Attackers could remotely hack and hijack Ninebot miniPRO hoverboard in just 20 seconds of continuous Bluetooth connection.
Do you have an hoverboard? This news will probably surprise you because according to the experts at security firm IOActive, your hoverboard could be hacked too.
The security researcher Thomas Kilbride from IOActive has found several critical vulnerabilities in Segway Ninebot miniPRO hoverboard. The vulnerabilities could be exploited by a remote attacker to take “full control” over the hoverboard within range-
The mobile app allows owners to perform a number of activities with their hoverboard such as adjust light colors, set anti-theft alarms, and even remotely control the movement of the Segway Ninebot miniPRO scooter.
“Using reverse engineering and protocol analysis techniques, I was able to determine that my Ninebot by Segway miniPRO (Ninebot purchased Segway Inc. in 2015) had several critical vulnerabilities that were wirelessly exploitable. These vulnerabilities could be used by an attacker to bypass safety systems designed by Ninebot, one of the only hoverboards approved for sale in many countries.” wrote Kilbride.
Kilbride told Forbes, that an attacker just needs 20 seconds of Bluetooth connection to hack the hoverboard remotely.
“Attacks could be carried out with just 20 seconds of continuous Bluetooth connection to a Segway hoverboard, said IOActive researcher Thomas Kilbride. “It may be sped up using other means,” he told Forbes. “It’s a little bit alarming.” Not only would it be possible to kill the motor mid-drive, but it’d be simple to steal a miniPRO too, as seen in his demonstration video below.”
Below the vulnerabilities discovered by the expert:
- Security PIN Bypass — Rider don’t need a PIN (Personal Identification Number) to establish a connection to the device. An attacker can use the modified version of the Nordic UART app to connect Segway Ninebot miniPRO via Bluetooth without providing the security PIN.
- Lack of encryption for the communications — The communication between the Ninebot App and the Hoverboard leverages an unencrypted channel, this means that attackers can perform man-in-the-middle attacks and inject malicious payloads.
- Lack of Firmware Integrity Verification — The hoverboard did not implement any integrity checks on firmware images before applying them.
- Leakage of GPS Location of Nearby Riders — The “Rider Nearby” GPS feature in Ninebot App which lets users locate other nearby miniPro riders in the real-time, exposes the hoverboard position through the phone’s GPS.
The flaws were fixed by Ninebot in April this year.
[adrotate banner=”9″]
(Security Affairs – Segway Ninebot miniPRO, hoverboard, hacking)
[adrotate banner=”13″]
