AI
Xiaomi Scooters as a Wireless Attack Surface
Xiaomi’s M365 and Mi3 run Nordic, STM32, and Texas Instruments chips and communicate with Mi Home over a vendor-specific BLE protocol. That wireless link is the attack surface. The researchers chose Xiaomi because it dominates the market and appears in Bird rental fleets, making one vulnerability scalable across thousands of units. By repackaging a popular scooter-modding app, an attacker installs a malicious payload on the victim’s phone and reaches the scooter remotely, without proximity and without touching Mi Home.
Four Vulnerabilities That Open the Internals
Four flaws make the attack possible. The Bluetooth controller firmware ships unencrypted and unsigned. That second flaw is the load-bearing one: any BLE-capable attacker who spoofs the Mi Home app can push arbitrary firmware to the controller with no signature check. Internal UART communications between the controller, motor driver, and BMS carry no integrity, encryption, or authentication, so a malicious controller can impersonate other subsystems. A fourth flaw leaves those same UART buses open to denial-of-service. The rogue firmware update is the entry point. Everything else follows.
Overvoltage Battery Destruction
Lithium cells fail above 4.2 V. Overheating follows, then fires or explosion. The malicious battery controller firmware exploits this in the register-level overvoltage manipulation (20:34): it writes 0xFF to the overvoltage threshold register, pushing the limit to 4.7 V, then clears the fault bit so no alarm surfaces and sets the fat-charge bit so charging continues past the threshold. Cell balancing is disabled to maximize imbalance. The entire state is hidden from the Bluetooth system and the user. Xiaomi’s own safety logic runs in the same controller, so once the firmware is replaced, that logic simply does not execute.
Undervoltage Battery Ransomware
Below 3.6 V, lithium cells sustain permanent damage. Below 1.58 V, polarity inversion becomes possible. The undervoltage ransomware trigger and ransom delivery (26:43) sets the threshold to 1.58 V, ignores the undervoltage alarm, forces the fat-discharge bit so the motor and BLE radio keep drawing power, and hides every symptom from the user. At critical undervoltage the firmware rewrites the BLE advertisement with a short link to a ransom app. Pay or the drain continues. The physical damage is irreversible; the offered recovery firmware only re-enables charging.
“So UBR is the first escooter ransomware” — Marco Casagrande
Reverse Engineering, Open-Source Toolkit, and Lab Results
Months of static and dynamic analysis preceded the attacks: Ghidra with an STM8 plugin for firmware reversing, and an ST-Link debugger soldered to the SWIM pins for runtime memory reads. The open-source toolkit released with the talk ships a binary firmware patcher and pre-built attack firmwares; overvoltage and undervoltage payloads are redacted to avoid live malware. Lab results on real devices: overvoltage hit 4.9 V and 80°C within five minutes before the team stopped. The M365 drained to zero in 3.5 hours (31:26), cutting autonomy in half.
Countermeasures and Responsible Disclosure
Four mitigations map to the four vulnerabilities: firmware encryption, firmware signing, SCP03 for authenticated UART communication, and DoS protection on internal buses. All use cryptography Xiaomi already deploys elsewhere, so the engineering lift is low. Disclosure ran two years. The espoofer findings, reported in November 2021, were marked unreproducible. The iTroans findings, first reported in 2023, hit the same wall, then cleared it: after a second round, Xiaomi assigned a medium CVE and paid its highest HackerOne bounty. Statement: the M365 and ES3 are end-of-life, and newer models incorporate the fixes.
Notable Quotes
So UBR is the first escooter ransomware Marco Casagrande · ▶ 26:43
really bad. This means that you can uh Daniele Antonuoli · ▶ 13:03
again that security is bad and was not Marco Casagrande · ▶ 36:50
Key Takeaways
- An unsigned Bluetooth controller firmware enables rogue updates over BLE, no physical access required.
- Malicious firmware can raise voltage thresholds to 4.7 V or drain cells to 1.58 V while hiding both conditions from the user.
- After two years and two disclosure rounds, Xiaomi assigned a medium CVE and confirmed the M365 and ES3 are end-of-life.