45
Indian Govt Bans Apps Being Misused to Stop E-Rickshaws Remotely (cybersecuritynews.com)
submitted 4 months ago by to c/cybersecurity@sh.itjust.works
13 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 22 points 4 months ago* (10 children)

My house batteries for my PV system are also susceptible to this. Ugh.

They've both got Bluetooth for monitoring and configuration. Some config changes require a PIN but not the settings to enable/disable charge and discharge. Someone could just get within range of them, install the official app, and set discharge to "off" and shut down my house.

I've also not found a way to disable bluetooth on them. Gonna have to put them in a damn Faraday cage if I decide to worry about that possibility. :sigh:

  • permalink
  • fedilink
  • source
  • hideshow 10 child comments
    •
  • [–] 6 points 4 months ago (2 children)

    That really sucks. My Solar system from my previous home used zigbee instead of bluetooth, but it was pretty much only for monitoring. I was glad that they failed to lock it down as getting access to that was the only way I could get to see interesting data, the company refused to let owners have access to their own data.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 4 months ago (1 child)

    I've never before appreciated enough that the shitty bluetooth emitter of my system has such short range that I have to lay my phone on top of it in order to work

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 4 months ago

    Yeah. These are pretty short range and my house (block construction + metal roof) blocks the signals pretty well. Batteries are installed in the basement, and even upstairs I struggle to keep a signal, especially with a crowded 2.4 GHz wifi with all my smart bulbs, etc.

    Someone would have to be right at my doorstep to pull this off unless they hook up a directional antenna and point it right at them. Still, would be nice if I could just turn off Bluetooth since I can just use a wired serial connection. At least the inverter has an external Wifi/BT module I can just choose not to connect (it also has a serial connection for monitoring/config).

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 4 months ago (1 child)

    There is a Bluetooth chip somewhere that is connected somehow. Assuming you can somehow get to it without destroying the battery, disconnecting it shouldn't be difficult.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 4 months ago*

    I thought about that, but one of the safety features of these batteries is an active fire suppression system that fills the interior with some kind of fire-extinguishing foam. I'm terrified to try to take these apart for fear of somehow triggering that. Plus, they're hella expensive lol.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 4 months ago (2 children)

    Wait, mine requires I scan a QR code physically on the device, or typing in the serial number. You can just... connect without any security?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •