key: cord-0277291-crqv3tfs authors: Sayed, Mohammad Ali; Atallah, Ribal; Assi, Chadi; Debbabi, Mourad title: Electric Vehicle Attack Impact on Power Grid Operation date: 2021-11-22 journal: nan DOI: 10.1016/j.ijepes.2021.107784 sha: e2fe6426823794f4855b0acec0a5e029a8c4d050 doc_id: 277291 cord_uid: crqv3tfs The increasing need for reducing greenhouse gas emissions and the drive for green cities have promoted the use of electric vehicles due to their environmental benefits. In fact, countries have set their own targets and are offering incentives for people to purchase EVs as opposed to traditional gasoline-powered cars. Manufacturers have been hastily deploying charging stations to meet the charging requirements of the EVs on the road. This rapid deployment has contributed to the EV ecosystem's lack of proper security measures, raising multiple questions related to the power grid security and vulnerability. In this paper, we offer a complete examination of the EV ecosystem from the vulnerability to the attacks and finally the solutions. We start by examining the existing vulnerabilities in the EV ecosystem that can be exploited to control the EV charging and launch attacks against the power grid. We then discuss the non-linear nature of the EV charging load and simulate multiple attacks that can be launched against the power grid using these EVs. EV loads have high reactive power demand which can have a larger impact on the grid compared to residential loads. We perform simulations on two power grids and demonstrate that while the grid can recover after a 48 MW attack utilizing traditional residential loads, a smaller 30 MW EV load attack can completely destabilize the system. Finally, we suggest several patches for the existing vulnerabilities and discuss two methods aimed at detecting EV attacks. • We discuss the non-linear nature of the EV load and demonstrate how these attacks can be more harmful than traditional residential and IoT loads. We then present an attack formulation method that takes advantage of the grid conditions to maximize the attack impact through the least number of compromised EVs. • Finally, we suggest mitigation measures to address the vulnerabilities discussed in this paper as well as 2 detection mechanisms tailored to detect EV attacks against the power grid. The rest of the paper is organized as follows. Section 2 provides a background of the current state of EV proliferation and the impact on the grid. Section 3 demonstrates the vulnerabilities in the EV ecosystem, the properties of the EV charging load and provides an attack strategy based on stability metrics to maximize attack impact. Section 4 presents EV attack preparation and simulations as well as demonstrates the difference between attacking the grid with EV loads and residential loads. Section 5 provides suggestions for patching the presented vulnerabilities as well as two detection mechanisms and Section 6 concludes the paper. EVs still have a long path to go before they take over the car market. Range anxiety and unavailability of sufficient charging infrastructure in some areas have led to reluctance in the acceptance of EVs by some users. To this end, governments around the world offer incentives for EV purchases ranging from rebates on purchases to road tax exemptions. The public's opinion has also improved due to the decrease in prices, which can be attributed to the advancement of underlying technologies and larger production volumes. One major factor is the massive reduction in battery cost which contributes roughly to 25% of the EV price. By the end of 2019, there were 7.3 million Electric Vehicle Charging Stations (EVCS) around the world [14] and 7.2 million EVs on the road [15] . Despite the COVID-19 pandemic, 2020 was a record sales year of 3.2 million sold EVs with 1.33 million EVs sold in China alone [16] . The Canadian EV market has also grown in 2020 with 47,000 EVs sold in 2020 [16] and a 15% increase in charging stations to reach 13,230 EV chargers at 6,016 public stations [17] [18] . Most notably, the Norwegian market has also grown in 2020 to reach 70% of new car sales at 108,000 EVs [16] and is expected to reach all EV sales in 2025 [19] earning Norway the title of the EV capital of the world [20] . The International Energy Agency (IEA) anticipates that 30 million EVs will be on the road in 2030 [14] , thus reducing the demand for oil products by 2.5mb/d (or 127 million tons a year) and displacing the total emissions by 189.1 Mt CO2. In line with this vision, the Quebec Government has set a target of 1 million EVs by 2030 [21] and will ban new gasoline-powered cars sales in 2035 [22] . Multiple nongovernment initiatives have also been undertaken to support the proliferation of EVs. One such initiative is the Zero Emission Transportation Association (ZETA). Two of the chief members of ZETA are Uber and Tesla that are pushing towards increased EV proliferation. Indeed, Uber's CEO expects that Uber's service will become fully based on EVs in the US and Canada by 2030 [23] [24] . Given the push towards EVs, it is important to examine the EV ecosystem components, as well as the threat EVs, introduce into the power grid. The following section presents a brief discussion of the components of the EV ecosystem. The EV charging ecosystem is a complex cyber-physical system composed of interconnected hardware elements, software elements and communication protocols making it an IoT paradigm at the heart of the smart grid. These elements are discussed below: • Electric Vehicles: The center element of this ecosystem is the EV itself. EVs have large batteries that require