Incident: Electric Scooter Vulnerability Allows Remote Control by Hackers

Published Date: 2019-02-12

Postmortem Analysis
Timeline 1. The software failure incident involving the Xiaomi M365 electric scooter happened in February 2019. [81152, 81115]
System 1. Xiaomi M365 electric scooter's password authentication process via Bluetooth communications [81152, 81115] 2. Bluetooth module in Xiaomi M365 scooter that allows communication with the smartphone app without proper authentication [81115]
Responsible Organization 1. Security research group Zimperium [Article 81152, Article 81115] 2. Xiaomi, the manufacturer of the electric scooter [Article 81152, Article 81115]
Impacted Organization 1. Users of Xiaomi M365 electric scooters [81152, 81115] 2. Rental companies utilizing Xiaomi M365 scooters [81152] 3. Security and safety of individuals riding Xiaomi M365 scooters [81152, 81115]
Software Causes 1. The software cause of the failure incident was a flaw in the Xiaomi M365 electric scooter's password authentication process, allowing a hacker to take full remote control over the vehicle without proper authentication [81152, 81115]. 2. The flaw was related to the Bluetooth communication used for authentication, where the password was not being used properly in the authentication process, enabling unauthorized access to scooter features and firmware updates [81152, 81115].
Non-software Causes 1. Lack of proper password authentication process in the Xiaomi M365 electric scooter, allowing hackers to take full remote control over the vehicle [81152, 81115]. 2. Third-party Bluetooth implementation module used by Xiaomi, which may have contributed to the vulnerability in the scooter [81115].
Impacts 1. The software failure incident involving the Xiaomi M365 electric scooter allowed hackers to take full remote control over the vehicle, including sudden acceleration or braking, due to a flaw in the scooter's password authentication process [81152, 81115]. 2. Researchers were able to interact with various features of the scooter, such as the anti-theft system, cruise control, and eco mode, without the required authentication, highlighting the severity of the vulnerability [81152]. 3. The flaw raised concerns about the safety of users and pedestrians as hackers could potentially endanger individuals by manipulating the scooter's functions remotely [81152, 81115]. 4. The incident also shed light on the broader issue of weak or missing authentication mechanisms in Internet-of-Things devices, emphasizing the importance of implementing robust security measures in such connected devices [81115]. 5. Xiaomi acknowledged the vulnerability and was working on a solution, including preparing an over-the-air update to address the security issue [81152]. 6. The incident highlighted the need for IoT companies and electronics manufacturers to prioritize security in their products to protect user data and ensure user safety [81115].
Preventions 1. Proper implementation of password authentication process with strong encryption and validation mechanisms could have prevented the software failure incident [81152, 81115]. 2. Regular security audits and testing of the scooter's software components, especially the Bluetooth module, could have identified and fixed the vulnerability before it was exploited [81115]. 3. Implementing integrity checks to confirm the authenticity and trustworthiness of software and firmware updates could have prevented unauthorized installations of malicious firmware [81115]. 4. Developing in-house Bluetooth implementation rather than relying on third-party developers for critical components could have provided better control over security measures and quicker response to vulnerabilities [81115].
Fixes 1. Implement a proper password authentication process for the Xiaomi M365 electric scooters to prevent unauthorized access and control [81152, 81115]. 2. Develop and deploy an over-the-air (OTA) update to fix the vulnerability in the Xiaomi M365 scooters [81152]. 3. Strengthen Bluetooth security measures in the scooters to prevent unauthorized connections and firmware updates [81115]. 4. Conduct regular security audits and testing on IoT devices like electric scooters to identify and address potential vulnerabilities [81115]. 5. Enhance communication and collaboration between third-party developers and manufacturers to address security issues promptly [81115].
References 1. Zimperium - The security research group Zimperium provided information about the flaw in the Xiaomi M365 electric scooter and conducted research on the vulnerability [Article 81152, Article 81115]. 2. Xiaomi - The company behind the Xiaomi M365 electric scooter, Xiaomi, acknowledged the flaw and mentioned they were working on a solution [Article 81152, Article 81115]. 3. Rani Idan - Rani Idan, the director of software research at Zimperium, discovered and exploited the flaw in the Xiaomi M365 scooter [Article 81115]. 4. John Michelsen - John Michelsen, the chief technology officer at Zimperium, commented on the urgency of the issue and the need for accountability in IoT companies [Article 81115].

