Slashdot Mirror
Xiaomi's Popular Electric Scooter M365 Can Be Hacked To Speed Up or Stop (wired.com)
The fleets of electric scooters that have inundated cities are alarming enough as is. Now add cybersercurity concerns to the list: Researchers from the mobile security firm Zimperium are warning that Xiaomi's popular M365 scooter model has a worrying bug. From a report: The flaw could allow an attacker to remotely take over any of the scooters to control crucial things like, ahem, acceleration and braking. Rani Idan, Zimperium's director of software research, says he found and was able to exploit the flaw within hours of assessing the M365's security. His analysis found that the scooters contain three software components: battery management, firmware that coordinates between hardware and software, and a Bluetooth module that lets users communicate with their scooter via a smartphone app. The latter leaves the devices woefully exposed.
Idan quickly found that he could connect to the scooter via Bluetooth without being asked to enter a password or otherwise authenticate. From there, he could go a step further and install firmware on the scooter without the system checking that this new software was an official, trusted Xiaomi update. This means that an attacker could easily put malware on a scooter, giving herself full command over it. "I was able to control any of the scooter features without authentication and install malicious firmware," Idan says. "An attacker could brake suddenly, or accelerate a person into traffic, or whatever the worst case scenario you can imagine."
Idan quickly found that he could connect to the scooter via Bluetooth without being asked to enter a password or otherwise authenticate. From there, he could go a step further and install firmware on the scooter without the system checking that this new software was an official, trusted Xiaomi update. This means that an attacker could easily put malware on a scooter, giving herself full command over it. "I was able to control any of the scooter features without authentication and install malicious firmware," Idan says. "An attacker could brake suddenly, or accelerate a person into traffic, or whatever the worst case scenario you can imagine."
You can use their app to have a speedometer and odometer. It also lets you lock it, and get exact battery details.
On a separate now, these are a bitch to upkeep - there is little to no repair documentation and you end up having to buy a lot of third party parts just to get them going for more than a month.
Why the fuck does a scooter need Bluetooth,
They needed a killer feature and the 'buttplug built into the seat' idea - a safety feature to keep you on the scooter - was determined to be too ahead of its time...
Sounds like any communicated data should be read-only. Reading out battery details is nice, but why is the brake not a mechanical feature? There should be a manual engine shut off button as a safety feature, but the ability to accelerate and brake are stupid things to have remotely. This is just a senseless attack vector waiting to be abused.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
# git diff --cached
# git commit -m "fixed security"
# git push
"Everybody's naked underneath" -- The Doctor
Lets you lock it? What use is that if anyone with a Bluetooth phone can come along and unlock it with zero validation?
Joker Approved!
https://southpark.fandom.com/w...
#DeleteFacebook
It blocks the hones thieves.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
You can use their app to have a speedometer and odometer. It also lets you lock it, and get exact battery details.
How exactly do you SAFELY use a speedometer on your phone while riding the scooter? It sounds like this sort of thing has more than just cyber-safety issues. All of these functions could be replaced by a simple LCD display for minimal cost and far safer functionality.
Actually, I kind of like the idea...
So I’ll write an app that will apply the brakes and slow any scooter within Bluetooth range to 5 MPH. No more worries about getting hit by some idiot on a scooter.
Now if I could do the same thing to e-bikes and cars, we’d have a winner!
"An attacker could brake suddenly, or accelerate a person into traffic, or whatever the worst case scenario you can imagine."
Like a government official bans them in the name of safety, but really doing so at the behest of car companies or the bus drivers' union?
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
"An attacker could brake suddenly, or accelerate a person into traffic, or whatever the worst case scenario you can imagine."
I don't know, I can imagine some pretty amazing sequences of events that would be best described as "Rube Goldberg Final Destination directed by Michael Bay" but I'd be willing to bet that in reality "accelerate a person into traffic" is as bad as it'd ever get, and even that would assume the person somehow never thought to let go of the scooter. Everything else that's actually likely basically amounts to "make scooter rider fall down".
I used to get high on life, but I developed a tolerance. Now I need something stronger.
Maybe Rani sometimes identifies as a woman? There's a lot of nonsense going on out there and it seems to be getting worse. Only total war and many deaths will solve the problem.
".. or whatever the worst case scenario you can imagine."
Well - I know a challenge when I see it!
So, What would that be? .. Driving over a box filled with kittens in front of a class of little kids?
Maybe
If the bluetooth hack let them control the steering as well. :^)E
- I was a perfectionist; now I'm much better - I'll compromise.