dedicated charging stations. • Electric Vehicle Charging Stations: EVCSs are the connection point between the power grid and the EVs. The EVCS itself is an IoT device running its firmware. These charging stations are classified into 3 levels based on their charging rate [25] [26] [27] . Level 1 chargers are the slowest chargers providing a rate of 1.4 kW and can be plugged into a 110 V wall outlet but are currently being phased out in favor of the faster Level 2 chargers. Level 2 chargers require extra hardware to be installed and provide a charging rate of 7.2 kW to 11 kW. The highest level 2 rate at the time of writing this paper is 19 kW. Finally, Level 3 chargers are DC fast chargers that deliver a charging rate of 40 kW to 240 kW. • Electric Vehicle Protocols: As mentioned earlier in this section, bilateral communication occurs between the components of the EV ecosystem. Figure 1 provides a simplified depiction of the established communication channels. Thus, the communication between user apps, EVs, EVCS, and the EV management system needs to be secure to ensure safe and reliable system operation. The adopted protocols vary between different equipment manufacturers, countries, and EVCS operators [28] [29]. This lack of standardization exposes the system to a variety of weaknesses as explained by the US Department of Transport [28] and summarized in Section 3. • Power Grid: The power grid is the backbone of most modern activities including EV charging. EVCSs are connected to the power grid and draw the needed electricity from this grid and as such have a great impact on the security and stability of this grid. The following sub-section presents some of the work done on the impact of EV on the users and the power grid. As EV numbers increase further, irregular charging behavior becomes more problematic and can negatively impact the power system operation. The work performed on [30] demonstrated how uncontrolled EV charging especially during peak load time can cause loss of load up to 6.89%. In fact, it is estimated that a 10% EV penetration in Portugal can cause significant voltage-drop at peak times [31] . The work performed in [32] performed a comparison between two optimization objectives, to reduce the peak load by shifting the EV charging to night times and by utilizing the Vehicle to Grid reverse power flow to reduce day peaks respectively. Their work demonstrated that reducing peak load and minimizing operation costs cannot be achieved simultaneously. The authors concluded that it is more important to properly manage the EV charging schedule rather than EV discharging to improve system load without significantly increasing the operation cost. Another aspect of EV impact on power system cost was studied in [33] that focused on power system infrastructure investment cost as well as system losses. This study performed simulations on a residential Area A with 6,000 consumers having 3,676 cars and a mixed residential/industrial Area B having 61,000 consumers and 28,626 cars. Multiple EV penetration levels were considered between 35% and 62% of the total car numbers. The EV charging stations were spread randomly in the grid at locations that already had non-EV loads. The simulations were performed for the peak and off-peak demand scenarios at each area and the results show increased investment cost and system losses at all levels of EV penetration. The incremental investment was found to be 201/EV in Area B and 6310/EV in Area A since it was already operating close to its operating limits. The authors also simulated the impact of the EV load on system losses and concluded that the losses could increase by up to 30-40% under a 62% EV penetration scenario. Several works in the literature have discussed attacks against or through the EV ecosystem against the users and the power grid. Attackers that gain control of the EV Battery management system through compromised web services or malware downloaded to the EVs systems can cause severe damage to the EV itself. In fact, [34] and [35] discuss how the attackers can cause damage to the EV batteries by manipulating the charging current and bypassing the safety measures in place. However, attacks against the users are considered out of the scope of this work. The authors of [12] presented an EV attack formulation by relying only on publicly available data to destabilize the Manhattan power grid. Their method consists of representing the power system as a feedback control system and the EV as the feedback gain of the system to determine the number of EVs required. Their work concluded that although Manhattan doesn't currently have enough EVs to mount such an attack, the growth in the EV numbers will soon provide a large enough surface to make it possible. Their work, however, relied on the DC power flow model that completely ignores the reactive power flow and other grid behavior issues. In contrast, our work will take into consideration the nature of the EV load presented in Section 3.5 that makes it ideal to mount attacks against the power grid with a larger impact than pure active power loads and loads with a high power factor. Being IoT devices that adopt multiple communication platforms and web applications, the EV infrastructure inherits the vulnerabilities of the adopted technologies [36] . The pressure to achieve rapid expansion has also been considered a great hindrance to the secure deployment of the EV infrastructure. Operators and manufacturers often forgo security measures to achieve faster and cheaper deployment of their equipment. Due to the connection of the EV infrastructure to the power grid, the secure operation