile application management platform for EV owners to monitor and control charging stations. The mobile application is an indispensable component for the commercialization of the EV charging ecosystem. Consequently, we give an overview of the mobile application which encompasses its role and the communication protocols used when communicating with the different entities (CMS and EVCS). Mobile applications communicate with the CMS using Hypertext Transfer Protocol Secure (HTTPS), which incorporates the Secure Socket Layer (SSL)/Transport Layer Security (TLS), to secure and encrypt the HTTP communication and to preserve the privacy of users by protecting against on-path attacks. Various functionalities are instilled in the mobile application that provides users with an interface to remotely monitor and control charging stations as illustrated in Figure 1. To name a few, a discovery service is provided by the mobile applications to allow users to find nearby charging station. Furthermore, charging control service is instilled to allow remote start and stop of charging sessions and set a duration of charging. Various vendors provide mobile applications that allow remote monitoring/charging. To name a few, ChargePoint, a leading operator, has over 500, 000 users. Similarly, ChargeHub, is a popular mobile application that provides users with services to remotely control charging stations. Indeed, the number of downloads of EV charging application, which can be extracted from Google Play, show the growth of the EV ecosystem, and the wide distribution of the mobile application among consumers. This sheds the light on the popularity and wide distribution of these application that are used by many users. Moreover, the charging stations and their management system in most cases belong to one or more different networks, thus allowing the cross-application control. For example ChargePoint mobile application controls Blink, SemaCharge, and of course its own network. This highlights the importance developing secure mobile applications due to its cross-operator collaboration which adds more heterogeneity to the ecosystem especially with the lack of standardization.

Threat Model
We consider a remote adversary with access to one or more mobile applications distributed on the Google Play Store and Apple store. Moreover, we consider the remote adversary is able to create an account on these mobile applications. Similar to [17], we do not assume any forms of software bugs or protocol vulnerabilities. The adversary relies on understanding the interactions between the components by utilizing various analysis methods to identify vulnerabilities and understand the interactions between the mobile application and the CMS. The analysis methods range from reverse engineering and white-box testing to functionality analysis, system fuzzing, and black-box analysis. The attacker aims to utilize the mobile applications as an entry point to target EVCSs with connected vehicles. The adversary's goal is to exploit design flaws in the interactions among the different entities (e.g., EVCS, CMS, Mobile application) to hijack or initiate an unauthorized charging session remotely without compromising legitimate user accounts. Moreover, the adversary's ultimate goal is  to leverage illegal charging sessions to perform large-scale, coordinated botnet attacks against the underlying critical infrastructure (e.g., the power grid) and the EV users.

METHODOLOGY
In this section, we elaborate on the analysis methodology to identify vulnerabilities that allow adversarial accounts to control charging sessions for vehicles they do not own. As shown in Figure 2, we combine static (reverse engineering and code review) and dynamic analysis techniques (functionality and traffic) to perform vulnerability analysis and assessment to the identified mobile applications. First, we start by fetching EV charging mobile applications, then for each product, we extract data for analysis by applying reverse engineering techniques on their binaries. Second, we extract network traffic during the functionality analysis while emulating user behavior of the application; consequently, we analyze the application states and behavioral changes to abstract the system interactions then evaluate it to find flaws. We provide details on the proposed methodology components below.

Mobile Application Look Up
In this section, we detail our selection strategy for mobile applications. According to Statista [18], Android maintained its position as the leading mobile operating system for mobile phones with about 73% market share. We look for EV charging mobile applications on the Google Play store, which is the main platform used by Android users to download applications. Furthermore, we automatically fetch 50 mobile applications from Google play store. Then, we choose the mobile applications and filter them based on the features they possess by automatically searching the description for keywords such as start/stop charging. After further analysis, we discarded 8 mobile applications that are either EV charging calculators or not related. Our analysis focuses on mobile applications that provide remote control functionalities to control public charging station, consequently, we analyze the applications manually to ensure the existence of these functionalities as they pose a real danger on the power grid when compromised at scale [6].
Based on the prior differentiation between the applications according to the capabilities, we identify and classify the applications to three types, as shown in Table 1. Type 1 are applications that allow users to have an overview of the ecosystem and control the charging session, while Type 2 applications are used to perform reconnaissance activities and can only show an overview of the system. Whereas, Type 3 applications are used to optimize home charging for EV users. Note that if Type 1 applications are compromised, they can be used to perform attacks because of their special capability to control the charging station and its operations (e.g., initiate charging sessions). Moreover, it is worth mentioning that an adversary can use information publicly shared by these applications (Type 1 and 2) to prepare for their attacks by analyzing the availability of charging stations and their usage trends, as discussed in Section 4.4. Finally, we fetch the remaining mobile applications and download/install their APKs. It is crucial to highlight that any security concern discovered in the communication between the mobile application and the CMS applies to both Android applications and iOS since they rely on the same back-end that handles their requests in most cases. Therefore, we assume that our analysis methodology and results can be generalized to both platforms, respectively. However, confirming this will be considered for future work.

Static Analysis
We aim at documenting and understanding the functionality of mobile applications and the utilized libraries. We used static analysis to understand the security measures implemented by EV charging mobile application vendors to thwart automated bot attacks by examining libraries and artifacts found in the binary files, along with understanding the structure of the mobile applications ( Figure 3a) to perform a systematic functionality analysis. Thus, we utilize reverse-engineering of the APK, which is an archive package that contains a manifest file with the package name, activity names, hardware features support, permission, and other configurations. The APK also contains the certificates for the application, a lib directory holding compiled libraries used by the application, and a file with compiled application code in the dex file format, which can be interpreted by the Dalvik Virtual Machine (DVM) and the Android run-time environment. We extract all the files using apktool [19], which disassembles all the resources and extracts the application Manifest and the dex files. Consequently, we use the extracted dex files and convert them to a JAR file using dex2jar [20] utility, we input the file into jd-gui [21] to browse the underlying Java source code. We then analyze the extracted jar files using white-box analysis techniques to check the application resources (e.g., libraries and their functionality, certificate signing techniques used by the application developer, etc.). Further, we extract resources from the reports generated (e.g., the activities used in the mobile application and the flow of activities), which allow us to perform a detailed functionality analysis and identify libraries used in EV charging mobile application applications by using MobSF [22] and LiteRadar [23]. Consequently, we check the functionality of the libraries used (e.g., Google reCAPTCHA, hCAPTCHA, Anti-location Spoofing).

