A Car Hacking Village talk at DEF CON 34 will argue that the weakest link in EV charger security may be the compiler, not the code.
Researcher Kangwon Lee points to Pwn2Own Automotive 2026, where a competitor ran Doom on a supercharger after triggering an out-of-bounds write in firmware that came out of an unverified build chain. Lee connects the contest’s exploit classes to an upstream blind spot: the toolchains that compile automotive and EVSE firmware have never been checked against safety or security standards.
The talk maps which compilers are actually qualified, where the coverage gaps are, and why Rust’s memory safety guarantees matter less than they seem if the compiler itself is not verified. A memory-safe language still depends on the toolchain that turns source into firmware behaving as documented.
Lee closes with a practical trust chain for the security community: develop, compile, verify, review. Teams evaluating toolchain integrity should treat the compiler as part of the attack surface, not a neutral black box.
With EV charging infrastructure expanding rapidly and regulators pushing charger makers toward compliance regimes, the session makes the case that firmware supply chain assurance has to include the build tools themselves.
