Ransomware, Tracking, DoS, and Data Leaks on Xiaomi Electric Scooters

Ransomware, Tracking, DoS, and Data Leaks on Xiaomi Electric Scooters

Speakers: Marco (Postdoc, KTH Royal Institute of Technology, Sweden) and Prof. Daniele Antonioli (Assistant Professor, EURECOM, France); co-authors Riccardo Cestaro, Eleonora Luzuk, and Marco Conti (University of Padua, Italy)

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=k-UsaSfndQQ

Reading Time: ~9 minutes

Type: Briefing

TL;DR

Researchers from EURECOM and KTH demonstrated five novel attacks on Xiaomi electric scooters (Mi 3 and M365 models) using a technique called eTrojans: by flashing unsigned, unencrypted firmware over Bluetooth Low Energy, an attacker can physically damage the scooter's lithium battery via dangerous overvoltage or undervoltage, deploy the world's first e-scooter ransomware, track users via internal hardware fingerprints, perform denial-of-service on internal UART communications, and leak hashed user passwords — all from wireless proximity using a laptop or a malicious app installed on the victim's phone.

Introduction

Electric scooters look like simple consumer devices, but internally they are complex embedded systems — a "smartphone on wheels," as the researchers described them — with multiple system-on-chips, proprietary wireless protocols, and cloud-connected companion apps. A compromise is not merely a software incident: an attacker who controls a scooter's battery management system can create conditions leading to lithium battery fires or explosions. That physical safety dimension elevates e-scooter security research well beyond the ordinary scope of consumer device hacking.

The eTrojans research project, led by Daniele Antonioli at EURECOM with contributions from researchers at KTH and the University of Padua, builds on an earlier project called eSpoofer — a 2023 study demonstrating authentication bypass against the same Xiaomi platform. Where eSpoofer established that an attacker could pair maliciously with a scooter and send unauthorized commands, eTrojans goes further: it delivers a malicious firmware payload to the scooter's battery management subsystem and uses that foothold to launch five distinct attacks. The toolkit and (partially redacted) firmware were released on GitHub on the day of the talk.

Architecture: A Three-Chip Attack Surface

▶ Watch: E-Scooter Internal Architecture (08:00)

The Xiaomi e-scooters targeted in this research share a three-subsystem architecture:

• BTS (Bluetooth subsystem): A Nordic nRF51 system-on-chip. This is the radio gateway — all wireless communication from the Mi Home app enters the scooter through BTS, which then routes messages internally via UART to other subsystems.
• DRV (Drive/motor subsystem): Manages the electric motor.
• BMS (Battery Management System): Consists of two chips — the battery controller (BCTRL), which manages charging behavior and can be updated over-the-air, and the battery monitor (BMON), an analog front-end that can be partially configured via the battery controller.

The attack chain exploits the fact that all three firmwares — BTS, DRV, and battery controller — can be updated over-the-air from the Mi Home app. The battery monitor, while not directly updatable, can have its protection registers written by the battery controller. This creates a path from a wireless Bluetooth payload to direct manipulation of battery voltage thresholds.

The research focused on two popular models: the Mi 3 (second generation, 2021) and the M365 (first generation, 2018), noting that vulnerabilities implicitly cover intermediate models (Pro, Pro 2, 1S, Essential) sharing the same chips.

Four Vulnerabilities Enabling the Attacks

▶ Watch: Vulnerability Summary and Attack Technique (12:01)

The research identified four critical vulnerabilities in the target scooters:

1. Unencrypted Bluetooth controller firmware: The BTS firmware can be extracted directly from the Mi Home app and from the chip's own memory, enabling full reverse engineering of the proprietary BLE protocol.
2. Unsigned Bluetooth controller firmware: There is no cryptographic signature verification on firmware updates delivered over BLE. An attacker who has reverse engineered the update protocol can flash arbitrary firmware to the BTS — and from there, distribute malicious firmware to the battery controller over the internal UART bus.
3. Unprotected UART communications: The internal bus connecting BTS, DRV, and BMS lacks encryption, integrity protection, and authentication. This enables an attacker who has compromised the BTS to spoof messages to or from other internal components.
4. No denial-of-service protection on UART: The internal communications are susceptible to flooding, allowing the firmware payload to disrupt normal operation of internal subsystems.

