Black Hat USA 2025 | Ransomware, Tracking, DoS, and Data Leaks on Xiaomi Electric Scooters

Why It Matters

These flaws expose millions of riders to safety, privacy and financial risks, forcing scooter makers to urgently adopt robust firmware signing and encrypted communications to protect the rapidly growing micromobility market.

Key Takeaways

• Xiaomi e‑scooters vulnerable to unsigned Bluetooth firmware updates
• Attackers can trigger over‑voltage battery destruction remotely with malicious firmware
• Undervoltage ransomware can render scooters inoperable via firmware
• Lack of UART integrity enables tracking through unique hardware fingerprints
• Researchers disclosed fixes; manufacturers must patch wireless protocols urgently

Summary

At Black Hat USA 2025, researchers from KTH, URIM and the ITROANS project presented a deep‑dive into the security flaws of Xiaomi’s flagship electric scooters, the M365 and Mi 3. The talk detailed how proprietary Bluetooth‑Low‑Energy protocols and over‑the‑air firmware updates expose the devices to ransomware, battery‑destruction, tracking and denial‑of‑service attacks.

The team identified four critical vulnerabilities: the Bluetooth controller firmware is transmitted unencrypted and unsigned, allowing rogue firmware updates; internal UART communication between the Bluetooth subsystem, motor controller and battery‑management system lacks integrity checks; the battery‑controller can be reprogrammed via the same channel; and the UART bus is susceptible to simple denial‑of‑service. By exploiting these flaws, the researchers demonstrated a suite of attacks, including an over‑voltage battery‑destruction payload, an undervoltage ransomware that locks the scooter, and a fingerprint‑based tracking method that reads unique serial numbers.

One of the highlights was the claim of the “first ransomware for electric scooters,” where an attacker forces the scooter into a low‑voltage state that prevents charging until a ransom is paid. Another novel attack used an over‑voltage command to physically damage the battery cells. The researchers also showed how a malicious app installed alongside the official Mi Home app can silently push these payloads, and they disclosed the findings to Xiaomi over a two‑year responsible‑disclosure process.

The findings underscore the urgent need for manufacturers to enforce signed firmware, encrypt internal bus traffic and harden Bluetooth authentication. For rental operators and end‑users, the vulnerabilities translate into safety hazards, potential financial loss and privacy breaches, prompting regulators and OEMs to reevaluate IoT security standards for micromobility devices.

Original Description

We present a broad security and privacy assessment of the internals of two popular Xiaomi e-scooters: the M365 (2016) and Mi3 (2023). The internals include a battery management system (BMS), an electric motor controller (DRV), and a Bluetooth Low Energy subsystem (BTS). We also analyze Mi Home, the official Xiaomi e-scooter companion app for Android and iOS.

We uncovered four critical vulnerabilities through extensive static and dynamic reverse engineering, including a remote code execution flaw in the BMS. We exploit the vulnerabilities to conduct four novel attacks we call E-Trojans. The attacks can be executed remotely via a malicious mobile application installed on the victim's phone or in wireless proximity using a Bluetooth Low Energy (BLE) device. The attacks affect the e-scooter safety, security, availability, and privacy. For example, we present a new ransomware attack infecting the BMS and asking for a ransom while permanently damaging the e-scooter battery by silently undervolting its cells.

We present the E-Trojans toolkit, an open-source and modular toolkit for reproducing our attacks and experimenting with Xiaomi e-scooters. The toolkit contains an automated patching module that creates modified BMS firmware with malicious capabilities, such as disabling firmware updates and overriding the battery safety thresholds. The toolkit also includes the Android app and Django/MongoDB backend required by our ransomware.

Empirical tests confirm our attacks' effectiveness and practicality. For instance, our undervoltage ransomware can permanently reduce the autonomy of an M365 battery by 50% in three hours while asking for a ransom. We propose four countermeasures to enhance the security and privacy of the Xiaomi e-scooter ecosystem.

By:

Marco Casagrande | Security Researcher, KTH

Daniele Antonioli | Professor, EURECOM

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#e-trojans-ransomware-tracking-dos-and-data-leaks-on-xiaomi-electric-scooters-45822