Dynamic Analysis
We rely on dynamic analysis ( Figure 3b) to complement our static analysis method and provide a holistic and comprehensive analysis of all the interactions and functionalities provided by the mobile application. The dynamic analysis constitutes of functionality analysis, recording user input, traffic analysis, and monitoring system state changes.
Functionality Analysis. We perform functionality analysis to collect data and identify system states to understand the communication between different entities. Specifically, we seek to answer the question of "How the adversary can utilize the interaction vulnerabilities and weaknesses to connect to a remote EVCS and control its operations?" Guided by the static analysis that allowed us to understand the structure of each mobile application by mapping the activity flow in each Android application, to systematically cover all the possible scenarios to a systematically perform a detailed functionality analysis [24,25]. We analyze each mobile application by manually mimicking regular users' behavior and operations and triggering every functionality possible in the mobile application. Throughout our analysis of the mobile applications we discover that some functionalities are strictly prohibited based on the location of the device, for example Petro-Canada EV prevents initiating charging requests if the users location is not close to the charging station. However, to mitigate that during our functionality analysis, we spoof the location of the device by broadcasting a location close to the charging station, which was used by the application to determine the eligibility to utilize the charging station. We utilized GPS JoyStick ADB Shell [26] to spoof the location of the device. It is worth mentioning that other applications (e.g., Electric Circuit) notify the user that they are far away from the location of the charging station however, it does not restrict the user from initiating a charging request. Furthermore, some applications (e.g., electromaps) detects that the user is far from the charging station even if the location was spoofed. This is attributed to the IP-Geolocation services used to detect the location of the originating IP, which can be circumvented using a VPN that routes our traffic through a private tunnel that appear to be originated from the same country as the charging station.
Traffic analysis. While emulating user behavior and performing user actions, we capture traffic generated by the mobile application to understand the information that is being sent and the interactions between the mobile application and the CMS similar to [17]. We trigger important functionalities of the application such as sign up/in and start/stop charging. However, most applications use trusted Certificate Authorities (CA) to protect user privacy by encrypting the communication between the mobile application and the CMSs [17]. To decrypt the communication we utilize an un-rooted device with Android 7 operating system . Moreover, since Android OS with version (≥ 7.0) does not trust user installed certificates by design, to run applications on an un-rooted device with user installed certificates we create a virtual space on the mobile phone that allows to run Android apks as plugins by utilizing VirtualXposed [27]. Consequently, we perform API hooking to bypass certificate pinning/verification by utilizing Inspeckage Package Inspector [28]. Moreover, some applications we bypass certificate verification as shown in Figure 4a, by reverse engineering the application using APKTool [19], then inject code into the application as shown in Figure 4b. We then repack and sign the application before installing it. Consequently, we utilize Burpsuite [29], which operates as a proxy server between the mobile application and the target server to intercept, inspect, and modify raw traffic passing in both directions. Our analysis was not intrusive, however, it allowed us to unravel the communication between the mobile application and the CMS to understand it.

RESULTS
We utilize different methods to infer and analyze the interaction of the main components within the EV charging ecosystem during user and device registration and when initiating charging requests. We extract the capabilities instilled in each mobile application. The capabilities recorded for each mobile application include remote start charging and remote stop charging. Moreover, we record the remote control restrictions that are implemented by the mobile application vendors to hinder illegal or abnormal usage of a charging station. The vendors limit the flexibility for the user to initiate charging requests based on: (i) location proximity of the users (i.e., must be near the target charging station to initiate a requests), (ii) IP Geolocation info (i.e., charging requests should originate from the same country/area as the target charging station), and (iii) user entered charging station ID that is found on the target device.
Our preliminary analysis shows that all applications provide their users with a remote start charging service. Moreover, only 13 (e.g., Flo EV Charging, Plugshare, etc.) mobile applications do not provide stop-charging functionality forcing users to remove their cars when they finish charging. It is important to note that only two applications (Petro Canada EV and Electromaps) check the integrity of the users by validating the location of the device, whereas only one application (Electromaps) checks the locations of the originating IP of the charging request. Finally, two applications force the user to input a station ID or scan a QR code to initiate charging (Anywhere Charging and Tata Power EZ Charge).

Inferred Interactions
As described in Section 3.3, we leveraged dynamic traffic analysis to capture and infer the interactions between the mobile application and the CMS. As an adversary, we consider the communication between the EVCS and the CMS as a black box. However, the communication between the other entities can be inferred from the different states that the mobile application goes through while performing different actions. Moreover, while previous work presented in [7,9,13,14] complements our analysis of the communication between the EV, EVCS and the CMS, they provide us with some additional insights about such communication and interactions. Specifically, it has been shown that the communication between the EV and the EVCS lacks proper security measures, which renders the underlying equipment vulnerable to remote attacks. For instance, Baker et al. [14] were able to eavesdrop on the Pulse-Width Modulation (PWM) communication, which was utilized by IEC 61851 [30,31] for safety-related signaling mechanism between EVs and EVCSs. Furthermore, despite the added security features into the ISO/IEC 15118 (e.g., Signal-Level Attenuation Characterization and TLS encryption), the works in [14,30,31] highlighted the improper deployment of these features in practice. Moreover, as highlighted in [6], most of these security features are optional and are commonly ignored by manufacturers, thus, rendering devices vulnerable in real-life.
User and EVCS Registration. To this end, we analyzed the EVCS charging applications listed in Table 1 of Type 1 to infer the interaction between the different entities upon user registration, EVCS registration, and upon sending a charging request. We identify the main interactions with the CMS during registration of a new user and an EV charging station (EVCS). During user registration, each user is assigned with a unique identifier, which allows the user to log into the platform and use  existing functionalities. There are several options for the user identifiers such as email/password combination or authentication tokens to name a few. The unique user identifier is transferred to the CMS upon user registration on a given platform, and then used later for authentication purposes. On the other hand, when an EVCS is installed and made available for the public, the operator needs to register it with the CMS by sending/registering its unique identifier. This information gets saved in the CMS and used by the mobile application to identify a charging station.
Initiating Charging Requests. After the user connects the vehicle to the charging station using one of the available connectors, the user must initiate a charging request using the mobile application by selecting the desired charging station (e.g., using a map view). The application embeds the unique user identifier along with the selected station's ID in the message sent to the CMS, respectively. The CMS then sends a start charge request to the charging station with the respective ID/info. Consequently, the EVCS checks for any connected vehicle before initiating the charging session. Note that in case no vehicle was connected at the time when the user initiates a charging request, the EVCS will wait for a grace period (e.g., 5 minutes) to provide the EV owner with sufficient time to plug the charger to the vehicle. Otherwise, if a car was found to be connected to the EVCS, it will initiate the charging session by sending a confirmation message to the CMS, this is inferred by monitoring the changes on the mobile application user interface. Once the CMS receives the confirmation, a correlation between the user identifier and the EVCS identifier is established. Finally, the CMS relays charging confirmation sent by the EVCS to the mobile application.
To put this in a better context, we describe the state transitions inferred from the analysis of different platforms provided by the various EVCS vendors in the industry. The interactions between the EVCS, mobile application, and the cloud management systems (CMS) cause state transitions. An action that occurs on one of the components will alter the state of the other components. For example, whenever a user initiates a charging session and transitions from S2 to S3 as illustrated in Figure 5c, the EVCS and the CMS will transition from S2 to S3 and eventually S4, the state of each component is dependent on the actions done by the other components. The different components making up the EVCS ecosystem are tightly coupled. The transition of one entity from one state to the other would change the current state of the ecosystem. An ideal system must strictly maintain the three entity state machine. The legitimate states of the EVCS ecosystem are depicted as a 3-tuple combination. The CMS, EVCS and the mobile application must strictly maintain the following 3-tuple states at all time: [S1, S1/S2, S1/S2], [S2, S2, S2], [S3, S3, S3], [S4, S4, S4], to avoid potential attacks. Note that all components have the same numeric state at all times, except at S1, where the CMS can be in S1 while the other components could be in either S1 or S2.

