Another reason to hate scooters

https://blog.zimperium.com/dont-give-me-a-brake-xiaomi-scooter-hack-enables-dangerous-accelerations-and-stops-for-unsuspecting-riders/

Don’t Give Me a Brake – Xiaomi Scooter Hack Enables Dangerous Accelerations and Stops for Unsuspecting Riders

"The rise of IoT devices brings with it a world of new opportunities and convenience, and unfortunately, serious risk. These risks can be found in your smart home, network devices, and even right under your feet – electric scooters, the new urban way to commute all over the world.

This is why Zimperium takes IoT security seriously, and why we are working closely with vendors and manufacturers alike to increase security on IoT.

As part of our IoT research in Zimperium’s zLabs team, we looked at the Xiaomi M365 electric scooter and put it under our scope.

Xiaomi’s scooter has a significant market share and is being used by different brands with some modifications. Bluetooth communication is utilized to manage the scooter.

The Bluetooth access allows the user to interact with the scooter for multiple features such as an Anti-Theft System, Cruise-Control, Eco Mode and updating the scooter’s firmware. To access those features the user can use a dedicated app, and every scooter is protected by a password that can be changed by the user.

During our research, we determined the password is not being used properly as part of the authentication process with the scooter and that all commands can be executed without the password. The password is only validated on the application side, but the scooter itself doesn’t keep track of the authentication state.

Therefore, we can use all of these features without the need for authentication.

In the video below, we demonstrate a PoC locking the scooter using our malicious application that scans for nearby Xiaomi M365 scooters and disables them by using the anti-theft feature of the scooter – – without authentication or the user consent.

The app sends a crafted payload using the correct byte sequence to issue a command that will lock any nearby scooter in the distance of up to 100 meters away."