  We present a novel attack against the Combined Charging System, one of the
most widely used DC rapid charging technologies for electric vehicles (EVs).
Our attack, Brokenwire, interrupts necessary control communication between the
vehicle and charger, causing charging sessions to abort. The attack requires
only temporary physical proximity and can be conducted wirelessly from a
distance, allowing individual vehicles or entire fleets to be disrupted
stealthily and simultaneously. In addition, it can be mounted with
off-the-shelf radio hardware and minimal technical knowledge. By exploiting
CSMA/CA behavior, only a very weak signal needs to be induced into the victim
to disrupt communication - exceeding the effectiveness of broadband noise
jamming by three orders of magnitude. The exploited behavior is a required part
of the HomePlug Green PHY, DIN 70121 & ISO 15118 standards and all known
implementations exhibit it. We first study the attack in a controlled testbed
and then demonstrate it against eight vehicles and 20 chargers in real
deployments. We find the attack to be successful in the real world, at ranges
up to 47 m, for a power budget of less than 1 W. We further show that the
attack can work between the floors of a building (e.g., multi-story parking),
through perimeter fences, and from `drive-by' attacks. We present a heuristic
model to estimate the number of vehicles that can be attacked simultaneously
for a given output power. Brokenwire has immediate implications for a
substantial proportion of the around 12 million battery EVs on the roads
worldwide - and profound effects on the new wave of electrification for vehicle
fleets, both for private enterprise and crucial public services, as well as
electric buses, trucks and small ships. As such, we conducted a disclosure to
the industry and discussed a range of mitigation techniques that could be
deployed to limit the impact.
