[Daljeet Nandha] from [RoboCoffee] writes to us, sharing his research on cryptographic signature-based firmware authenticity checks recently added to the Xiaomi Mi scooter firmware. Those scooters use an OTA firmware update mechanism over BLE, so you can update your scooter using nothing but a smartphone app – great because you can easily get all the good new features, but suboptimal because you can easily get all the bad new features. As an owner of a Mi 1S scooter but a hacker first and foremost, [Daljeet] set up a HTTPS proxy and captured the firmware files that the app downloaded from Xiaomi servers, dug into them, and summarized what he found.
Unlike many of the security measures we’ve seen lacking-by-design, this one secures the OTA firmware updates with what we would consider the industry standard – SHA256 hash with elliptic cryptography-backed signing. As soon as the first firmware version implementing signature checks is flashed into your scooter, it won’t accept anything except further firmware binaries that come with Xiaomi’s digital signature. Unless a flaw is found in the signature checking implementation, the “flash a custom firmware with a smartphone app” route no longer seems to be a viable pathway for modding your scooter in ways Xiaomi doesn’t approve of.
Having disassembled the code currently available, [Daljeet] tells us about all of this – and more. In his extensive writeup, he shares scripts he used on his exploration journey, so that any sufficiently motivated hacker can follow in his footsteps, and we highly recommend you take a look at everything he’s shared. He also gives further insights, explaining some constraints of the OTA update process and pointing out a few security-related assumptions made by Xiaomi, worth checking for bypassing the security implemented. Then, he points out the firmware filenames hinting that, in the future, the ESC (Electronic Speed Control, responsible for driving the motors) board firmware might be encrypted with the same kind of elliptic curve cryptography, and finds a few update hooks in the decompiled code that could enable exactly that in future firmware releases.
One could argue that these scooters are typically modified to remove speed limits, installed there because of legal limitations in a variety of countries. However, the legal speed limits are more nuanced than a hard upper boundary, and if the hardware is capable of doing 35km/h, you shouldn’t be at mercy of Xiaomi to be able to use your scooter to its full extent where considerate. It would be fair to assert, however, that Xiaomi did this because they don’t want to have their reputation be anywhere near “maker of scooters that people can modify to break laws with”, and therefore we can’t expect them to be forthcoming.
Furthermore, of course, this heavily limits reuse and meaningful modification of the hardware we own. If you want to bring a retired pay-to-ride scooter back to usefulness, add Bluetooth, or even rebuild the scooter from the ground up, you should be able to do that. So, how do we go around such restrictions? Taking the lid off and figuring out a way to reflash the firmware through SWD using something like a Pi Pico, perhaps? We can’t wait to see what hackers figure out.
Considering these scooters are usually parked (and locked) in public places, a secure firmware update process helps prevent someone from bricking or otherwise changing the operational characteristics of your scooter.
If you want to bring back to life a former rental scooter, I’m sure once they become widely available on the market, folks will develop a suitable control board to swap in for the original.
Is er ieland die weet hoe dit op te lossen mijn scooter geeft niks anders dan foutmeldingen en wil zelfs niet uit gaan
Signing also prevents any bad actor from doing an man in the middle attack. So I think it’s actually a good move to have over-the-air updates signed.
That’s the same problem with every device with OTA updates. Even if a manufacturer was allowing its users to put any firmware they want, how to block external bad actors from doing an update while still allowing legitimate users to do it ? They can’t even assume that only legitimate users have physical access to the device. I think the solution would be a key provided with the device, but not on the device, like a key provided at first launch or on a piece of paper for example. Yet this strategy assumes that device security matters to manufacturers, and that they have no financial interest in blocking software changes (as do all manufacturers who lock features in software)
I suppose you could pair it to somebody’s phone, then let them upload through an app whatever they wish.
Unpairing if you loose your phone is tricky though. you want some kind of reset procedure that should be long and onerous. Maybe you can only re-pair after starting the process and waiting a week? Uploading firmware isn’t something that needs to be done often.
Think this is the link that the article should point to: https://robocoffee.de/?p=193
I uh.. yes? it does? first link of the article. Is there anything wrong?
