Indore: India’s certified ethical hacker & cybersecurity expert Abdultaiyeb Chechatwala said the issue stems from insecure Battery Management Systems (BMS) used in some lithium-ion batteries rather than from a single mobile application.Abdultaiyeb, who’s recognized by the National Critical Information Infrastructure Protection Centre (NCIIPC) and has previously worked with the Cybercrime Branch in Pune, spoke with TOI from Bangalore.He explained that a BMS continuously monitors battery parameters such as voltage, charging and discharging status, temperature and overall battery health. Since many battery packs do not have built-in displays, manufacturers provide smartphone applications that communicate with the BMS over Bluetooth to display this information and, in some cases, perform maintenance functions.Abdultaiyeb, who’s featured in the Google Vulnerability Research Program (VRP) Hall of Fame for identifying security vulnerabilities in Google products, said several low-cost battery manufacturers rely on generic software, often sourced from Chinese vendors, that lacks robust encryption and authentication standards. While BAT-BMS has come under scrutiny, he said it is only one of several similar applications available in the market.
“The problem is not the name of the app. It is the logic behind how the Battery Management System accepts commands,” he said.Once connected to an unsecured BMS, an authorised service application can access various maintenance functions. If adequate security controls are absent, an attacker may also be able to issue commands that alter battery parameters or temporarily disconnect the battery from the vehicle. The battery itself is not permanently damaged; instead, the BMS interprets a command and disconnects the power output until it is reset or reactivated.Taiyeb, who divides his time between India and Australia while working on key cybersecurity projects, said manufacturers should have implemented encryption, secure key exchange and authentication to ensure that only authorised users could communicate with the battery. “Without these safeguards, anyone within communication range who understands the protocol may attempt to interact with the system,” he said.He added that although some manufacturers have started releasing software updates and password protection after the controversy, thousands of batteries already in circulation may continue running older firmware until they are updated or replaced which may require money at the end of the e-rickshaw owner and that’s not possible.Referring to broader cybersecurity risks, Taiyeb said it is possible to hack any electric two or four-wheeler.
Modern connected devices increasingly rely on wireless communication protocols, including Bluetooth and radio-frequency technologies. Sophisticated attackers can use specialised equipment such as software-defined radios (SDRs) and protocol analysis tools to study wireless communications and, where security is weak, attempt replay or relay attacks.
Similar techniques have previously been demonstrated against wireless key fobs and other connected devices.“The lesson is that every connected device—whether it is an e-rickshaw battery, a drone, a smart appliance or a connected vehicle—must be designed with security built in from the beginning. As more physical devices become digitally connected, the attack surface also grows,” he said.