The attack technique is straightforward in principle: exploit the authentication bypass from eSpoofer to pair maliciously with the scooter, then deliver a malicious firmware update over BLE to the BTS, which forwards it to the battery controller over UART. With the battery controller firmware replaced, the attacker controls every protection register in the battery monitor.

Attack 1 and 2: Overvoltage Destruction and Undervoltage Ransomware

▶ Watch: Overvoltage Battery Destruction Attack (18:01)

Overvoltage Battery Destruction (OBD): Xiaomi's lithium battery cells operate between 3.6V (0% charge) and 4.2V (100% charge). Battery overvoltage — exceeding 4.2V — causes permanent cell damage, imbalanced cell voltages, overheating, and potential fire or explosion. The battery monitor's overvoltage threshold register normally enforces this limit.

The malicious battery controller firmware:

• Writes 0xFF to the overvoltage threshold register, raising it from 4.2V to the hardware maximum of 4.7V (critical overvoltage).
• Clears the overvoltage fault bit in the system status register, making the battery monitor appear normal.
• Sets the FET charger bit to force continued charging despite overvoltage conditions.
• Disables cell balancing (which would otherwise equalize cell voltages), allowing cells to become severely imbalanced.
• Reports normal voltage to the BTS — keeping the attack hidden from the rider's Mi Home app.

In lab tests, the researchers drove battery cells to 4.9V — nearly a full volt above the safe limit.

▶ Watch: Undervoltage Battery Ransomware (22:01)

Undervoltage Battery Ransomware (UBR): Undervoltage occurs when a cell drops below 3.6V. Deep discharge can cause polarity inversion — the reversal of a cell's positive and negative terminals — leading to fires, short circuits, and explosions. The malicious firmware:

• Writes 0x00 to the undervoltage threshold register, lowering it to 1.58V (the hardware minimum, well below safe operation).
• Clears the undervoltage fault bit.
• Sets the FET discharge bit, forcing continued discharge even when protective circuitry would normally halt it.
• Disables cell balancing.
• Reports normal voltage to the BTS and Mi Home app.

At the trigger condition (reaching critical undervoltage), the ransomware changes the scooter's BLE advertisement payload to include a short link pointing to a ransom payment app. That app informs the owner of the infection, explains that the battery is being continuously damaged, and demands payment in exchange for a recovery firmware that restores normal charging behavior. The researchers noted that the attack can also be deployed silently — without any ransom demand — as a covert battery destruction tool.

In lab tests on an M365, the battery was undervoltaged to 0V, completely draining it within 3.5 hours from 5% charge. Subsequent testing showed a 50% reduction in battery autonomy — permanent degradation.

Attacks 3–5: Tracking, DoS, and Data Leaks

▶ Watch: Additional Attacks Overview (16:01)

The paper details three additional attacks that the talk summarized:

Attack 3 — User Tracking via Internal Fingerprinting: Each scooter's hardware components have unique identifiers: a battery serial number and an electric motor serial number. By reading these from the internal UART bus, the malicious BTS firmware can construct a unique fingerprint and include it in the BLE advertisement. A network of passive BLE sniffers can then track the scooter — and by extension, its owner — across time and location, with no reliance on GPS or network connectivity.

Attack 4 — Internal Denial of Service: The UART bus connects BTS, DRV, and BMS without DoS protections. A malicious BTS firmware can flood the bus, disrupting normal communication between subsystems and rendering the scooter inoperable.

Attack 5 — Data Leakage: The malicious firmware can read and exfiltrate sensitive data, including the hashed password used to lock the scooter and private usage data such as odometer readings. These are leaked over BLE to an attacker within wireless range.

Reverse Engineering: Months of Work, One Open-Source Toolkit

▶ Watch: Reverse Engineering Methods and eTrojans Toolkit (28:02)

The research required months of static and dynamic reverse engineering. For the battery controller — an STM8 microcontroller, a relatively uncommon architecture — the team used Ghidra with a community STM8 plugin, manually setting memory addresses (RAM start/end, flash start/end) by cross-referencing hardware schematics to make the decompiled code readable. Dynamic analysis included live firmware debugging over STLink and real-time UART bus traffic monitoring.