It’s literally the link in the very first sentence of the article.
For something like a scooter why hack the firmware authentication at all, one can just swap out the garbage locked smart boards for our own alternative without DRM infection. If you’re hacking a scooter all you want to keep is the mechanical bits and the low level (analogue, digital, i2c, spi…) electronics, no need to load alternative firmware to make use of these lower levels with your own replacement higher level.
All it takes is Xiaomi and others to take this as a step towards “the bus-enabled” scooter and there’s some bastardized CAN bus instead between the ESC, the handlebar board, and the motors, or they embed controllers into the motors and make them “smart” and you need encrypted comms to the motor to spin the wheels.
Then even defeating the boards won’t happen because you’d have to replace the motors at that point…
Nah, you can replace the ESC boards too.
There’s a much, much simpler solution: ditch the electronics and their nasty DRM-laden firmware. Clone the hardware instead.
When Bird scooters were frequently impounded and resold by city governments, conversion kits appeared that included a compatible replacement board with replacement firmware for like $30. Then you don’t need to tango with the firmware signature cryptography, or any potential lawsuit over “defeat of anti-circumvention devices” protecting the firmware.
Indeed, Bird tried to use that argument against Cory Doctorow to suppress an article he wrote, and all they got for thier trouble was the backhand from the EFF.
https://techcrunch.com/2019/01/11/scooter-startup-bird-silence-journalist/
Which chip is it?
This feels like a typically American problem. Not so much that Xiaomi is trying to steal our freedumbs, but that they’re (rightly) concerned that a “clever” hacker-type mods their ride, crashes the bejeezuz (spelling?) out of it, and the family tries to sue Xiaomi into penury for debraining (<- innovative phrasing!) their lovely and innocent and now persistently vegetative baby/sibling/spouse/grandparent via a recklessly open, horrifically practically-self-modifying, rocket-speed fiery death-scooter.
[nb. My solicitor suggested that I not write this where Americans might see it, but relented after I threatened to update their scooter.]
Thank you: this made my morning so much better.
I think the problem is much simpler.
E.g. in Germany or France there is a speed limit on these scooters imposed by law and, more importantly, *only scooters which have a type approval are allowed to be sold and driven legally*. Which, at least in Germany, includes also mandatory liability insurance that you can’t get for non-approved scooter.
Part of that type approval is also the speed limit enforcement. So the manufacturer is simply doing their legal CYA here otherwise the approval could be revoked by the authorities and they would lose the market to competition.
It is very much the same thing as requiring that wifi firmware is not user modifiable or that consumer drones must include geofencing and what not to be legal for sale. Or how cars and motocycles are required to obtain such type approval (homologation) before being allowed to be sold.
This isn’t an American problem. I don’t think many areas in America have some of the asinine restrictions that some of the European and other countries have. Think its Germany, France, Australia are a few places where you can’t own one that goes over 20km/h. This requires the scooter makers to come out with custom SKUs of these scooter models that abide by the limit to legally sell them. My understanding is the UK allows the rental scooters that anyone can ride, but wont allow citizens to own their own personal scooters. I don’t even know how that is a thing? I would think a scooter owner would potentially be safer on it, have more experience on it, more likely to be carrying a helmet, and less likely to do stupid shit on them since their full purchase price of the scooter is on the line. Enforcing paying for damage on a rental is nearly impossible. All someone has to say is it was fine when I parked it. Not my problem someone came by later and vandalized it.
I know how it’s done in some of these scooters. They have specific serial number prefixes for scooters sold in these areas. Otherwise the “restricted” scooters are the same as they sell in other places like America. Same motor, same controller, same battery, same firmware. The firmware checks the serial number, if the prefix matches then the restrictions in the firmware area enabled. Thing is up until they started locking down and signing the firmware it was completely possible to use apps that connect to the scooter over BTLE and modify the serial number stored in the eeprom/flash and then remove the restriction.