Identified Vulnerabilities
In what follows, we present examples of the identified vulnerabilities that can be exploited to perform remote attacks against the EV charging ecosystem and the various involved stakeholders (e.g., EV consumer and the power grid). We leveraged the described analysis methodology in Section 3 along with the inferred traffic/interactions in the previous sub-section to identify vulnerabilities. Specifically, we discovered three major security weaknesses that are inherited from design and implementation flaws in the EV charging mobile application studied (Type 1). The EVCS charging platform do not strictly comply with the legitimate 3-tuple states. We found that the three entities stay in multiple unexpected 3-tuple states. The first unexpected state is (S4, S4, S1/S2); the CMS and the EVCS transition to the charging state, whereas the mobile application user is either still in registration or EVCS discovering state. This illegal state combination when exploited by an adversary could allow for remote charging/discharging session hijacking. Another unexpected 3-tuple state that does conform with the legal 3-tuple states is (S3, S3, S2). In this 3-tuple illegal state the CMS and the EVCS transition to S3 where both components wait for the EVCS to authorize and confirm the beginning of charging which renders the charging station "in-use". The adversary could exploit the later to perform DDoS and affect the availability of resources.
In what follows, we elaborate further on the root cause of such behavior, the identified vulnerabilities and their implications. It is worth noting that some mobile applications (e.g., EVMatch) mitigate the first unexpected state by forcing the user to reserve a spot before hand. Whereas, other applications (e.g., Tata Power EZ Charge) hinder the remote hijacking by forcing users to scan a QR code on the charging station. However, when statically analyzing the mobile applications, QR codes are being saved in a temporary file in the external SD card, which allows an on-device attacker to get access to that information to hijack the charging sessions. It is worth noting that some application hide the access to charging behind payment gateway (e.g., buying store credit). However, adversaries can overcome this by obtaining a store credit, which will provide access to the charging infrastructure.
Flaw 1 (F1): Unverified ownership (CWE-283). Ideally, an EV user should be the owner or authorized user of the vehicle. Thus, the EV user should be the sole entity to authorize any form of control or action on the vehicle. Interestingly, our static and dynamic analysis results indicate that the mobile applications do not verify user ownership over target vehicles when initiating charging requests. In other words, an EV charging mobile application user can initiate a charging request to any vehicle connected to the network since both the mobile application and the CMS do not have a mechanism to bind the application user to the target vehicle. Given that all communications of the mobile application go through the CMS, it is imperative to have the CMS verify critical operations such as vehicle identification and ownership management. On the other hand, access to vehicles from an unauthorized user is not verified within the EV charging mobile application platforms. Therefore, rendering the EV exposed to any user who can claim ownership and control over its charging functions when connected to the EVCS. Thus, leading to unexpected behaviors and potentially exploitable states.
Flaw 2 (F2): Improper authorization for a critical function (CWE-285). Starting and stopping charging operations on a given EVCS are considered as examples of critical functions, which could be abused by adversaries (unauthorized users) to destabilize the operations of the EVCS and the connected power grid. This was clearly demonstrated in [6], where the authors measured the impact of mass charging and stopping operations on the power grid.
Ideally, an EV owner/operator should be the only user authorized to perform critical functions on the vehicle. Exposing critical functionalities essentially allows adversaries to control charging sessions, which is considered as the first step towards initiating mass charging attacks on the grid. Nevertheless, our analysis results indicate that there is a lack of authorization, which allows any actor to perform critical functionalities on the connected vehicles. This is closely related to our first finding (F1), it is mainly due to the fact that the binding step happens only based on the user and charging station IDs without further verification of the EV ownership or binding to specific mobile users. Therefore, an adversary can utilize fake accounts to hijack sessions.
Flaw 3 (F3): Insufficient granularity of access control (CWE-1220). The majority of the studied EV charging mobile applications/platforms were found to implement some sort of access control mechanisms to restrict/disable critical functions. For instance, for some mobile applications, only registered user can view, initiate, and stop a charging session, while unregistered users can only view the availability of a given charging station. Additionally, some applications allow only one registered user to be associated with an ongoing charging session at a time. Finally, a mobile application may require a registered user to input a valid station ID to initiate the charging session.
However, the implemented access control methods lack the required granularity, which renders the control policies too broad while allowing access from unauthorized agents to trigger charging action on charging stations. Ideally, triggering a charging request should only occur in the first place if a vehicle is connected to the charging station and legitimately owned by the user issuing the charging request. However, due to the broad access control policy an adversary can trigger charging requests without owning any vehicle and even without connecting his vehicle to the charging station. We acknowledge that triggering charging request before connecting the user's vehicle is a feature instilled in the application for ease of use of the charging infrastructure, but we deem what can be exploited to be a vulnerability. Such functionality, with the lack of granularity, leads to a DDoS as described in Section 4.3. The lack of such granularity exposes the charging mechanism to unauthorized actions and allows adversaries to send requests to charging stations that changed the status of charging stations from "available" to "in-use". Although, this system design is used to enhance the user experience however, this feature should be combined with a proper EV identification mechanism.

