en.Wedoany.com Reported - At the Black Hat Asia conference, Hetian Shi, a hardware and IoT security researcher at China's Tsinghua University, pointed out that developers of rental IoT infrastructure (such as public electric vehicle chargers and shared e-bikes) prioritize user convenience over security, leaving services vulnerable to large-scale denial-of-service attacks.
Shi stated that the characteristics of rental IoT services create unique security issues: anyone can access the devices and inspect vulnerabilities. The researcher probed with permission and responsibly disclosed his findings. He discovered that some rental devices contain debug ports or UART connectors, allowing educated attackers to easily examine their operation. His research also revealed shared authentication keys in device firmware and backend services that fail to properly verify users.
The researcher investigated applications released by rental IoT providers, which consumers use to access services. He again found weak security measures, enabling him to create virtual clients indistinguishable from real customers. Using virtual clients, attackers could charge cars or rent scooters at zero cost. Shi said the techniques he developed could also expose personal information by revealing the backend of rental IoT services.
He created a tool called "IDScope" that exploits many of the discovered vulnerabilities. During his presentation, he demonstrated by running an iOS app from a Chinese public EV charging station provider. Shi asked the audience to choose a Chinese city—Shanghai became a popular choice—then searched for available chargers at People's Square. He asked the audience to select which available charger to attack, noted its ID number in the app, and entered it into a script. Within one or two seconds, the charger's icon in the app changed from green (indicating available for charging) to gray (indicating a disabled port). The demonstration earned spontaneous applause from the audience.
Shi believes his techniques could also achieve denial of service on a significant scale, potentially paralyzing an entire city's EV charger network. The researcher tested 11 apps released by European shared bike and scooter providers and found similar issues, suggesting his findings would apply elsewhere. He speculated that the discovered vulnerabilities result from developers trying to build services users find convenient, at the expense of security.
This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com