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident having happened again at one_organization: Zimperium researchers found a similar set of flaws in Segway MiniPro hoverboards in 2017, which is owned by Chinese scooter-maker Ninebot [81115]. The flaw discovered in the Xiaomi M365 electric scooter is similar to the one found in the Segway hoverboard, where full remote access could be gained without the need for authentication [81152]. (b) The software failure incident having happened again at multiple_organization: There is no specific mention in the articles about the software failure incident happening again at multiple organizations.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the flaw discovered in the Xiaomi M365 electric scooter. The flaw allowed a hacker to take full remote control over the vehicle, including accelerating or braking the scooter, due to a vulnerability in the scooter's password authentication process done via Bluetooth communications [81152, 81115]. (b) The software failure incident related to the operation phase is highlighted by the fact that the flaw in the Xiaomi M365 scooters left them vulnerable to takeover attacks, where an attacker could control various scooter features without authentication and even install malicious firmware. This vulnerability in the operation of the scooters could potentially lead to dangerous situations, such as sudden braking or acceleration, endangering the users [81115].
Boundary (Internal/External) within_system (a) within_system: - The software failure incident involving the Xiaomi M365 electric scooter was due to a flaw in the scooter's password authentication process, which is done via Bluetooth communications [81152]. - Researchers from Zimperium found that the flaw allowed them to take full remote control over the scooter, including manipulating features like anti-theft system, cruise control, eco mode, and firmware updates without proper authentication [81152]. - The flaw was attributed to the improper use of the password as part of the authentication process within the scooter itself, leading to the vulnerability [81152]. - The issue with the Bluetooth module in the scooter allowed attackers to connect to the scooter without authentication and install malicious firmware, potentially endangering users by controlling acceleration and braking remotely [81115]. (b) outside_system: - The software failure incident was not explicitly linked to contributing factors originating from outside the system in the articles provided.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the Xiaomi M365 electric scooter was due to non-human actions. The flaw in the scooter's password authentication process, which allowed a hacker to take full remote control over the vehicle, was a result of the improper use of the password in the authentication process with the scooter itself. This flaw enabled commands to be executed without the password being validated on the scooter side, indicating a failure introduced without human participation [81152, 81115]. (b) On the other hand, the failure to address the vulnerability promptly and effectively by Xiaomi, as well as the lack of proper authentication mechanisms and oversight in the Bluetooth module of the scooter, can be attributed to human actions. The delay in fixing the flaw, the reliance on a third-party developer for the Bluetooth implementation, and the oversight in ensuring the authenticity and trustworthiness of software and firmware updates are examples of contributing factors introduced by human actions [81115].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The software failure incident involving the Xiaomi M365 electric scooter was due to a flaw in the scooter's Bluetooth module, which allowed hackers to take full remote control over the vehicle, including accelerating or braking it without authentication [81152, 81115]. - The flaw in the scooter's Bluetooth module exposed the device to takeover attacks, enabling attackers to install malicious firmware and control various scooter features without authentication [81115]. (b) The software failure incident related to software: - The software failure incident was primarily caused by a flaw in the scooter's software authentication process, which did not properly utilize the password for authentication, allowing all commands to be executed without the password [81152]. - The vulnerability in the scooter's software allowed researchers to interact with the device's anti-theft system, cruise control, eco mode, and update its firmware without the required authentication [81152]. - The flaw in the software authentication process was similar to a vulnerability discovered in a Segway hoverboard in 2017, where full remote access to the hoverboard was possible through Bluetooth updates without authentication [81152].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident related to the Xiaomi M365 electric scooter is malicious in nature. Security researchers from Zimperium discovered a flaw in the scooter's software that could allow a hacker to take full remote control over the vehicle, including causing sudden acceleration or braking without proper authentication [81152, 81115]. The flaw was exploited by the researchers to demonstrate the potential risks associated with the vulnerability, such as installing malicious firmware on the scooter to gain full command over it. This type of software vulnerability poses a serious threat to the safety of scooter riders as it could lead to dangerous situations, indicating a malicious intent behind the failure incident.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the Xiaomi M365 electric scooter was primarily due to poor decisions made in the design and implementation of the scooter's software security features. The flaw in the scooter's password authentication process, which allowed hackers to take full remote control over the vehicle, was a result of poor decisions in how the authentication was handled. The fact that the password was not properly used as part of the authentication process with the scooter, and that all commands could be executed without the password, highlights a significant flaw in the design ([81152], [81115]).
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in Article #81152 occurred due to development incompetence. The flaw in the Xiaomi M365 electric scooter was attributed to a password authentication process issue where the password was not being used properly for authentication, allowing hackers to take full remote control over the vehicle without the need for authentication [81152]. (b) The software failure incident in Article #81115 also involved accidental factors. The vulnerability in the Xiaomi M365 scooter was discovered by researchers from Zimperium, who found that the scooters contained a flaw in the Bluetooth module that allowed attackers to remotely take over the scooters without authentication. The flaw was exploited by the director of software research at Zimperium, Rani Idan, who was able to control the scooter features without authentication and install malicious firmware, potentially endangering users' physical safety [81115].
Duration permanent (a) The software failure incident related to the Xiaomi M365 electric scooter is considered permanent. The flaw in the scooter's software allowed a hacker to take full remote control over the vehicle, including causing sudden acceleration or braking, without the need for proper authentication [81152, 81115]. The flaw was attributed to the scooter's password authentication process not being implemented correctly, allowing all commands to be executed without the password [81152]. Researchers were able to interact with various features of the scooter and update its firmware without authentication [81152]. The issue was compared to a similar flaw found in a Segway hoverboard in 2017, where full remote access could be gained without authentication [81152]. Xiaomi acknowledged the vulnerability and was working on a solution, including preparing an over-the-air update to address the issue [81152]. The article also highlighted concerns about the potential risks to users and emphasized the importance of implementing stronger Bluetooth protections in IoT devices like the Xiaomi M365 scooter [81115].
Behaviour omission, other (a) crash: The software failure incident described in the articles does not involve a crash where the system loses state and does not perform any of its intended functions. (b) omission: The software failure incident falls under the category of omission. The flaw in the Xiaomi M365 electric scooter software allows a hacker to take full remote control over the vehicle, including causing the scooter to suddenly accelerate or brake. This omission occurs because the password authentication process is not properly implemented, allowing all commands to be executed without the password [81152, 81115]. (c) timing: The software failure incident is not related to timing issues where the system performs its intended functions but too late or too early. (d) value: The software failure incident is not related to value issues where the system performs its intended functions incorrectly. (e) byzantine: The software failure incident does not exhibit byzantine behavior with inconsistent responses and interactions. (f) other: The behavior of the software failure incident is related to a security vulnerability that allows unauthorized access and control over the scooter's features, such as acceleration and braking, due to a flaw in the authentication process [81152, 81115].

