Skip to content
Free lab · no signup · Vehicles & EV log triage

Connected Vehicle & EV Charging Log Triage

You are watching the vehicle security operations centre for a fictional carmaker and its EV charging network. The stream mixes OTA updates, CAN gateway alerts, app commands, dealer diagnostics, OCPP chargers and the fleet portal. Most of it is routine; flag the logs that hide an attack and say which fields give it away.

Tiers
Trainee · Analyst · Lead
Logs per shift
400–1000
Attack types
6
Mapped to
MITRE ATT&CK Enterprise

Your journey → certificate

BronzeSilverGold

Loading your progress…

All log triage tracks and the capstone · practice certificates, not accredited credentials.

1 in 5 logs hides an attack. 400 logs in the practice set.
10 logs ≈ 3 minutes → a graded shift scorecard you can share.

How to play: a 20-second start

  1. Pick a log in the inbox. Most are normal operations; a few are attacks.
  2. In the detail pane, click any field value that looks wrong.
  3. Hit Check: green = a real flag caught, amber = a flag missed, red = false alarm, each with a “why”.
  4. Stuck? Press Reveal to learn the answer (not scored). Use End shift for your report.
0Reviewedof 400
0Signals caught
0Missed
0False alarms
0%Recallof red flags
0Streak
0/10 logs to your shift scorecard
Inbox400 logs
Telematics UnitinfoL100143 · 23:56:59 UTC

TCU attach — PCXED6D2740D45DE1

PCXED6D2740D45DE1

Click any field value you think is a red flag (or press 1–9), then Check.

0/10 logs to your shift scorecard

How scoring works

Your shift score (0–100) is 60% red-flag recall (the suspicious fields you caught) plus 40% flag precision (how many of your flags were real). Only logs you check without pressing Reveal count. Check 10 logs, at least one of them an attack, and you get a graded scorecard with a share link. The score is recomputed on the server from the same deterministic log set, so a saved card always matches what you flagged. The daily shift is the same set for everyone that UTC day. Every log is synthetic: no real devices, people or networks.

Attack types in this track

OTA & Supply Chain Tampering

Update packages with the wrong signer, failed verification, or download URLs that are not the official OTA host.

  1. Pause the affected rollout and block the bad package hash and host.
  2. Identify every vehicle that downloaded or installed it.
  3. Audit the signing keys and release pipeline for leaks or bypass flags.

Firmware & Boot Tampering

Secure-boot failures, custom firmware strings, downgrades with anti-rollback disabled, and unsigned charger firmware.

  1. Quarantine the unit (restrict its connectivity) and keep the boot and update logs.
  2. Compare the running image against the signed release.
  3. Re-flash from a trusted image and find how the change was delivered.

In-Vehicle & TCU Intrusion

Diagnostic traffic at speed, ECUs transmitting IDs they do not own, brute-forced SecurityAccess, or open shells on the TCU.

  1. Switch the gateway rule from monitor to block for the offending traffic.
  2. Contact the owner and check the OBD port and recent workshop visits.
  3. Pull the gateway and TCU logs and check other vehicles for the same signature.

Remote API & Data Abuse

One token commanding many vehicles, or bulk location data leaving by API.

  1. Revoke the token or API key and rate-limit the endpoint.
  2. Fix the authorisation check so a token can only act on vehicles it owns.
  3. Work out which vehicles were commanded or tracked and notify those owners.

Account & Credential Abuse

Credential stuffing, new digital keys from unexpected places, cloned RFID cards and fleet-admin sign-ins from new countries.

  1. Lock the affected accounts, revoke sessions, digital keys and API keys.
  2. Force a password reset and move admins to phishing-resistant MFA.
  3. Review what each account did since the suspicious event.

Charging Infrastructure Attacks

Chargers re-pointed at unknown backends, exposed admin pages with default credentials, and message floods against the backend.

  1. Take the affected charge points offline or force them back to the official CSMS.
  2. Rotate their credentials and enforce TLS (security profile 2 or 3).
  3. Check billing and meter data for manipulation during the exposure.

FAQ

Are these real vehicles or chargers?

No. PCX Motors, the VINs, the dealers, the chargers and every account are invented. All logs are generated from a fixed seed for training only.

Why is a failed OTA signature check sometimes normal?

A truncated download over a weak cellular link fails the hash check and is retried. That is the control working. It is suspicious when the signer is wrong, the URL is not the official host, or the vehicle installs the package despite the failure.

When are diagnostic frames on the CAN bus expected?

In a workshop: vehicle parked, a certified dealer tool connected and a work order open. Diagnostic requests while driving, or from an uncertified tool guessing SecurityAccess keys, are red flags.

What is OCPP?

The Open Charge Point Protocol is how EV chargers talk to their backend (the CSMS). It carries boot, status, charging-session and firmware-update messages. Security profile 0 means no TLS and no authentication.

Why MITRE ATT&CK Enterprise for cars?

Most connected-vehicle attacks go through cloud APIs, accounts, update pipelines and Linux-based telematics units, which Enterprise techniques describe well. Some in-vehicle steps map only approximately, such as Hardware Additions for a device plugged into the OBD port.

More security tools

The tools people use most on PlayCISO.

All tools
Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.

🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. See the deal