In recent years an increasing amount of electric vehicle fast charging stations have been built to meet the growing demand from rising electric vehicle numbers. The standard for fast charging communication in europe is ISO 15118. In theory the standard includes security controls for authentication and transport encryption. In reality difficulties with implementing those security controls as well as insecure design within the standard lead to multiple possible attack vectors compromising the confidentiality and authenticity of charging communication sessions. The goal of this research is to present different approaches towards performing sniffing and man-in-the-middle attacks against charging communication. We also provide a novel approach, which does not rely on race conditions and thus is more reliable than previous approaches.
Modern charging communication standards for electric vehicles include optional security controls such as TLS-based authentication and encryption. However, with tens of thousands of fast charging points deployed in any given country, individually testing each one for security control support is infeasible. This paper proposes a scalable, extrapolation-based methodology for assessing charging station cybersecurity at a national level. A market analysis identifies operator-manufacturer pairs, enabling the targeted selection of charging stations for field testing, whose results can then be extrapolated to all stations sharing the same combination. We demonstrate this methodology for Germany, covering over 40000 CCS charging points as of December 2025. With a manageable number of field tests, our extrapolated data examines 51.9% of german CCS charging stations. It shows that only 27.4% of charging stations in our scope provide TLS-protected communication, despite widespread theoretical support.
