A vulnerability in the Egret GT E-scooter’s display allowed it to accidentally enter firmware update mode and enabled operating mode without the security PIN. [I] reverse-engineered the protocol and rewrote the firmware in Rust. By analyzing the mobile app’s Bluetooth traffic and code, data not visible on the display and the information sent to the central server along with the scooter’s unique identity were identified. This was one of the reasons for modifying the firmware. Once it was discovered that the scooter used CAN Bus, an oscilloscope and a homemade CAN decoder were used; it was determined that the data lines were located in the USB-C port officially provided for phone charging. There were at least three types of updates, for the display, input panel, and controller; installing new firmware depended on resolving this process.
Why it matters
This work shows that security in electric scooters is not limited to mechanical components; the relationships among the display, mobile app, wireless communication, and controller also determine authorization to use the device. The additional data observed in Bluetooth traffic and the transmission of the scooter’s unique identity to the central server raise questions about what information is collected from users and the extent to which this flow can be controlled. The presence of CAN lines in the USB-C port provided for phone charging reveals the gap between the device’s official intended use and its actual technical capabilities. The fact that the firmware depends on multiple components shows that security issues cannot be resolved by changing a single piece of software. The open question is how these findings will be reflected in Egret’s official update process and security approach.