Stay Alert—As Cyberattacks Ramp Up, EVs Are Vulnerable

"Hearst Magazines and Yahoo may earn commission or revenue on some items through these links."

• Cybersecurity firm Upstream (pictured above monitoring cyberattacks) said there were 295 cybersecurity incidents in the automotive and mobility space in 2023.
  

• “The risk is that, unlike a data leak or a bricked phone or laptop, even a minor car hack can be hugely disruptive to people’s lives,” analyst Michael Austin said.

• Britain’s Royal United Services Institute (RUSI) think tank said “the proliferation of EV charging stations and related devices being connected to the grid is widening the attack surface.”

As we enter the age of the software-defined automobile, especially those with electric drivetrains, we’re facing unprecedented risk from cyberattacks, say a wide coterie of experts. According to the Israel-based Upstream firm, from 2019 to 2023 disclosed cybersecurity incidents in the automotive and mobility space increased by more than 50%, with 295 such occurrences in 2023.

Some 64% of these attacks were executed by “bad hat actors” with malevolent intent, the report said. And 65% of deep and dark web cyber activities last year “had the potential to impact thousands to millions of mobility assets.”

Shira Sarid-Hausirer, vice president of marketing at Upstream, which has an office in Ann Arbor, Michigan, said attacks could potentially cost automakers millions of dollars.

“The smarter a vehicle, the more vulnerable it is,” she said. “A single incident could cause a lot of damage to an OEM. Over-the-air updates could fix the vulnerability, but that would cost millions, too. The vast majority of these assaults are from non-governmental sources, folks trying to make money. Terrorism isn’t a dominating motivation.”

Michael Austin, senior research analyst for EVs and mobility at Guidehouse Insights, said the overall cybersecurity threat underlies how automakers need to adapt as cars become more connected.

“I think they’re aware of it and design systems to mitigate the dangers, but the threat is real,” Austin said. “And the risk is that, unlike a data leak or a bricked phone or laptop, even a minor car hack can be hugely disruptive to people’s lives.”

An irony is that artificial intelligence cuts both ways when automotive cybersecurity is at issue. “AI has been an increasingly popular topic on the dark web, and the bad actors are learning from it,” said Sarid-Hausirer. “But it can also be used positively to investigate alerts and perform triage.”

For EVs, the connected charging network is a target. Last year, the National Institute of Standards and Technology (NIST) prepared a draft guidance that called on companies deploying fast chargers to secure their digital payment systems.

The government’s report said that in 2023, the US had more than 48,000 public charging stations, and they “connect and communicate with cloud providers and third-party vendors for EVSE location information, billing and other services.”

And that’s a vulnerability, along with the utilities that provide the power. The interface between the EV and the charging station via the cloud “presents a potential attack surface for malicious actors to cause damage,” NIST said.

A 2023 paper on cybersecurity risks notes that because a public charging station “is connected into the grid and takes the necessary power from it, it poses a significant threat to the reliability and safety of the power supply.”

The cyberattacks are not just theoretical. Video shows a hacker freely manipulating an Electrify America (EA). station. Octavio Navarro, a technology spokesman for EA, told Autoweek, “Electrify America is constantly monitoring and reinforcing measures to protect ourselves and our customers and focusing on risk-mitigating station and network design.