Slashdot Mirror
Xiaomi's Popular Electric Scooter M365 Can Be Hacked To Speed Up or Stop (wired.com)
The fleets of electric scooters that have inundated cities are alarming enough as is. Now add cybersercurity concerns to the list: Researchers from the mobile security firm Zimperium are warning that Xiaomi's popular M365 scooter model has a worrying bug. From a report: The flaw could allow an attacker to remotely take over any of the scooters to control crucial things like, ahem, acceleration and braking. Rani Idan, Zimperium's director of software research, says he found and was able to exploit the flaw within hours of assessing the M365's security. His analysis found that the scooters contain three software components: battery management, firmware that coordinates between hardware and software, and a Bluetooth module that lets users communicate with their scooter via a smartphone app. The latter leaves the devices woefully exposed.
Idan quickly found that he could connect to the scooter via Bluetooth without being asked to enter a password or otherwise authenticate. From there, he could go a step further and install firmware on the scooter without the system checking that this new software was an official, trusted Xiaomi update. This means that an attacker could easily put malware on a scooter, giving herself full command over it. "I was able to control any of the scooter features without authentication and install malicious firmware," Idan says. "An attacker could brake suddenly, or accelerate a person into traffic, or whatever the worst case scenario you can imagine."
Idan quickly found that he could connect to the scooter via Bluetooth without being asked to enter a password or otherwise authenticate. From there, he could go a step further and install firmware on the scooter without the system checking that this new software was an official, trusted Xiaomi update. This means that an attacker could easily put malware on a scooter, giving herself full command over it. "I was able to control any of the scooter features without authentication and install malicious firmware," Idan says. "An attacker could brake suddenly, or accelerate a person into traffic, or whatever the worst case scenario you can imagine."
Why the fuck does a scooter need Bluetooth, how about a string of LEDs to let you know charge status and battery life like by DeWalt drill, you don't need any of this crap, just because a Bluetooth module costs 10 cents doesn't mean it should be included.
You know, I wish people would figure out this one simple fact ... if it's consumer electronics, and it involves an app, the app is going to be a steaming pile of shit which will spy on you, have piss poor security, or both.
It will have been rushed out the door by greedy sacks of shit, little or no effort for even basic security will have been done, and it is likely designed to collect and monetize your data.
I'm so fucking tired of this endless parade of stories about shit apps -- yes, we know, they're made by incompetent morons and pushed out the door by greedy motherfuckers.
I refuse to buy products which are connected, because you are 100% guaranteed of them being poorly designed.
I simply no longer have the ability to feel sorry for people who are buying this shit.
Until companies have very severe legal liability for the quality of their apps and security, you pretty much have to assume you're not getting either of those things.
watson shorting out? will the real tesla (aka 'sparky') please turn over some leaves & stuff? no matter, good sports with good spirits prevail? 99.9*% guaranteed? see you there
# git diff --cached
# git commit -m "fixed security"
# git push
"Everybody's naked underneath" -- The Doctor
Joker Approved!
So why would the attacker be giving herself access to the firmware? Come on and stop the PC crap!
https://southpark.fandom.com/w...
#DeleteFacebook
You can use their app to have a speedometer and odometer. It also lets you lock it, and get exact battery details.
How exactly do you SAFELY use a speedometer on your phone while riding the scooter? It sounds like this sort of thing has more than just cyber-safety issues. All of these functions could be replaced by a simple LCD display for minimal cost and far safer functionality.
This is why companies need strict legal liability for security.
So Xiaomi were stupid, lazy, and incompetent .. they farmed out the work to someone who was also stupid, lazy, and incompetent .. and now they are shipping a piece of shit technology which is so utterly broken in terms of security it's pathetic.
Sadly, this is exactly what I've come to expect of any piece of connected technology ... complete indifference to anything resembling security.
If you're a company who sells connected products, you should be aware of just how stupid and incompetent you are at it. If you are someone who makes the apps for connected products, you should do the world a favor and go kill yourself.
This is why I refuse to buy anything which thinks it's a "smart" device ... because you can rest assured the company selling it are totally un-qualified to have not put out a shitty product.
Pretty much when this shit needs to be so that if your product has a security/privacy issue, you are legally required to fix it ... and failure to do so means you have to refund the customer's money with additional damages.
Fuck your connected product, and fuck your apps. Both of them have turned people into bigger idiots.
Actually, I kind of like the idea...
So I’ll write an app that will apply the brakes and slow any scooter within Bluetooth range to 5 MPH. No more worries about getting hit by some idiot on a scooter.
Now if I could do the same thing to e-bikes and cars, we’d have a winner!
"An attacker could brake suddenly, or accelerate a person into traffic, or whatever the worst case scenario you can imagine."
Like a government official bans them in the name of safety, but really doing so at the behest of car companies or the bus drivers' union?
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
>> communicate with the product via a smartphone app
Yeah, no, fuck shit that uses this sentence.
Don't AKSHUALLY with exceptions that leave the rule standing.
"An attacker could brake suddenly, or accelerate a person into traffic, or whatever the worst case scenario you can imagine."
I don't know, I can imagine some pretty amazing sequences of events that would be best described as "Rube Goldberg Final Destination directed by Michael Bay" but I'd be willing to bet that in reality "accelerate a person into traffic" is as bad as it'd ever get, and even that would assume the person somehow never thought to let go of the scooter. Everything else that's actually likely basically amounts to "make scooter rider fall down".
I used to get high on life, but I developed a tolerance. Now I need something stronger.
".. or whatever the worst case scenario you can imagine."
Well - I know a challenge when I see it!
So, What would that be? .. Driving over a box filled with kittens in front of a class of little kids?
Maybe
If the bluetooth hack let them control the steering as well. :^)E
- I was a perfectionist; now I'm much better - I'll compromise.