Attack Scenarios
An attacker can leverage the discussed vulnerabilities to launch various malicious activities against the charging station and its operations such as DoS and remote charging sessions hijacking. To do this, attackers need to control a number of adversarial accounts (e.g., bots), which provide access to existing charging services through the mobile applications. Note that adversaries do not need to exploit or hijack user accounts to create the required botnet. Instead, they can easily overcome the existing security measures as they mainly depend on using a phone number or email address for authentication/verification purposes during account creation (e.g., one time password and email verification).
In practice, an attacker could rent service from online SMS and Email providers such Twilio [32], which provide communication APIs to handle the verification processes.
Remote Charging DDoS. In a remote charging DDoS attack, the adversary's goal is to render the charging stations as unavailable for other users. To this end we performed tests on the applications backend using BurpSuite [29] and inferred that most of the applications do not control the interaction frequency by limiting API requests to their backends. To keep the load on the server minimal, we tested for the presence of defensive mechanisms by 50 attempts from our account from a single computer. This can allow the adversary to perform actions more frequently than expected. The adversary could be an automated process such as a bot, which could be used to cause a denial of service to the backend, or to the charging infrastructure. For example, the authentication routine with no limit over the number of times an adversary can guess a password would lead to a bruteforce attack that might allow the adversary to compromise other users accounts. Although, some applications like ChargePoint and ChargeHub restrict interaction frequency for the login, this could be utilized by the adversary to lockout legitimate users if the adversary has access to the users' email. The mobile applications provide a vital and essential service to EV car owners, by preventing them from charging their vehicles, in case of an emergency, the users would be at risk.  It is worth mentioning that, we did not discover any limit on the interaction frequency for initiating charging requests on any of the charging applications. This allows the adversary to automate bot sending requests in a short period except for Chargepoint that was using Cloudflare backend. The attacker can send charging requests to the charging stations to check if an idle vehicle is connected to it. The charging station then will become unavailable ("in-use") for around 5 minutes. The attacker can also send requests from multiple accounts and from multiple mobile application vendors and exploit the cross-operator collaboration to distribute their attacks. This way, the adversary will bypass rate-limiting mechanisms employed on the account sending by rotating the sending account (if any). Moreover, the if rate-limiting is employed based on originating IP, the adversary using AWS rotate can change the originating IPs thus, mitigating IP based rate-limiting. To prevent being detected the adversary could introduce a random delay to the requests using Burpsuite [29]. The adversary exploiting this and the fact that there is improper and missing authentication on critical charging function, lack of granularity of access control combined with lack of ownership as illustrated in Figure 6a, can send numerous charging requests rendering the charging station unavailable for other mobile application users. Consequently, allowing a wide-scale remote DDoS that would prevent users from charging. This attack can be launched when no vehicle is connected to the charging station, thus, by monitoring the status of the charging station can coordinate his attack and gradually render the charging stations unavailable. It is worth noting that such attack might incur monetary losses on the public charging network operator and on the users that own private charging stations, but made them publicly available on the mobile platforms. The users in this attack scenario just see that the charging station is 'in-use'. Users on the application will be denied access to the charging functionality and thus denying them service. Whereas, a user that can see that the charging station is available would consider this station as malfunctioning and this would incur reputation damage for the mobile application operator.
Remote Charging Session Hijacking. From analyzing the interactions of the mobile application with the different entities, with the aim of understanding how the mobile application could be used as an attack surface against the various stakeholders, we found that the studied platforms are vulnerable to session hijacking. Utilizing these vulnerabilities leads to unauthorized vehicle charging. Ideally, the CMS should only allow a charging request if the request is issued from the account owner that is bound with the electric vehicle. However, we found that the CMS does not perform any account-based authorization or check during charging. In other words, the connection is decoupled from the user account. The user is coupled with the charging station ID only. Thus, a vehicle connected to an EVCS can be charged remotely regardless of whether the user initiating the request is the legitimate owner of the EV. The CMS does not perform the necessary checking of the validity of the request and whether a user is allowed to perform this action, or if the user is the actual owner of the electric vehicle. Thus, allowing adversarial accounts to unlawfully hijack charging sessions.
As illustrated in Figure 6b, the adversary can leverage the combination of F1 and F2 to initiate unauthorized charging requests to take control over the charging session that should have been initiated by the actual EV owner. When the attacker uses an adversarial account to start charging requests, the CMS will establish a connection with the adversary. It is worth mentioning that the actions performed by the adversary are fully legitimate and within the scope of the permitted functionalities of the ecosystem. Consequently, the legitimate EV owner can no longer control his charging session. The only way for the user to stop the charging is by unplugging his vehicle.
To this end, the user's charging session has been hijacked, the user can no longer communicate with the charging station. While this could raise an alert for a security-savvy user, other users may simply regard it as a service failure or that someone is charging their vehicle for free. It is worth mentioning that even for security-savvy users, it is not easy to trace back to the adversary. Only the CMS has some clues to trace back to the attack origin. Thus, affecting the integrity of the system and the data stored.
Remote Discharging. Vehicle-to-Grid (V2G) capabilities are one of the attractive features of EVs that can one day transform the EV battery into a distributed storage to support the power grid operation. Willing EV owners would register themselves as users willing to contribute in supporting the grid during peak hours for an incentive (e.g. financial incentives that is larger than the cost of charging) through utilizing their mobile application. However, as demonstrated above, the current system architecture lacks traceability and end-to-end authentication. An adversary can hijack a session, as explained above, and register themselves as a legitimate user that is willing to contribute in supporting the grid. This allows the adversary to gain monetary compensation by discharging other users vehicles. We acknowledge such class of attacks is not feasible at this moment due to the shy adoption of V2G capabilities in the ecosystem and the absence of wide scale compensation programs. However, the advancement towards such capabilities being instilled in the ecosystem, requires improving the current ecosystem architecture and lenient access control mechanisms, for safe and secure operation.

