Xiaomi Electric Scooters Vulnerable to Life-Threatening Remote Hacks

If you are an electric scooter rider, you should be concerned
about yourself.

In a report shared with The Hacker News in advance, researchers
from mobile security firm Zimperium said to have discovered an
easy-to-execute but serious vulnerability in M365 Folding
Electric Scooter by Xiaomi that could potentially putting
riders life at risk.

Xiaomi e-Scooter has a significant market share and is also being
used by different brands with some modifications.

Xiaomi M365 Electric Scooter comes with a mobile app that
utilizes password-protected Bluetooth communication, allowing its
riders to securely interact with their scooters remotely for
multiple features like changing password, enabling the anti-theft
system, cruise-control, eco mode, updating the scooter’s firmware,
and viewing other real-time riding statistics.

However, researchers find that due to improper validation of
password at the scooter’s end, a remote attacker, up to 100 meters
away, could send unauthenticated commands over Bluetooth to a
targeted vehicle without requiring the user-defined
password.

• Locking Scooters—A sort of a denial-of-service attack,
  wherein an attacker can suddenly lock any M365 scooter in the
  middle of the traffic.
• Deploying Malware—Since the app allows riders to upgrade
  scooter’s firmware remotely, an attacker can also push malicious
  firmware to take full control over the scooter.
• Targeted Attack [Brake/Accelerate]—Remote attackers can
  even target an individual rider and cause the scooter to suddenly
  brake or accelerate.

To demonstrate one of the attack scenarios, as shown in the video,
researchers developed a specialized proof-of-concept (PoC) app that scans
for nearby Xiaomi M365 scooters and locks them by using the
anti-theft feature of the scooter, without authentication or
victim’s knowledge.
“The app sends a crafted payload using the correct byte sequence to
issue a command that will lock any nearby scooter in the distance
of up to 100 meters away,” the researchers say.

The researchers also developed a PoC app for installing
malicious firmware capable of accelerating the scooter, but due to
the safety concerns of the M365 Electric scooter riders, they will
not publish its PoC.

Zimperium already reported their findings to Xiaomi two weeks
ago. The Chinese company acknowledged them, saying that its team
was aware of the issue and is working on a fix to address it.

Since there is no mitigation that users can deploy at their end,
M365 Electric scooter riders are recommended to implement the
patches as soon as they become available. Until then, they can not
do anything except avoid riding their scooters for a while.

^[2]