EmuOCPP: Effective and Scalable OCPP Security and Privacy Testing
summary
EmuOCPP is a container-based OCPP security and privacy testing framework using container emulation and IPMininet on low-cost hardware that runs real OCPP stacks and supports OCPP 1.6, 2.0, 2.0.1 and all security profiles. It uncovers five attacks—three novel MITM vectors exploiting security‑profile upgrade/downgrade and CS impersonation via boot notification undefined behavior—and validates them against tested on nine targets including open‑ and closed‑source implementations, a real charging station and a production network; findings are responsibly disclosed and the tool will be open sourced.
AI-written summary · about
chapters (15)
- 0:00EmuOCPP introduction
- 0:35What is OCPP
- 2:00OCPP security flaws
- 3:23OCPP risks
- 4:27Existing tool limits
- 5:11New framework needs
- 5:53EmuOCPP release
- 6:37Disclosure impact
- 7:19EmuOCPP design
- 9:30OCPP messages supported
- 9:52Eight attacks overview
- 12:00Man-in-the-middle example
- 13:25Downgrade attack SP3
- 13:45Real-world evaluation
- 14:48Conclusion & Q&A
related talks
12mThe Power of Confidential Computing: Exploring Open Source Projects
15mAn Extensible Orchestration and Protection Framework for Confidential Cloud Computing
40mExploiting OPC-UA in Every Possible Way: Practical Attacks Against Modern OPC-UA Architectures
01h 06mHacking and Securing C++
43mOCPP: Zephyr RTOS as Electric Vehicle Supply Equipment(EVSE)
39mInsecure Containers? Continuous Defense Against Open Source Exploits
44mModular Approach to Cloud Security
30mFinding Imposter Among Us: Container Edition