Source-linked AI summary
EVSEFuzz : A Tool for Automated Testing of Protocol Implementations
Soham Gumaste, Michael Khan, Roland Varriale, Rigel Gjomemo
TL;DR
Fragmented EV-charging infrastructure relies on protocols whose implementations can vary, making security testing across implementations difficult to scale. EVSEFuzz builds fuzzers from protocol specifications and generates compliant and non-compliant messages. The authors report finding vulnerabilities, including in EVerest, while noting that partner-company findings cannot be disclosed.
Problem
Fragmented stakeholders and varying protocol implementations make it challenging to develop security methods that apply across the EV-charging industry and scale with little manual effort.
Source: §1 · pp. 1–2Method
EVSEFuzz uses protocol specifications and runtime datatype modeling to automatically generate compliant and non-compliant messages for remote testing.
Source: §1 · p. 2, §2.1 · p. 4Results
Takeaways & Limitations
The authors report that specification-based fuzzer instantiation cuts development time and simplifies deployment in the field.
Source: §4 · p. 7A connection loss only identifies the last sent message as a potential cause; it does not establish that the message caused the interruption.
Source: §2.3 · p. 6
Abstract
from arXiv · showhide
The rapid adoption and development of electric vehicle (EV) networks has required the expansive deployment of EV charging infrastructure (EVCI) which relies on communication protocols such as the open charge point protocol (OCPP) to coordinate data transfer between charging network operators and the EV supply equipment. In this paper, we present EVSEFuzz, a tool for automatically building fuzzers to test the security of protocol implementations. To achieve this we make a novel use of Python datatype validation packages and tools to ``understand'' datatypes and message structures and generate both compliant and non-compliant messages. To date, EVSEFuzz has been tested successfully with several open and closed-source implementations and has found several vulnerabilities leading to the publication of two CVEs.
1 Introduction
Fragmented EV-charging stakeholders and widely varying protocol implementations make security testing difficult to generalize across the industry. EVSEFuzz addresses the gap in automated, specification-driven testing for protocol implementations.
- Fragmented stakeholders and varying OCPP implementations complicate security models and methods that work across the EV-charging industry.OCPP's expanding reach and connectivity can amplify the consequences of attacks.Source: §1 · p. 1
- Security testing needs to scale across implementations with little manual effort, including implementations that deviate from protocol specifications.Manually building a separate fuzzer for each implementation is described as cost-intensive.Source: §1 · p. 2
- Prior work identified OCPP implementation pitfalls, while the more general assessment framework did not fuzz protocol software implementations.Source: §1 · p. 2
- EVSEFuzz builds remote fuzzers from JSON or XML schemas and generates compliant and non-compliant messages without requiring access to target code.It has been tested on open- and closed-source implementations and found vulnerabilities resulting in two CVE entries.Source: §1 · p. 2
2 EVSEFuzz Architecture
EVSEFuzz uses protocol schemas and orchestration settings to generate and send messages through distinct fuzzing strategies. Its modules cover datatype and structure violations, message sequencing, and black-box response analysis.
2 EVSEFuzz Architecture
- Schema inputs guide compliant and non-compliant message generation, while orchestration settings specify the endpoint and fuzzing sequence.The schemas may follow a standard or deviate from it.Source: §2 · p. 2
2.1 Datatype Fuzzer
- Runtime Pydantic models recursively populate schema-defined types and constraints to generate messages, including composite fields and lists.Datatype mutations include overlong values, incorrect types, and values outside specified constraints; fields may also be randomized between valid and invalid.Source: §2.1 · pp. 3–4
2.2 Schema and Sequence Fuzzers
- The schema fuzzer alters message structure, while the sequence fuzzer can authenticate, reach a target state, and then send unexpected or non-compliant messages.State specifications can provide messages for reaching deeper protocol states and can include targeted malicious payloads.Source: §2.2 · pp. 4–5
2.3 Error Analysis and Configuration
- Black-box error analysis flags responses that conflict with expected protocol behavior, such as accepting a non-compliant message or rejecting a compliant one.Configuration coordinates authentication, state establishment, and subsequent random or state-based fuzzing; a severed connection logs the preceding message only as a potential cause.Source: §2.3 · pp. 5–6
3 Evaluation and Results
EVSEFuzz was evaluated on open-source OCPP implementations and a charging-company server. Testing found several vulnerabilities in EVerest, including crashes and non-compliant message acceptance.
- The evaluation covered EVerest, CitrineOS, and a charging-company OCPP 1.6 server, with 10,000 random messages sent two to three times weekly to the partner endpoint.Source: §3 · p. 7
- Several vulnerabilities were found in EVerest, including out-of-bounds crashes, acceptance of NaN in integer fields, and crashes when required fields were omitted.The authors traced the omitted-field crashes to validation code accessing a field that was not present.Source: Table 1 · p. 6, §3 · p. 7
- The authors cannot disclose the findings from the partner charging company, while EVerest's open-source code enabled root-cause analysis.Source: §3 · p. 7
4 Conclusion
The conclusion presents EVSEFuzz as a practical tool for testing the security of communication-protocol implementations in EV charging infrastructure.
- Given a protocol specification, EVSEFuzz automatically instantiates a fuzzer, reducing development time and simplifying field deployment.Source: §4 · p. 7
- The tool was tested successfully with EV-charging-company infrastructure and open-source software.Source: §4 · p. 7
- EVSEFuzz is presented as a practical means of testing communication-protocol security in EV charging infrastructure.Source: §4 · p. 7