The eTrojans toolkit, released open-source on GitHub, consists of three modules:

1. Binary firmware patcher: Allows users to patch existing firmware with individual malicious capability modules (disable overvoltage protection, disable undervoltage protection, disable charging cutoff, disable firmware update protection, disable load balancing, spoof voltage to BTS, change BLE advertisement, and others). Capabilities can be combined to build custom attack payloads. The overvoltage and undervoltage sections are redacted in the public release to prevent malware deployment.
2. Malicious battery controller firmware images: Pre-built firmware for the documented attacks, flashable via an included script. Overvoltage/undervoltage variants are redacted.
3. Ransom app and backend: A complete payment and messaging application used to demonstrate the UBR ransomware flow.

Responsible Disclosure and Xiaomi's Response

▶ Watch: Disclosure History and Countermeasures (34:04)

The disclosure process spanned years. The eSpoofer vulnerabilities were reported to Xiaomi via HackerOne in November 2021; Xiaomi stated they could not reproduce them. The first eTrojans disclosure in 2023 received the same response. A second disclosure round in 2025 resulted in Xiaomi acknowledging the findings, assigning a medium CVE, and awarding what the researchers described as the highest bug bounty of their careers.

Xiaomi's official statement for the talk noted that the Mi 3 and M365 models are at end-of-life and will not receive firmware updates, but stated that newer models incorporate enhanced security measures.

The researchers proposed four lightweight countermeasures aligned with cryptographic primitives Xiaomi already uses in other firmware components:

1. Encrypt the BTS firmware (preventing extraction and reverse engineering).
2. Sign the BTS and battery controller firmware with a digital signature (preventing unsigned firmware installation).
3. Protect UART communications with integrity and encryption using SCP03, a constrained secure bus protocol.
4. Add DoS protections to UART message handling.

Notable Quotes

"If you compromise an e-scooter, you can have some safety concerns like physical damage. You can maybe set the e-scooter on fire. So it is very important that e-scooters are properly protected against remote attackers and proximity-based attackers."

— Daniele Antonioli, ▶ 04:00

"This is the first, as far as we know, ransomware for electric scooter. This is the first attack that is using undervoltage as an attack technique."

— Daniele Antonioli, ▶ 16:01

"UBR is the first e-scooter ransomware which targets physically the battery. We do undervoltage to physically damage the battery. This is different than typical ransomware which targets the data, encrypts the data."

— Marco, ▶ 26:02

"We've also proven one time again that security through obscurity is bad and was not enough to stop us from discovering these attacks and vulnerabilities."

— Marco, ▶ 36:04

Key Takeaways

• Unsigned, unencrypted BLE firmware updates are the root exploit primitive: Without cryptographic signing or encryption on BTS and battery controller firmware, any attacker in Bluetooth proximity — or one who has installed a malicious app on the victim's phone — can flash arbitrary payloads into the scooter's embedded systems.
• The battery controller can write directly to battery monitor protection registers, enabling an attacker to override all hardware overvoltage (4.2V → 4.7V) and undervoltage (3.6V → 1.58V) thresholds while hiding the dangerous state from the rider's app.
• The Undervoltage Battery Ransomware (UBR) is the first ransomware targeting an e-scooter's physical battery: it silently drains cells to critical undervoltage, then reveals the infection via BLE advertisement changes, demanding payment to stop permanent battery destruction.
• Internal hardware serial numbers (battery, motor) serve as persistent tracking fingerprints that persist across BLE MAC address randomization, enabling location tracking via passive sniffer networks.
• The eTrojans toolkit, including a modular firmware patcher and ransom app backend, is publicly available on GitHub, with overvoltage/undervoltage sections redacted; the M365 and Mi 3 will not receive patches as they are end-of-life, making physical mitigations (avoiding rogue apps, restricting BLE pairing) the primary defenses for existing owners.

Slides: No slide PDF was available for this talk.