Hacking e-rickshaw battery remotely: Ongoing attack on BMS of ~2 million electric vehicles. 🛺🔋😈🪫🆘
A group of security researchers led by Santhosh Kumar and Kiran Singh published a technical advisory about an attack on commercial three-wheelers (e-rickshaws) that was recently spotted in the wild in India, targeting BMSs from JBD/Jiabaida.
The BMS, or Battery Management System, is the component that manages the battery in electric vehicles. According to the research, JBD BMSs do not have proper authentication for diagnostic or management connections to the battery.
How the attack works:
1️⃣ Within seconds, the attacker pairs with the BMS of a nearby e-rickshaw.
2️⃣ Using a diagnostic app, she disables battery discharge and stops the vehicle remotely.
The attack is already being actively used. The authors mention several viral videos of e-rickshaws losing power in traffic or in the middle of the road.
An interesting finding and technical analysis, with a good, detailed report and a workaround for those affected.
More details:
Unauthorized Over-the-Air Disruption of EV Battery Management Systems (BMS) via Unauthenticated Bluetooth Low Energy (BLE) Controls [PDF]: https://tracexlabs.com/reports/bms-security-advisory-immediate-mitigation-for-ev-vehicles.pdf