of EV charging is considered pivotal for the security of the modern smart grid. To this end, we present the following insight into the security issues surrounding the EV charging ecosystem. The US Department of Transport mentions the following four vulnerabilities in the EV ecosystem [28] : • EV Charging Infrastructure Lacks Cybersecurity Best Practices: The EV industry lacks secure software design and development methodologies. • EV Charging Infrastructure Lacks a Trust Model: There is no agreement on a secure communication standard for communication between EVs and the EVSCs. • EV/Charging Infrastructure Lack Cybersecurity Testing: There are inadequate integrity protections and there are limited cybersecurity monitoring tools to detect malicious activity. • Commercial Charging Infrastructure Lack Physical Security: Most EVCS are exposed and can be physically accessed and tampered with. Different EVCSs have different physical features. Given the mentioned vulnerabilities, this section discusses possible EV ecosystem exploits and specific system vulnerabilities. Then we discuss the EV charging load properties that make it ideal for attacking the grid as well as present an attack strategy. The National Institute of Standard and Technology (NIST) [37] classifies attacks against the EV infrastructure as: • Physical: EVCSs lack physical security and malicious actors can damage the EVCS, steal electricity, or even install malware through the available USB ports. EVCS can even be blocked at public locations by parking Internal Combustion Engine vehicles in front of them (known as ICEing) to cause a denial of service. • Local: This exploit is based on gaining logical access to the EVCS through the firmware vulnerabilities. The firmware updates of some vendors such as Schneider Electric are available online and can be disassembled, and reverse engineered by attackers to find their weaknesses and possible entry points into the system [28] [38]. Kaspersky labs were able to reverse engineer the firmware of ChargePoint home chargers [39] . • Limited Remote: Attackers can take advantage of Local Area Networks at homes or public charging locations to access the EVCS. These networks usually employ weak credentials and outdated encryption techniques. The communication between the EV and the EVCS takes place through a set of protocols over the charging line adding vulnerabilities to the system. • Remote: As mentioned above, EV users communicate with the EV management system online. Whether this communication takes place through a webpage or a mobile application, it creates a plethora of entry points for malicious actors. Furthermore, the EVCSs communicate with the EV management system through protocols such as the Open Charge Point Protocol (OCPP). The IEC and ISO protocols define the communication between the EV and the EVCS. Information is exchanged over the powerline through a dedicated control pin. However, this communication has its issues and vulnerabilities as explained herein. IEC protocols are well established in the Control of substations but have also been included in the EV ecosystem. These protocols define multiple aspects of EV charging, but we only mention two of them herein. IEC 61850-90-8 fulfills smart charging requirements and has considered other standardization efforts from the beginning. However, basic functionality for EV charging like user authentication was considered outside the scope of this protocol and was delegated to other protocols like OCPP or other IEC protocols. IEC 61851-1 defines a safety-related signaling mechanism between EVs and EVCS based on Pulse-Width Modulation (PWM). The PWM signal is transferred over the control pilot pin of the charging ca as demonstrated in [42] . The ISO/IEC 15118 defines an international complementary standard to IEC 61851-1 and provides bidirectional digital communication [41] . However, ISO 15118 is not demand response compliant and does not devote a space for privacy except by stating that private information shall only be transferred, when necessary, to the intended addressees [43] . External studies have highlighted the potential privacy concerns related to the usage of this protocol [43] and the work done in [42] even performed a real-world attack campaign. The authors of [41] [42] and [43] highlighted some weaknesses in the protocol or the improper use of the available security measures. • Signal-Level Attenuation Characterization (SLAC) is a protocol that can operate in a secure mode, with mutual authentication and encrypted communication. • TLS encryption is supported by this protocol but is dropped when the charging session is authorized by an external source such as RFID (Radio-frequency identification) cards, mobile app networks, or manually by an operator. • Public key infrastructure can also be implemented with ISO 15118. These security measures, however, are optional and have been mostly ignored by manufacturers and operators to reduce additional cost and overhead leaving the communication through plain text vulnerable to attacks. OCPP coordinates communication and power flow between EVCS, EV management system, EVs, and the grid and allows full eliminated this option. The main security concern for OCPP is ensuring that a charging session is authorized by a billing system. This along with communication using plain text and the absence of wide adoption of encryption allows attackers to highjack the communication and gain control of EV charging. Attackers that are unable to break the encryption, can capture messages such as those that start and terminate charging sessions and use them in replay attacks to