News: 1768564798

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Bankrupt scooter startup left one private key to rule them all

(2026/01/16)


An Estonian e-scooter owner locked out of his own ride after the manufacturer went bust did what any determined engineer might do. He reverse-engineered it, and claims he ended up discovering the master key that unlocks every scooter the company ever sold.

The company in question, Äike, [1]which filed for bankruptcy last year , built app-controlled electric scooters that rely on a phone and backend servers to do as basic a task as turning them on. That setup worked while the startup was still around. Once it wasn't, owners were left with pricey scooters that only unlocked when the cloud happened to answer.

Some features limped along for a while, others stopped altogether. So rather than trust his commute to a bankrupt startup's servers, one owner, Rasmus Moorats, an Estonian security researcher and penetration tester, [2]took matters into his own hands and started poking around to see how the scooter really worked.

[3]

A closer look at the Android app and Bluetooth traffic showed that locking, unlocking, and basic status checks all occur locally over Bluetooth, with the cloud mostly along for the ride.

[4]

[5]

Before accepting commands, the scooter runs a simple authentication check: it sends a short challenge, the app replies with a cryptographic response, and access is granted. It's designed to stop random passers-by from hopping on and riding off. In theory, at least.

In practice, the secret used to generate that response was, Moorats claims, never properly set. Instead of a unique key per scooter, the manufacturer shipped all models with the same placeholder value: a default private key that appears to have been intended to be replaced before production and simply never was.

[6]Cops developing Ghostbusters-esque weapon to take out e-bike thugs

[7]Devs reverse-engineer 16,000 Android apps, find secrets and keys to AWS accounts

[8]Infinite Machine e-scooter is like the offspring of a Vespa and a Cybertruck

[9]Welcome to the World Of Tomorrow, where fridges suffer certificate errors. Just like everything else

Once Moorats had worked that out, unlocking his own scooter without the cloud was trivial, and the exact same method works on every other Äike scooter within Bluetooth range, he says. With a short proof-of-concept script and standard tools, he says he was able to unlock any nearby scooter, whether it belonged to him or not.

This isn't a blueprint for a mass scooter theft spree. Äike never sold scooters at the scale of big rental fleets, and shared scooters appear to use different hardware. Still, the mistake is a familiar one in IoT: default settings left in place, no real key management, and nothing to fall back on once the company vanishes.

[10]

Moorats says he disclosed the issue to the hardware supplier, only to be told that key management was the manufacturer's responsibility – a dead end when that manufacturer is bankrupt.

When smart devices die with their makers, reverse engineering becomes less of a hobby and more of a basic ownership skill. ®

Get our [11]Tech Resources



[1] https://ariregister.rik.ee/eng/company/16530912/%C3%84ike-Mobility-O%C3%9C

[2] https://blog.nns.ee/2026/01/06/aike-ble/

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aWpuvqjWe42KKeGUy__mTQAAAYk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWpuvqjWe42KKeGUy__mTQAAAYk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWpuvqjWe42KKeGUy__mTQAAAYk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2024/05/14/ghostbuster_ebike_weapon/

[7] https://www.theregister.com/2017/01/17/hackers_reverse_16000_apps_find_secrets_and_keys_for_aws_others/

[8] https://www.theregister.com/2025/12/19/infinite_machine_electric_scooter/

[9] https://www.theregister.com/2019/10/15/welcome_to_the_world_of_tomorrow/

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWpuvqjWe42KKeGUy__mTQAAAYk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[11] https://whitepapers.theregister.com/



First law of IoT

Mishak

Never buy a device that doesn't work if the internet is down or the server is not responding.

Re: First law of IoT

NoneSuch

Microsoft, Google and Apple would like a word.

Re: First law of IoT

Doctor Syntax

I think the word they'd like would be "concealed". They'd like it applied to the OP's comment.

Re: Never buy a device that doesn't work if the internet is down or the server is not responding.

tmTM

It's easy to say that, but it's not like anyone is going to advertise this fact to potential customers.

Usually something you find out a few months down the line, when the servers go TITSUP and suddenly nothing will respond.

Re: Never buy a device that doesn't work if the internet is down or the server is not responding.

LBJsPNS

If it requires an app to function, it's immediately suspect.

Re: Never buy a device that doesn't work if the internet is down or the server is not responding.

doublelayer

True, manufacturers generally don't advertise that, but that doesn't mean it's hopeless. If you think that it might, for example because there's an app, you can ask them. If they lie, you can use that from anything from a return outside normal windows to a legal complaint. It's also something you can check after having bought something to know whether that can affect you later.

