Security researchers discovered a worrying flaw in popular e-scooters that leaves them open to being remotely controlled by hackers.
Mobile security firm Zimperium has warned that a security vulnerability in Xiaomi's M365 scooter could let anyone savvy enough lock the device, hit the brakes and even cause the device to suddenly accelerate.
Zimperium said several popular ride-sharing services use M365 scooters, but it's unclear how many are currently in use in the U.S.
Scroll down for video
Zimperium has warned that a security vulnerability in Xiaomi's M365 scooter could let anyone savvy enough lock the device, hit the brakes and even cause the device to suddenly accelerate
Researchers from mobile security firm Zimperium discovered that a flaw in the scooter's Bluetooth-connected app allows hackers to remotely control Xiaomi M365 scooters.
Anyone savvy enough could control the scooter by connecting to it via Bluetooth, since it doesn't require password authentication.
From there, they can:
Carry out a Denial of Service attack - Lock any M365 scooter Deploy Malware - Install a new malicious firmware that can take full control over the scooter. Initiate a targeted Attack - Target an individual rider and cause the scooter to suddenly brake or accelerate.The flaw resides in the scooter's Bluetooth module, which lets users control the device remotely.
For example, using Bluetooth, customers can lock the scooter on the app handsfree.
Rani Idan, a security researcher at Zimperium, found that a hacker could easily connect to the scooter with Bluetooth and without having to enter a password.
'The password is only validated on the application side, but the scooter itself doesn’t keep track of the authentication state,' Idan said.