Attack Feasibility
In this section we study the feasibility of launching wide-scale coordinated charging/discharging attacks. In these attacks, we assume that users connect their vehicle to the charging station before starting a charging session. Along with that, we assume that the vehicle remains connected for a period of time after the end of the charging. In the aims to understand user behavior and predict it, the authors in [33] highlight that EV owners do not necessarily start charging right after plugging-in. Additionally, a time window exists between plugging in and charging a vehicle, which is the time a user needs to pull out his phone to start a charging session. Moreover, according to Almeghrebi et al. [34], another time window exists, where customers leave their vehicles for an extended time when parking at the workplace or overnight beyond finishing charging. Some users even leave the vehicles for longer than 24 hours. This attack window is only applicable for mobile applications that provide the remote start and stop services. These time windows are exploitable by the adversary where he can utilize them to launch remote session hijacking. In [35], the authors utilize a multistep electric vehicle charging station to predict occupancy using hybrid LSTM neural networks. They base their analysis on public charging data from the City of Dundee, UK in 2018. The number of charging stations pluging-in simultaneously during the day fluctuates reaching 300 charging sessions at 10:00 a.m. during the weekend and 400 charging sessions during the weekday. The number of charging sessions starting at a peak times during the day are expected to increase as more customers adopt electric vehicles as a means of transportation with the rapid and increased deployment of public charging stations. Thus, feasibility of remote charging session hijacking at scale increases. Consequently, as illustrated in Section 5.1, the attacker could cause generation and line losses that would incur monetary and generation costs with a limited number of sessions, where this impact is amplified as the number of charging sessions controlled increase which would lead to overloading and tripping transmission lines.
To execute an attack by exploiting these vulnerabilities, an adversary needs information about the user's behavior. By understanding user behavior, the adversary can time and coordinate his attack to increase its success rate. The attacker can extract information, from the mobile applications (Type 1 and Type 2), similar to [36], where the authors predicted user behavior based on arrival time, duration, departure time, etc.
An adversary can utilize the online interface (mobile application/web portals) to gather information. The information we gathered through a tool we devised are: start charge time (arrival time), departure time if a vehicle connected within the attack windows. We used Appium [37] to automate mobile application scraping or Beautiful Soup (a python library) and Object Character Recognition can be used for web applications scraping. Appium is an open-source test automation framework for use with native, hybrid and mobile web applications. It drives iOS, Android and Windows applications using the WebDriver protocol. We then identify target EVCS and monitor their utilization and status. We collect information about the charging stations that are in use, allowing us to track arrival and departure times. Moreover, whenever the station's status changes from "in-use" to "available", we send a probe charging request to check if there is a vehicle connected to the EVCS.
The adversary then will be able to collect what is needed to model user behavior and allow him/her to target peak hours to hijack charging sessions at scale [35]. The adversary can also understand the attack windows between end charging and unplugging an EV, and between the user plugging in his vehicle and starting a charging session. The adversary can leverage this information to identify numerous plugged-in EVs at peak hours and synchronize an attack against the grid.

ATTACK IMPLICATIONS
In what follows, we discuss the remote charging session hijacking attack scenario along with its implications on the power grid and EV users, respectively.

