Security researcher Ben reverse-engineered the Egret GT E-scooter firmware to address critical security vulnerabilities, including a bypass that allowed users to operate the vehicle without a PIN.

Key Points

• The Egret GT E-scooter contained a security flaw allowing users to bypass the PIN requirement by entering firmware update mode.
• Ben reverse-engineered the scooter’s proprietary protocol and successfully rewrote the device firmware using the Rust programming language.
• Analysis revealed that the scooter transmits telemetry data tagged with a unique device ID to a remote server via a mobile application.
• The scooter utilizes a CAN Bus for internal communication, which is unexpectedly accessible through the data pins of the USB-C charging port.
• The project involved reverse-engineering three distinct firmware components: the display, the input panel, and the main controller.

Why it Matters

This project highlights significant security and privacy risks inherent in consumer IoT devices that lack robust firmware encryption and data protection. It serves as a practical case study for hardware enthusiasts on how to identify and mitigate vulnerabilities in embedded systems.