Slash Boxes

SoylentNews is people

Submission Preview

Link to Story

Xiaomi E-Scooter remote hackable

Accepted submission by RandomFactor at 2019-02-12 18:00:56 from the just another vulnerable IoT device dept.

Xiaomi's popular M365 Folding Electric Scooter is remotely hackable via bluetooth [] according to security firm Zimperium.

due to improper validation of password at the scooter’s end, a remote attacker, up to 100 meters away, could send unauthenticated commands over Bluetooth to a targeted vehicle without requiring the user-defined password.

This allows an unauthenticated attacker nearby to

Locking Scooters—A sort of a denial-of-service attack, wherein an attacker can suddenly lock any M365 scooter in the middle of the traffic.
Deploying Malware—Since the app allows riders to upgrade scooter’s firmware remotely, an attacker can also push malicious firmware to take full control over the scooter.
Targeted Attack [Brake/Accelerate]—Remote attackers can even target an individual rider and cause the scooter to suddenly brake or accelerate.

A video is embedded showing a rider's scooter being disabled by a bystander.

Fortunately I still have my skateboard...and better health insurance than I used to.

Original Submission