disrupt the EV charging. OCPP 1.5 and 1.6 also offer a functionality known as local authorization list (LAL), which allows an EVCS to serve customers even if it gets disconnected from the Management System. An attacker, however, can use this functionality to force the Management System into accepting EV charging requests without proper authentication. As mentioned in Section 2, the EVCS host a firmware the controls their operation and interacts with multiple online services available for management and user interaction with the EVCSs. As IoT devices, EVCS exhibit the same types of vulnerabilities present in other IoT devices. In addition, the web pages and phone apps used in this environment also exhibit the same vulnerabilities as other web/phone apps. These vulnerabilities are discussed in the OWASP Top 10 Application Security Risks [46] and can be discovered through the framework presented in [47] . Other vulnerabilities include malicious update packages sent to replace the authentic updates by the manufacturers similar to the Solar Winds Hack [5] that would allow the attacker to embed their code in the deployed system and virtually control all aspects of the charging process. The most critical vulnerabilities that were proven to be present in the EV ecosystem in [28] [38] [39] and by work involving one of the authors of this paper are summarized below: • SQL Injection: allows the attacker to gain access to privileged user information and manipulate the EVCS firmware. • XML/External Entity Injection: allows the attacker to inject HTTP requests into the system and in some cases gain remote access to the EVCS. • Server-Side Request Forgery (SSRF): allows the attacker to redirect traffic towards internal/external endpoints causing denial of service and reading files and record logs of the EVCS. • Cross-Site Scripting (XSS): allows the attacker to inject malicious code into the EVCS allowing them to highjack user accounts or even administrator accounts in some cases. • Comma-Separated Values (CSV) injection: allows attackers to embed XSS payloads that get triggered and stored on the EVCS leading to hijacking administrator session tokens. Using this vulnerability, attackers can manipulate EVCS functionality. • Cross-Site Request Forgery (CSRF): allows the attacker to induce target users to perform unintentional actions that lead to setting modification and manipulation of EVCS functionality. This weakness can allow attackers to gain control of the EVCS. • Hard-Coded Credentials: are utilized by developers to ease the coding process, but it allows attackers to recover the hardcoded login credentials in the source code of the EVCS or the associated application and gain unauthorized access to the EVCS. • Missing Authentication: allows the attacker to gain unauthorized access to user accounts without being properly verified by the EV management system. Unlike conventional residential loads, EVs are battery storage loads that present a new concern to the power grid. Charging this battery is a non-linear process that would reduce the quality of the delivered power [48] - [53] . The EV charging load would increase the reactive power demand and reduce the Power Factor (pf), introduce harmonics, cause voltage distortion and fluctuation, and it can also cause three-phase imbalance [48] - [53] . EV charging is a typical non-linear load based on rectifier circuits and power converters [49] . Non-linear loads draw non-sinusoidal current from a sinusoidal voltage [50] causing voltage and current waveforms to have different shapes. Some mainstream EVCS utilize uncontrollable rectifier circuits having high harmonic distortion. Other EVCS that support V2G technology, utilize controllable power converters [51] . These non-linear loads contribute to a poor power quality on the grid [52] . New solid-state devices are feasible using MOSFETs and IGBTs as well as incorporating active and passive filters into the chargers [52] . Yet these devices are costly, bulky and incur losses that reduce the overall efficiency. Regardless of the specific circuit of the EVCS, adding a large amount of non-linear load would increase the reactive power demand of the system [53] . As the work in [51] demonstrated, nonlinear loads can have a power factor as low as pf=0.15 lagging. The authors also discussed that although power factor correctors can improve the pf, a perfect pf=1 is not possible due to the harmonic distortion of these non-linear loads. The authors of [48] also demonstrated that an AC-DC converter (rectifier) can have a power factor as low as pf=0.4. Uncompensated battery chargers have a power factor slightly above or below 0.6 [53] . To make things worse, an attacker that gains control of an EVCS with controllable power converters can manipulate it to draw more reactive power from the grid [50] . As a middle ground, we consider the EV attack loads will have a pf=0.6 lagging [54] . Transmitting large amounts of reactive power from generators to the loads causes large transmission losses in the power lines, reduced voltage levels, and might cause severe problems in terms of grid stability. Synchronous generators (not being operated as condensers) are limited in terms of the total reactive power they can produce at a given point of active power generation [55]. On the other hand, traditional residential loads and home IoT loads have a high-power factor being mostly resistive. This is especially true for the larger loads such as electric water heaters and space heaters that have a power factor very close to pf=1. Other large loads such as air conditioners and refrigerators have a power factor of 0.8