Weak security means attackers could disable all of a city's public EV chargers

Tsinghua University researcher Hetian Shi presented critical security flaws in rentable IoT infrastructure (EV chargers, shared e-bikes/scooters) at Black Hat Asia, discovered through authorized penetration testing. Vulnerabilities include exposed debugging ports, shared authentication keys, and weak backend authentication enabling attackers to create phantom clients for free service use and execute coordinated denial-of-service attacks on entire city networks. Using his tool IDScope, Shi demonstrated remotely disabling EV chargers and theorizes flaws stem from developers prioritizing user convenience over security.