I would like to know why everything needs a phone app for basic functionality, and yes updates. I can’t tell youhow many devices I have that I can’t even use because I don’t want to install the sketchy apps just to use a device. My Galaxy buds also force install galaxy wear on my every few days. They do a pop up though, so I can uninstall it when it gets installed
1. It’s a portable device – more portable than a laptop
2. Nearly every potential customer has one (or will buy one if they really want to use the “toy”)
3. The touch screen is a convenient control surface. This means they don’t need to make dedicated controls, so save cost
4. They can track the users
1. Spying on users
2. Cheaper than having a display
3. It simplifies planned obsolesence
4. Spying on users
I have not, and never will buy a product that requires an app for no legitimate reason. Cheap fpv drone: sure. Fitness tracker: OK I get that. Toaster: fuck right off.
Mini split heat pump. Sure, why not? Quite handy to be able to open the app and remotely turn the air conditioning on when you’re 50 miles from home so the house will be cool when you arrive.
You don’t really “need” it. Only if you want to update it or use some higher end features like battery statistic and such. Also some scooters use phones to lock/unlock them, for ex – which is, IMO, dumb.
OTOH, given the reality that many appliances today are mostly a load of software running on some semi-generic commodity hw and software has both bugs and security vulnerabilities, having to update it is a fact of life.
And for that you can either build in an update mechanism directly – which would mean connecting a scooter to the internet somehow + carrying around the hw required for that when riding even when not needed, or it would need a cable and a computer. Which is not always practical. Also a lot of people do have smartphones but perhaps not laptops and wifi available where the scooter is (garage, outside of the house somewhere, etc.)
From this point of view using a phone to manage the appliance is a better solution. That it has also benefits for the vendor (tracking, various subscription-only “features”, etc.) is a bonus.
Lets me honest. The only reason they’re doing this is to stifle modding, and to probably to protect anti-features in the future. Who’s trying to flash malicious firmware on peoples scooters? Just because its theoretically possible doesn’t mean it ever actually happens.
Okay, for me it is best practice to sign firmware, and encrypt update files and storage on OT devices. At least the parts containing IP relevant data/programs or e.g., some configuration data. It is one part in the scope of secure operation.
I do security testing for industrial devices and, if we find unencrypted storage, unsigned updates, e.t.c., this is a security finding. I know, for a scooter it seems not so relevant for you, but for the operating company e.g., if they make their business by lending them, or think of a corrupt PLC sitting in a substation switching on or of powerlines to your city, or your own PLC monitoring the heater of your jacuzzie, that does not stop heating because it was hacked.
It all has two sides, we, as hacker want to do things with this equipment, there are people who earn their money with these things – and there are bad people, who …. you can imagine.
Would flashing over ST-Link still work?
I think you can always erase a STM chip, as long as you can control the BOOT pins, so you might have to lift them from the board.
Otherwise, it should be fairly straightforward to replace the chip entirely, unless it’s a BGA or no-leads package, then it’s still possible but probably outside the capability of most hobbyists.
likely! i.e. check this out: https://github.com/Koxx3/SmartESC_STM32_v2 AFAIU it reflashes the original Xiaomi M365 ESC?
Well, if you don’t like the limitations of your scooter, or any device for that matter, then you are welcome to learn how to develop firmware for such applications and flash a new firmware yourself. That’s what I would do.
Usually you set fuses to only accept signed firmware the first time you install it. So that’s not really possible here.
Transportation may not be as rough as medical, but I can tell you in any safety-regulated environment being able to write off the risk of attacker modification as unlikely due to cryptography sure makes getting approved as little smoother.
Could be worse, e.g. the current onewheel debacle
https://www.reddit.com/r/onewheel/comments/tjc2ek/onewheel_uses_copyright_to_prevent_righttorepair/
I don’t know what is a recent state, but historically these scooters were so insecure you could push an update to it on a red light. Xiaomi has had moronic level of security, not even requirement to push a button to pair with the scooter. So some level of firmware security while leaving the debug port open for flashing is fine with me.
I don’t understand why there’s a push on the manufacturer to limit the speed of a scooter – there’s no such push for cars and motorbikes, you can buy a car and go as fast as the car can, it’s the users responsibility to obay the rules.