An Investigative Study on the Privacy Implications of Mobile E-scooter Rental Apps

Vinayaga-Sureshkanth, Nisha; Wijewickrama, Raveen; Maiti, Anindya; Jadliwala, Murtuza

doi:10.1145/3507657.3528551

Cited by 2 publications

(2 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Despite their associated security, privacy, and safety risks, no research work evaluated the security protocols used by Xiaomi to secure the interaction between its e-scooters and Mi Home. Instead, recent work focused on the privacy implications of e-scooter rental apps (including Xiaomi) [46] and on the security of Xiaomi's fitness tracking ecosystem [10]. In our work, we find that Xiaomi protocols can be exploited to (remotely) unlock and steal an e-scooter or permanently prevent its owner to manage it from Mi Home.…”

Section: Introductionmentioning

confidence: 81%

“…Public e-scooters from the Lime sharing company are weak to a man-in-the-middle attack that allows for arbitrarily swapping audio files [26]. N. Vinayaga-Sureshkanth et al [46] provide an extended evaluation of Android e-scooter rental applications. In particular, they investigate the user-related data collected and shared with third parties, which could monitor the users' schedules and visited locations.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

E-Spoofer: Attacking and Defending Xiaomi Electric Scooter Ecosystem

Casagrande

Cestaro

Losiouk

et al. 2023

Proceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks

View full text Add to dashboard Cite

Xiaomi is the market leader in the electric scooter (e-scooter) segment, with millions of active users. It provides several e-scooter models and Mi Home, a mobile application for Android and iOS to manage and control an e-scooter. Mi Home and the e-scooter interact via Bluetooth Low Energy (BLE). No prior research evaluated the security of this communication channel, as it employs security protocols proprietary to Xiaomi. Exploiting these protocols results in severe security, privacy, and safety issues, e.g., an attacker could steal an e-scooter or prevent the owner from controlling it. In this work, we fill this research gap by performing the first security evaluation on all proprietary wireless protocols deployed to Xiaomi e-scooters from 2016 to 2021. We identify and reverse-engineer four of them, each having ad-hoc Pairing and Session phases. We develop four attacks exploiting these protocols at the architectural level, and we call them Malicious Pairing (MP) and Session Downgrade (SD). Both attacks can be performed from proximity, if the attacker's machine is within BLE range of the target e-scooter, or remotely, via a malicious application co-located with Mi Home. An adversary can utilize MP and SD to steal a password-protected and software-locked e-scooter, or to prevent a victim from accessing it via Mi Home. We isolate six attack root causes, including the lack of authentication while pairing, and the improper enforcement of the e-scooter password. We open-source the E-Spoofer toolkit. Our toolkit automates the MP and SD attacks, and includes a reverseengineering module for future research. We empirically confirm the effectiveness of our attacks by exploiting three e-scooters (i.e., M365, Essential, and Mi 3), embedding five BLE subsystem boards and eight BLE firmware versions that support all four Xiaomi protocols. We design and evaluate two practical countermeasures that address our impactful attacks and their root causes, and we release them as part of E-Spoofer. We responsibly disclosed our findings to Xiaomi.

show abstract

Section: Introductionmentioning

confidence: 81%

Section: Related Workmentioning

confidence: 99%

E-Spoofer: Attacking and Defending Xiaomi Electric Scooter Ecosystem

Casagrande

Cestaro

Losiouk

et al. 2023

Proceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks

View full text Add to dashboard Cite

show abstract

E-scooter Sharing Platforms: Understanding Their Architecture and Cybersecurity Threats

Isik,

Tryfonas,

Oikonomou

2023

2023 IEEE 26th International Conference on Intelligent Transportation Systems (ITSC)

View full text Add to dashboard Cite

E-scooter sharing platforms (ESPs) offer fast, affordable and flexible urban mobility solutions, with numerous benefits such as reducing traffic congestion, air pollution and carbon emissions. However, the long-term sustainability of the platform could be challenged by the threats and risks it faces because these can negatively impact the system and its users. The potential consequences may include the abuse of system resources, manipulation, denial of service (DoS) or data loss. In addition, breaches of users' personal information endanger the reputation of companies and the privacy and security of users. This paper describes a typical ESP system architecture so as to provide a better understanding of the potential threats it faces. The paper also presents a categorization of the risks so as to provide solutions. Risks include data breaches, privacy violations, service disruptions, DoS attacks, firmware and software vulnerabilities, GPS spoofing and breaches of physical security, including theft and vandalism. The paper contributes to the progress and development of ESP and supports the development of effective strategies for its longterm sustainability and security.

show abstract

An Investigative Study on the Privacy Implications of Mobile E-scooter Rental Apps

Cited by 2 publications

References 47 publications

E-Spoofer: Attacking and Defending Xiaomi Electric Scooter Ecosystem

E-Spoofer: Attacking and Defending Xiaomi Electric Scooter Ecosystem

E-scooter Sharing Platforms: Understanding Their Architecture and Cybersecurity Threats

Contact Info

Product

Resources

About