IoT System Layer

Layer Option Rationale
Perception network_communication, embedded_software (a) sensor: The software failure incident related to the Xiaomi M365 electric scooter was primarily due to a flaw in the scooter's password authentication process, which is done via Bluetooth communications. This flaw allowed hackers to take full remote control over the vehicle, including causing sudden acceleration or braking, without proper authentication [81152, 81115]. (b) actuator: The incident did not specifically mention any failure related to the actuator of the scooter. (c) processing_unit: The software failure incident did not directly involve any issues related to the processing unit of the scooter. (d) network_communication: The failure was related to network communication error as the flaw in the password authentication process was exploited through Bluetooth communications, allowing unauthorized access and control over the scooter [81152, 81115]. (e) embedded_software: The failure was also related to embedded software error as the flaw in the authentication process allowed hackers to interact with various features of the scooter, update its firmware, and disable anti-theft systems without proper authentication [81152, 81115].
Communication link_level [a81152, a81115] The software failure incident related to the Xiaomi M365 electric scooter was primarily related to the communication layer of the cyber-physical system. The flaw in the scooter's security was due to issues with the Bluetooth communication protocol, which allowed hackers to take full remote control over the vehicle without proper authentication. This vulnerability stemmed from weaknesses in the Bluetooth module that enabled communication between the scooter and the smartphone app, highlighting a failure at the link_level of the cyber-physical system. The lack of proper authentication mechanisms and the ability to install malicious firmware without verification contributed to the security breach, emphasizing the importance of secure communication protocols in such systems.
Application TRUE The software failure incident related to the Xiaomi M365 electric scooter was indeed related to the application layer of the cyber physical system. The flaw in the scooter's password authentication process, which allowed a hacker to take full remote control over the vehicle, was due to the application not properly using the password as part of the authentication process. This flaw enabled all commands to be executed without the password, as the scooter itself didn't keep track of the authentication state [81152, 81115]. This lack of proper authentication at the application layer contributed to the vulnerability that allowed unauthorized access and control over the scooter's features.

Other Details

Category Option Rationale
Consequence harm, property, non-human, theoretical_consequence, other (a) death: People lost their lives due to the software failure - There is no mention of any deaths resulting from the software failure incident reported in the articles [81152, 81115]. (b) harm: People were physically harmed due to the software failure - The software failure incident involving the Xiaomi M365 electric scooter could potentially lead to physical harm as a hacker could take full remote control over the vehicle, including causing sudden acceleration or braking, endangering riders [81152, 81115]. (c) basic: People's access to food or shelter was impacted because of the software failure - There is no mention of people's access to food or shelter being impacted by the software failure incident [81152, 81115]. (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incident could impact people's property as hackers could potentially take control of the scooters, affecting the physical safety of riders and potentially causing damage to the scooters themselves [81152, 81115]. (e) delay: People had to postpone an activity due to the software failure - There is no mention of people having to postpone activities due to the software failure incident [81152, 81115]. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incident directly impacted the Xiaomi M365 electric scooters, as hackers could take control of the scooters remotely, affecting their functionality and safety features [81152, 81115]. (g) no_consequence: There were no real observed consequences of the software failure - The software failure incident involving the Xiaomi M365 electric scooter did have observed consequences related to potential physical harm and security risks due to the flaw that allowed remote control by hackers [81152, 81115]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The articles discuss the potential consequences of the software failure incident, such as hackers being able to remotely control the scooters, including acceleration and braking, without authentication, which could lead to dangerous situations for riders [81152, 81115]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - The software failure incident could potentially lead to accidents, injuries, or even fatalities if a hacker were to exploit the flaw in the Xiaomi M365 electric scooters to cause sudden acceleration or braking without the rider's control [81152, 81115].
Domain transportation, health (a) The failed system was related to the transportation industry as it involved electric scooters used by scooter rental companies in various US cities [81152, 81115]. (j) The failed system also had implications for the health industry as the safety concerns surrounding the electric scooters could potentially endanger pedestrians and riders' physical safety [81152, 81115].

Sources

Back to List