Attack Implications on the Power Grid
As demonstrated in the analysis, attackers can leverage the identified vulnerabilities to compromise user accounts and perform synchronized large-scale cyber-attacks against the integrated infrastructure [5,7,38,39]. With the EV charging ecosystem being a new and wide attack surface, it is an attractive target for exploitation by organizations with enough resources to conduct large scale attacks against the power grid, by utilizing the mobile application to perform stealthy attacks.
Consequently, an adversary could initiate a distributed botnet attack utilizing thousands of malicious accounts to send charging requests and hijack as many sessions as possible to amplify the attack.
The behavior of arrival and departure at charging stations almost coincides with the demand behavior of the power grid [36], as demonstrated in the utility demand curve of California, United States of America [40] and New South Wales (NSW), Australia [41]. Additionally, by exploiting the identified vulnerabilities and initiating the remote charging session hijacking attack (Section 4.3) during the described attack windows (Section 4.4), an adversary can remotely orchestrate hijacked charging sessions to synchronize a wide scale attack that can disrupt the power grid operations.
In this section, we study the impact of synchronized mass charging attacks on power system economics (i.e., generation cost and transmission line losses). We then examine how adversaries with some knowledge of the grid topology can craft targeted mass charging attacks in order to overload and trip transmission lines. Finally, we study the power grid stability subject to oscillatory load attacks that can cause violation of the safe frequency operation limits and load shedding. Oscillatory load attacks can be performed using 16 of the applications that provide on and off remote control capabilities without requiring the use to scan a QR code.
To amplify the attack impact on the grid, an adversary with knowledge of the grid can craft targeted and smarter attacks. A small number of compromised charging sessions with enough knowledge of weak buses allow the adversary to disrupt the power grid operations. Power grid information can be estimated through monitoring the measurements of the power grid to estimate the topology, using MILP programming, machine learning and voltage and load monitoring [6,[42][43][44][45][46][47][48]. Various stability techniques and strategies could then be used by adversaries to locate the most sensitive/vulnerable buses, such as PV and QV curves [6,49].
We demonstrate the impact of the attacks on the 7-bus test case introduced by Glover et al. [50] (Figure 7a), which is commonly used for research purposes [6]. We utilize this grid due to its built in optimal power dispatching capabilities, unlike the work in [7]. Moreover, this 7-bus test case provides the generation costs formulas that will allow us to study the economical impacts on the utility. To achieve close to realistic simulation of the power grid behavior during peak and off-peak demand hours, we scaled the grid loads based on the NSW [41] power grid load profile using Equation 1.
To this end, we use PowerWorld [51] which is a power simulator that allows us to analyze the steady-state power flow, transient stability, generation costs and other power system operations. Unlike [6,52], here we study the economical aspects of an attack such as generation cost and line losses respectively. Along with that, we also take into account load shedding mechanism that is used by the utility to regulate power generation in case of a sudden drop in frequency below certain thresholds [53] to demonstrate more realistic attack implications. The different attack simulations and results are demonstrated below. In what follows, the attack is initiated by compromising 84 MW of EV load that are equivalent to 7636 EVs charging at the 11 kW Level 2 chargers, The current numbers of EVCSs and EVs is not enough to mount such attacks, however, the growth in the EV numbers will soon provide a large enough surface to make it possible [6]. It is worth noting that mobile applications allow cross-product communication and control, thus, increasing the scale of the attack as more vendors join these platforms. Moreover, as the EVCS market move towards wide adoption of level 3 chargers, the higher power entails a higher risk.
Economical impact. The attacker can cause the power utility to incur economic losses by launching EV attacks against the power grid. To study the economical impacts of a mass charging attack on the grid, we examine the transmission line losses and the power generation cost during different loading conditions and under different attack scenarios. To perform mass-charging attacks 29 applications allow us to perform such an attack, whereas the rest prevent remote mass charging by forcing the adversary to scan a QR. We used the scaled load profile to demonstrate the incurred cost and losses at different grid loading conditions. Namely, we focused on the peak load (943 MW), the average load (800 MW) and the minimum load (677 MW) conditions that we will refer to later as off-peak load. We simulate 3 different attack scenarios against the test grid by (1) distributing the attack load  randomly, (2) distributing the attack load equally among the 6 load buses and (3) distributing the attack load proportionally among the different load buses. It is worth highlighting that Scenario (1) represents a random distribution of the EV charging attack load to simulate an adversary with no knowledge of the grid topology. Scenario (2) and (3) represent attacks by an adversary with limited knowledge of the grid and geographical knowledge of load size and EV distribution respectively.
Generally speaking, the attacks will increase the transmission losses under all loading conditions. However, under higher loading conditions, the same attack will cause more incremental losses due to the increased power flow in the lines. Line losses are calculated as P loss = R line × I 2 thus at higher loading conditions, the same attack load will result in more losses. It is worth noting that under the different attack scenarios, the total incremental line losses were almost equal. This is due to the fact that, the total load of the different attack scenarios is the same and that we do not have any extra long transmission lines that will have significantly different losses under different attack load distribution. The normal and incremental losses are demonstrated in Figure 8a. The no-attack losses under the different loading conditions were 3.1 MW (off-peak), 3.4 MW (average) and 4.3 MW (peak), which lead to an increase by 16.13% at off-peak loading conditions, 17.65% during average loading conditions and 18.6% during peak conditions. Thus, this simulation clearly demonstrates that the attack impact on system losses is amplified when the power demand was the highest, which also coincides with the time during which EV connection to the chargers is the highest.
In the case of attacks against generation cost, each attack scenario differs based on the optimal power dispatch performed by the utility to reduces the overall cost. Figure 8b presents the total generation cost of the system when no-attack occurs and during the three attack scenarios mentioned above. As Figure 8b demonstrates, the total added cost due to the attack is the higher during peak loading condition across all attacks. More importantly, the proportional attack scenario caused the highest extra cost. To put things into context, the no-attack cost at off-peak, average and peak loading conditions were $14,545.28/Hour, $16,009.39/Hour and $18,438.10/Hour respectively. The added cost due to the proportional attack is $1,423.83/Hour under off-peak conditions, $1,426.45/Hour under average conditions and $1,451.95/Hour under peak conditions. This demonstrates how an attacker can force the utility to increase its generation and incur extra costs.
One aspect not present in the simulation was the usage of peak generation units. This was left out due to the absence of these units in the Glover grid in Figure 7a. These units are usually fast ramping units used by utilities and power grid operators during peak hours when the large baseline generation units do not have sufficient capacity to supply all the load. These peak generation units are usually operated for a few hours a day only due to their high operation cost. This means that if the attack occurs at a time where peak generators are being utilized, the extra cost would be higher. Another aspect of repeated long term attack worth mentioning, is that mass charging attacks, especially at peak hours, will cause extra transformer loading. This extra loading would reduce its lifetime and would require more frequent maintenance intervals causing extra maintenance costs. An attacker with a long term target of causing the utility to incur extreme losses can repeat the hijacking of charging sessions over long periods of time. For instance launching the above attack for one hour during peak times every day for an entire year will create an extra generation cost totalling $529,962 for the utility based on the Glover grid and the generators' cost functions. To put things into a better context, scaling this attack up to the NSW grid will cause $4,615,967 extra cost for the utility per year. To this end, an attacker might choose to compromise a smaller number of EV charging sessions and choosing different sets of EVs every day to remain stealthier and still cause millions of dollars of losses to the utility in extra generation costs.
Overloading and tripping transmission lines. Another type of impact that might be desired by the attacker is causing line overloading and tripping by crafting a targeted attack against the grid. This attack has more severe and immediate consequences since it can leave consumers without electricity. In the previous set of attacks, some lines got highly loaded but none of them reached an overloaded state. The same EV load however can be used by attackers with topology knowledge to target certain lines in order to cause cascading line failure. The attacker will only require knowledge of the topology and estimate values of the loads and power flows but not the line parameters. This information can be found online and in multiple public access databases and websites.
To simulate such attacker behavior, we targeted bus 4 and bus 5 with a synchronised 20 MW and 64 MW EV charging attack respectively. This attack overloaded and tripped the line connecting bus 1 and bus 2 after which multiple lines would be overloaded and tripped. In total, seven lines would trip successively in the order shown in Figure 7b. The successive line tripping would lead to islanding each of buses 1, 3, 4 and 5. While the load at bus 4 will be supplied by power from the generator at the same bus, the loads at bus 3 and 5 will lose their power supply and thus the grid will lose a total of 280 MW which represents a loss of electricity to 35% of the consumers.
Power grid instability. Another attack that takes advantage of load manipulation is an oscillatory load attack that can impact the frequency stability of the power grid. This attack revolves around the concept of creating a demand surge to cause a frequency drop on the grid followed by a drop in demand to cause the frequency to overshoot. In the first step, the attacker will use the compromised accounts and hijack charging sessions to initiate mass charging to increase the power load. This extra power load would create an imbalance between the increased load and the generated power causing the generators to slow down resulting in a frequency drop. The second step of this attack happens when the system starts its recovery. The attacker would switch off the compromised charging sessions, initiated in the first step, to cause a frequency increase that is amplified by the operator's effort to increase the speed in response to the initial step. The attacker would then alternate between these steps for the desired duration. The impact can be amplified by launching the attack when the system has lower inertia due to the presence of a high share of renewable energy resources. Given the dependence of the grid's transient behavior on the generator and turbine models, we utilized the automatic control models common to studies similar to ours. It is important to note that the utilization of different control models will change the exact values of the simulation but the general shape and behavior remain the same. This demonstrates that the attacks can be successful under different conditions, but their magnitudes might be need to be scaled based on the different conditions to achieve the desired impact. In our study, we used the machine model "GENSAL", the exciter model "IEEE T1" and the turbine governor model "IEEE G2".
The oscillatory load attack is simulated against the grid in Figure 7a by initiating the oscillatory load behavior described above on buses 3 and 5. The attack is initiated by starting a mass charging session equivalent to 20 MW ( at time t=15s and stopping it at t=25s after the system starts to increase generator speed to compensate and the frequency starts to rise. This charging and stopping behavior is repeated periodically every 10 seconds while increasing the attack load at each bus by 5.5 MW every cycle. The frequency behavior of the grid that results after such an attack is demonstrated in Figure 9a where we can see the frequency fluctuation due to the oscillatory load behavior. The importance of this attack is that it does not require huge loads to cause the frequency fluctuations depicted in Figure 9a. Even when the compromised EV numbers are much less than the example above, a sustained oscillation will hinder the system's return to normal operation. Sustaining this attack would damage the turbines due to the constant acceleration and deceleration.
In the previous example, we assumed no grid protection mechanism was used by the utility and that the attacker followed a semi-naive approach in which the attack period is predetermined and does not change as a result of actual conditions on the grid. In this iteration of the attack we assume the the utility will utilize load shedding when the frequency drops below preset thresholds. The threshold that is violated in the attack is the 59.3 Hz threshold after which the utility will immediately disconnect 5% of the total load in order to compensate for the fast dropping frequency [53]. This utility behavior is depicted in Figure 9b by the squares at time t=17.9s and t=33s. The behavior depicted in Figure 9b is a response to a more advanced oscillatory load attack that requires the attacker to have knowledge and observability over the actual grid response to tune the attack load and period. The attacker and utility interaction at every step is summarized in Table 2.
An extension of the oscillatory load attack can be achieved by utilizing the reverse power discharge through the V2G functionality similar to a work performed in [54]. By initiating this V2G at the instance we stop the mass charging, the attacker can cause a larger frequency spike. It is worth mentioning, that by instilling V2G capabilities in the mobile application the adversary can then utilize it to increase the oscillatory attack effect on the grid. As more generators are tripped, the system would reach a state where the demand is larger than the supply and certain loads get disconnected possibly leading to a blackout.

