Stories
Slash Boxes
Comments

SoylentNews is people

Xiaomi E-Scooter Remotely Hackable

posted by martyb on Wednesday February 13 2019, @12:56PM   Printer-friendly
from the just-another-vulnerable-IoT-device dept.

RandomFactor writes:

Xiaomi's popular M365 Folding Electric Scooter is remotely hackable via bluetooth according to security firm Zimperium.

due to improper validation of password at the scooter's end, a remote attacker, up to 100 meters away, could send unauthenticated commands over Bluetooth to a targeted vehicle without requiring the user-defined password.

This allows an unauthenticated attacker nearby to

Locking Scooters—A sort of a denial-of-service attack, wherein an attacker can suddenly lock any M365 scooter in the middle of the traffic.
Deploying Malware—Since the app allows riders to upgrade scooter's firmware remotely, an attacker can also push malicious firmware to take full control over the scooter.
Targeted Attack [Brake/Accelerate]—Remote attackers can even target an individual rider and cause the scooter to suddenly brake or accelerate.

A video is embedded showing a rider's scooter being disabled by a bystander.

Fortunately I still have my skateboard...and better health insurance than I used to.

Original Submission

 
This discussion has been archived. No new comments can be posted.
Xiaomi E-Scooter Remotely Hackable | Log In/Create an Account | Top | 6 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 4, Interesting) by FatPhil on Wednesday February 13 2019, @01:13PM (3 children)

    by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Wednesday February 13 2019, @01:13PM (#800579) Homepage
    What I want is the for the hackers to spoof a scooter, such that you can exploit some sloppy decoding in the crappily-written phone app, and pwn the scooter-owners phone. Spoofed master taking over slave units is old hat, I want spoofed slaves taking over the master.
    --
    Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
    Starting Score:    1  point
    Moderation   +2  
       Interesting=2, Total=2
    Extra 'Interesting' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   4  

  • (Score: 0) by Anonymous Coward on Wednesday February 13 2019, @02:45PM (2 children)

    by Anonymous Coward on Wednesday February 13 2019, @02:45PM (#800597)

    'full control of the scooter'

    I for one, welcome our new AI scooter overlords. May they clog the traffic of others too lazy to pedal.

    • (Score: 0) by Anonymous Coward on Wednesday February 13 2019, @04:34PM (1 child)

      by Anonymous Coward on Wednesday February 13 2019, @04:34PM (#800624)

      I see those scooters being ditched all over the place. I welcome anyone to hack those pieces of shit and make them their own, instead of them being impounded by police (which is cheaper to recover than hiring people to collect them). There's cheap kits on ebay to do that.

      • (Score: 2) by bob_super on Wednesday February 13 2019, @06:21PM

        by bob_super (1357) on Wednesday February 13 2019, @06:21PM (#800680)

        If everybody who hates the scooters walks around with an app that disables them within bluetooth radius, it won't take long for them to vanish from the streets.