HoneyEVSE: An Honeypot to emulate Electric Vehicle Supply Equipments

TL;DR

HoneyEVSE is a novel honeypot that emulates electric vehicle charging stations to study security threats and attract attacker interactions, aiding in the development of better security strategies for EV infrastructure.

Contribution

This paper introduces HoneyEVSE, the first high-fidelity honeypot for EVSE, capable of simulating the charging process and engaging attackers, filling a gap in cybersecurity research for EV infrastructure.

Findings

HoneyEVSE successfully evades Shodan honeyscore metrics.

It attracts a high number of interactions from potential attackers.

The honeypot remains operational and convincing over 30 days online.

Abstract

To fight climate change, new "green" technology are emerging, most of them using electricity as a power source. Among the solutions, Electric Vehicles (EVs) represent a central asset in the future transport system. EVs require a complex infrastructure to enable the so-called Vehicle-to-Grid (V2G) paradigm to manage the charging process between the smart grid and the EV. In this paradigm, the Electric Vehicle Supply Equipment (EVSE), or charging station, is the end device that authenticates the vehicle and delivers the power to charge it. However, since an EVSE is publicly exposed and connected to the Internet, recent works show how an attacker with physical tampering and remote access can target an EVSE, exposing the security of the entire infrastructure and the final user. For this reason, it is important to develop novel strategies to secure such infrastructures. In this paper we present HoneyEVSE, the first honeypot conceived to simulate an EVSE. HoneyEVSE can simulate with high fidelity the EV charging process and, at the same time, enables a user to interact with it through a dashboard. Furthermore, based on other charging columns exposed on the Internet, we emulate the login and device information pages to increase user engagement. We exposed HoneyEVSE for 30 days to the Internet to assess its capability and measured the interaction received with its Shodan Honeyscore. Results show that HoneyEVSE can successfully evade the Shodan honeyscore metric while attracting a high number of interactions on the exposed services.