Impact on the User
In addition to attacks against the power grid, in this section, we discuss attacks implications against the EV consumer. The trust between the communication of different entities in the EV ecosystem allows the adversary to control the charging session using the vulnerabilities discussed above. Thus, an adversary can create an unusual charging behavior that could be switching the charging session ON and OFF multiple times which we refer to as an oscillatory attack. Performing such attacks would be of interest for various unscrupulous merchants in commercial competitions. This would lead to user experience disruption, by leveraging this insecure and unauthorized device charging, the unscrupulous can hijack charging sessions thus, making the user experience terrible. Moreover, by churning out hundreds or thousands of compromised botnet accounts, a malicious company can launch a DDoS attack preventing users from using the mobile application of a competitor to charge their vehicles. Further, initiating an unusual charging behavior might lead to a decrease in battery life, thus, the battery will age faster forcing the users to replace it and incurring extra charges [55,56]. In some cases, the unusual charging behavior could lead to compromising the user safety, since batteries might catch fire due to unstable charging behavior. Moreover, by utilizing remote discharging attack the adversary will be able to discharge users vehicles while gaining monetary compensation. The adversary registers their account and willing to contribute in supporting the grid when needed, w.

MITIGATION AND RECOMMENDED COUNTERMEASURES
We recommend hardening the EVCS ecosystem by reducing the attack surface through addressing the discovered vulnerabilities vulnerability.
To assist in mitigating automated attacks, the mobile platforms should try to detect bot behavior. To keep malicious software from engaging in abusive behaviors, charging platforms should utilize reCAPTCHA [57] or other similar services which use an advanced risk analysis engine and adaptive challenges. The implementation of reCAPTCHA helps in detecting automated scraping, creation of synthetic compromised accounts, and automated behaviors. This will not only hinder the attacker from performing the attack, it will also hinder the attacker from utilizing mobile applications to perform reconnaissance on the charging stations and their behavior, which is an integral step in preparation for a wide-scale attack against the grid.
While this could hinder the attacker, it does not prevent the adversary from utilizing the lack of end-to-end authentication. Thus, to mitigate the consequences of such vulnerability on the user and the grid. We recommend the user should have ownership over his vehicle. The user should be coupled with his vehicle from the beginning making him the central authority that controls any action performed on the vehicle. Using this we would be instilling security by design in the interactions between the entities in the EV ecosystem [58]. The user should authenticate anything related to his vehicle and view its status at all times. This would require collaboration between different counterparts such as charging station vendors, and vehicle manufacturers. Each vehicle should be identified by a unique identifier that is accessible by only the EV owner (e.g., MAC address), this allows the one-one relationship between the vehicle and the owner.
We understand for usability and commercialization of the mobile application other users should be allowed to control the vehicle charging if, for example, Alice lends her car to her son, thus, her son can be added to an authorization list by Alice, that allows him to control the charging of the vehicle. An overview of the ideal ecosystem interaction to mitigate remote charging/discharging hijacking and remote charging DDoS attacks would be by instilling end-to-end authentication. The user sends his user identifier (email and password) and his vehicle identifier upon registration. These two parameters are recorded on the CMS and correlated making the vehicle using the main owner and the sole entity able to authenticate any action related to his correlated vehicle. In step 2, any user sending a charging request sends his identifiers to the CMS. Then the CMS will relay the charging request to the EVCS with the vehicle identifier associated with that user.
To ensure that the decision-making is distributed, we task the EVCS to check if a connected vehicle has the same vehicle identifier sent in the charging request. If the identifiers match, then the EVCS will start charging by enabling end-to-end authentication. If no match was found, then it will return an error to the user. The main challenges brought to the adversary here would be finding the vehicle identifier, and the ability to anonymously send requests from compromised accounts. The adversary can no longer register to the platform without registering with a valid vehicle ID thus, rendering him incapable of sending charging requests to vehicles he does not own. Thus, by enabling a strict end-to-end authentication the attacker can not be associated with someone else's vehicle thus, the adversary will not be able to control the charging session. Finally, this would prevent the adversary from launching large-scale attacks against the grid.
After implementing the countermeasures, the user will have more visibility over his vehicle allowing him to view its status in real-time. Thus, charging companies will enhance the security by indulging the user in monitoring and controlling his charging session and vehicle, by transforming the user to an active line of defense. Moreover, attacks that are initiated by cloud management systems will also be mitigated when transparency and visibility are incorporated in the EV ecosystem.

