Ransomware, Tracking, DoS, and Data Leaks on Xiaomi Electric Scooters

Overview: Marco and Professor Daniele Antonioli present a comprehensive hardware and wireless security evaluation of personal light electric vehicles, focusing on market-leading Xiaomi electric scooters (including the M365 and Mi 3). The researchers investigate the interconnected microcontroller architecture across the scooter's internal buses and Bluetooth Low Energy (BLE) gateway. Introducing the "e-Trojans" exploit suite, the speakers demonstrate how wireless proximity attackers or trojanized mobile companion apps can execute destructive over-voltage battery attacks and the first documented electric vehicle ransomware.

Key Topics: - Embedded microcontroller architecture and internal UART/I2C buses in e-scooters - Reverse engineering Xiaomi proprietary BLE communication protocols - Lack of digital signatures and encryption in over-the-air firmware update pipelines - Over-voltage battery destruction attack leading to thermal runaway risks - Under-voltage battery ransomware attack triggering persistent vehicle bricking

Technical Details: The researchers analyzed the internal hardware architecture of Xiaomi electric scooters, which comprise three main system-on-chips: the DRV (motor controller running on an STM32 MCU), the BTS (Bluetooth Low Energy subsystem near the handlebar running on a Nordic nRF51), and the BMS (Battery Management System in the chassis). The BMS contains two cooperating chips: the Battery Controller (BCTRL, an STMicroelectronics STM8 MCU) and the Battery Monitor (BMON, a Texas Instruments analog front-end). The BTS serves as the wireless bridge, receiving commands from the Mi Home mobile app and forwarding them to the DRV and BMS across an unauthenticated internal UART bus, while BCTRL communicates with BMON over an internal I2C bus.

Reverse engineering the proprietary BLE protocol and extracted firmware revealed four fundamental architectural vulnerabilities: unencrypted BCTRL firmware, complete absence of cryptographic digital signature verification on over-the-air (OTA) firmware updates, lack of authentication and encryption on internal UART communications, and susceptibility of internal buses to denial-of-service. Leveraging their prior *e-Spoofer* framework to bypass BLE authentication, the authors developed the *e-Trojans* attack toolkit. Attackers within wireless proximity—or remotely via a trojanized third-party scooter speed-modding app installed on the victim's phone—can flash rogue firmware directly onto the BCTRL microcontroller over BLE.

The authors weaponized rogue BCTRL firmware into two high-impact physical attacks. In the "over-voltage battery destruction attack," malicious BCTRL firmware manipulates BMON configuration registers over I2C, disabling hardware over-charge cutoffs during AC charging. This forces lithium-ion cells past their 4.2V safety threshold, risking permanent battery destruction, thermal runaway, and vehicle fires. In the "under-voltage battery ransomware attack," the rogue firmware reprograms BMON safety cutoff registers to report artificially depleted cell voltages, triggering permanent BMS safety lockouts. The scooter is rendered completely unusable until the victim flashes an attacker-supplied decryption key or unlock payload.

Key Takeaways: Manufacturers of micro-mobility and embedded IoT systems must implement hardware-enforced secure boot and mandatory asymmetric digital signature verification across all microcontroller firmware update pipelines. Bluetooth Low Energy companion interfaces must enforce mutual cryptographic authentication and encrypted sessions to prevent rogue command dispatch. Battery management systems must incorporate hardwired, immutable analog over-voltage and thermal cutoffs that cannot be overridden or reconfigured by software commands or I2C register manipulation.

(AI summary — Gemini Flash)