E-Trojans: Ransomware, Tracking, DoS, and Data Leaks on the Xiaomi E-Scooter...
summary
Reverse-engineering of Xiaomi M365 and Mi3 internals uncovers four flaws that enable arbitrary code execution on the BMS and unsigned, unencrypted firmware updates; a modular low-cost toolkit binary-patches BMS firmware to disable battery safety thresholds and perform five attacks. Practical tests reach 4.9 V in 5 minutes causing 80°C, and degrade battery to 0.1 V in 3.5 hours on M365; proposed fixes (ECDSA signing, encrypted firmware, bus protections) are disclosed to Xiaomi.
AI-written summary · about
chapters (11)
- 0:00E-Trojans research intro
- 1:55Xiaomi e-scooter ecosystem
- 5:06Reverse engineering scooter
- 7:09Firmware vulnerabilities found
- 8:52Five E-Trojan attacks design
- 9:35Overvoltage battery attack
- 12:47Other attacks overview
- 13:51Experimental results
- 15:20Countermeasures and fixes
- 16:03Responsible disclosure
- 16:45Conclusion and Xiaomi response
related talks
52mIoT Hacking 101: Reverse Engineering The Xiaomi Ecosystem
42mBreakMi: Reversing, Exploiting & Fixing Fitness Tracking Ecosystems
40mUnlocking the Drive: Exploiting Tesla Model 3
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
36mPhysical Attacks Against Smartphones
40mHis Power Level is Over 9000! Vulnerabilities in Solar Panel Controllers
41mSecrets Of Simos18: REng The Secure Boot Mechanism Of An ECU
21mIndustrial IoT security issues and countermeasures