RELATED WORK
In this section, we survey and discuss previous work that tackled the security of the EV charging ecosystem's components. The security was analyzed from various perspectives, one of which discussed the security software component and the communication protocols, and the implications of the security vulnerabilities on the infrastructure.

Software Components Security
Nasr et al. [7], studied and examined the security posture of the EVCS and their management systems. They managed to find vulnerabilities across 13 severe vulnerability classes in firmware and management systems (mobile applications and websites). It is worth mentioning that in [7], mobile applications were analyzed using only static analysis, whereas our analysis utilizes both aspects to understand the interaction of the different components. Moreover, outside of academia Kaspersky Lab's team [59] analyzed the security of ChargePoint home charging station and found significant vulnerabilities in its firmware and mobile management application. In our study, we provide a systematic and detailed analysis of the top 31 EV charging mobile applications due to the lack of a comprehensive analysis of this integral component that when compromised creates an attack surface and a backdoor that affects users, EVCSs, and the power grid.
It is worth noting that the mobile applications used to manage EVCS are widely distributed and easily accessible which simplifies and makes it easier for the attacker to acquire, analyze and compromise, compared to firmware or cloud management systems.
Moreover, the communication links have been also studied in the literature. Alcaraz et al. [9] examined the communication protocol and presented a vulnerability in the OCPP protocol that allows for man-in-the-middle (MITM) attacks, thus interfering in the communication between the EVCS and the EV resource reservation service. Moreover, in [60] they address the vulnerabilities presented in [9] and provide countermeasures. The security of the OCPP protocol has been improved, various security measures have been implemented to harden the communication protocol such as the addition of secure firmware updates, security logging, and event notification and security profiles for authentication (key management for client-side certificates) and secure communication (TLS) [13].

Infrastructure
Mohammad et al. [6] demonstrated the impact of compromising EVCSs on the power grid and launched attacks against it. Then discussed the non-linear nature of the EV charging load and simulated multiple attacks that can be launched against the power grid using these EVs. While the grid was able to recover after a 48 MW attack utilizing traditional residential loads, a smaller 30 MW EV load attack is able to completely alter user sessions the system. Moreover, in [61], the authors study how a botnet of compromised EVs and fast-charging direct current stations can be utilized to launch cyber attacks on the power grid, and its implications on the transmission and distribution networks. Moreover, in [62][63][64][65][66] they study the implications of the EV charging on the grid, and discuss some mitigation techniques. Moreover, in [67] they discuss the use of SMS phishing as a social-based attack. Where an attacker can send spoofed text messages to the users advertising a discount (20% off when the users charge their vehicle at noon). Consequently, they studied the impact of such an attack on the grid. However, the mobile phishing attacks requires knowledge of mobile phone numbers of EV users in a certain target area, which affects the feasibility of acquiring such information. Furthermore, in [67] the attack depends on the susceptibility of users to the demand and response phishing attack. Whereas, in our study, we demonstrate how and when can an attacker get information to perform an orchestrated attack that might impact the stakeholders and study the feasibility of acquiring such information. Moreover we demonstrate vulnerabilities that allows us to exploit the communication between the mobile application and the charging station that will allow the adversary to charge any vehicle connected to the charging station.

Difference Over Related Work
Zhou et. al. [17], studied home IoT communication with the cloud to detect device interaction issues. They performed traffic analysis by intercepting mobile application traffic with the cloud, and the IoT devices interaction with the cloud. However, due to the limited access to the public charging station infrastructure, we use functionality analysis to monitor the EVCS state changes based on mobile application user behavior. Moreover, we record user input in the application (e.g., user information, credit card, vehicle information) to understand the semantics of the traffic being sent. Utilizing traffic analysis similar to [17], the origin and the meaning of the traffic being sent would be lacking. For The adversary in [17] needs to have access to the charging infrastructure to detect vulnerabilities, however, in our analysis we only utilize the mobile application as a means to get information about the whole ecosystem. Furthermore, in [7], the authors focused on static analysis to analyze the vulnerabilities in mobile applications, which limits their ability to analyze the interactions of the ecosystem while utilizing the mobile application as an attack vector. To the best of our knowledge, the analysis of electric vehicle charging station mobile application and its interaction with other components (CMS and EVCS) has not been done before.

CONCLUSION
In this work, we explored the security of the EV charging ecosystem by focusing on the understudied EV charging mobile application as a main attack surface. We studied the interactions of the mobile application with other components to understand its remote control functionality over the charging stations. Our analysis of the identified interactions and communications unveiled critical vulnerabilities that allow remote adversaries to gain control over the charging operations and perform DDoS attacks by preventing legitimate users from using the charging equipment. Moreover, while we demonstrate the feasibility of exploiting existing EV charging mobile applications' vulnerabilities to to hijack charging sessions, we discuss the implications of such attacks on various stakeholders within the EV charging ecosystem. Specifically, we discuss the impact of wide scale remote attacks the underlying critical infrastructure (i.e., the power grid) and show that an attacker can utilize a botnet of adversarial accounts on those vulnerable mobile applications to cripple the operations of the power grid. Finally, while we discuss attack implications against EV consumers, we also recommend counter measures to secure the infrastructure and impede adversaries from performing reconnaissance and launching remote attacks using compromised accounts. In future work, we aim at studying the interactions between the mobile application and other components by utilizing penetration testing techniques (e.g., system fuzzing) after consulting with the different mobile application vendors.