MitM Cyber Risk Analysis in OCPP Enabled EV Charging Stations

The increasing adoption of Electric Vehicle Charging Stations (EVCS) necessitates robust security measures, par-ticularly in the communication protocols used between Charging Point (CP) and EVCS Server (CS). This paper focuses on the vulnerabilities associated with the Open Charge Point Protocol (OCPP), a widely used protocol for EVCS communication. Specifically, we analyze the risks of Man-in-the-Middle (MitM)attack, which exploit weaknesses in OCPP's client and server communication. We implemented a MitM attack on OCPP 1.6, discovering that although it uses TLS 1.2 for encryption, this version is not secure. In the intercepted packets, the information about the cipher suites used by TLS 1.2, session id, server address, application protocols is in plaintext, making the system vulnerable. Our findings underscore the need for enhanced security measures. First and foremost, preventing MitM attacks is crucial. Additionally, if communication is intercepted, using the latest version of TLS and encrypting cipher suite information can further strengthen security. Our analysis is supported by experimental results demonstrating the feasibility of such attacks and their potential consequences.