In a perfect world, there would be a requirement to disclose this. Since we don't have that yet, it is still something you can do before you feel the consequences.

Law...

YetAnotherACUser

This should covered by some sort of "buyer protection law" IMHO. If the manufacturer/retailer goes out of business there should be an obligation to either refund the customers or provide a way for them to keep using the devices they have paid for.

I understand that this is kind of a "new" things, but since this is the world we live in, it should be addressed.

Re: Law...

Neil Barnes

I like the idea, but I'm not sure how it might be implemented. If the company is out of business, how do they fund either the refund or provide a new way to use things? Obviously they don't have the money, and I suspect that any insurance - particularly for a startup - is going to be prohibitively expensive.

Anything which requires a cloud connection to provide basic functionality (rather than value added) is, I think, broken. Whether it's a TV, a cat feeder, an electric scooter (or car?), if it relies on the manufacturer (or a third party) to remain in business, then really, you're a hostage to fortune, not an owner. This applies equally to e-books, downloaded music/videos, anything that works on this model of 'you will own nothing, and rent everything'.

Which needs a change in the operation of the supplier, to make his money by selling the product and not from ongoing subscriptions.

Re: Law...

John Robson

escrow - either of funds or of code

Re: Law...

lglethal

How about a complete ban on any hardware that loses basic functionality, if it loses the internet connection?

(I wrote hardware to stop the inevitable "Internet Explorer stopped working because I lost internet! I want my money back!" comments).

A TV, fridge, phone, scooter, vacuum cleaner, washing machine, dildo, door, car, and god knows what else should all remain functional without an internet connection. Yeah you might lose additional functionality ("My fridge no longer sends me a list of items that I'm running low on.", "My Dildo no longer operates to the beat of The Prodigy - Smack My Bitch up!", "My door no longer thanks for walking through it!"), but the thing should bloody well work at perform at least their basic function.

Sigh... I know it's not going to happen in this world. But it would be nice to believe it could...

Re: Dildo

TimMaher

Doesn’t that have a fallback to Local Intranet Management Program?

Mine has a spare battery in the pocket.

Re: Law...

ChoHag

> I suspect that any insurance - particularly for a startup - is going to be prohibitively expensive.

So vulture capitalists will not be able to litter our streets with ejunk without paying for it?

Don't threaten me with a good time.

Re: Law...

jdiebdhidbsusbvwbsidnsoskebid

"This should covered by some sort of 'buyer protection law' IMHO"

In the UK, if the manufacturer goes out of business, the seller still has legal obligations to you the purchaser. This is on the basis that the buyer has a contract in law with only the seller, not the manufacturer or the seller's supplier. (If you go back to a shop with a broken thing after only a few days and the shop says you have to contact the manufacturer, the shop is breaking the law). If the seller also goes out of business, then you are pretty much stuffed. If you bought it using credit (e.g. a credit card or bank overdraft) then the Consumer Credit Act says the credit supplier has some joint liability to you. This is the way you can get a refund from your credit card supplier for faulty equipment if the supplier goes bust or refuses to play fair.

But otherwise, if the supplier and manufacturer go bust, then you can register as a creditor of the company and join the queue of people that the bankruptcy administrators will have to deal with. Problem is that customers are at the back of that queue, with investors, lenders, staff, suppliers etc. all ahead of past customers.

I think that there should be some sort of compensation/refund pot that manufacturers should have to pay into, to compensate consumers for when the products are artificially killed off when some sort of online service required for continued functioning of the product stops working. There should be statuary mandated periods for which such online required services must be maintained for (maybe even including security updates too). Manufacturers must state at the point of sale the minimum time for how long those services will stay active, the longer that period, the less they have to pay into that compensation pot. If they go off before that minimum period, the consumer gets compensation from the pot, according to some sliding scale declared well in advance. You could follow the example of the pensions industry, and have the pot filled up sufficient to pay all the manufacturer's liabilities under this scheme, at any time. If a product is standalone and requires no online connectivity to function, then no need to pay anything. If a manufacturer never causes the pot o pay out, they get a refund later, once the product is finally deemed to be beyond end of life. Consumer protection law would mandate minimum periods for how long those online services must stay active for, inline with the anticipated lifetime of the products. Maybe 5yrs for smart watches, 15yrs for white goods and cars, 20 yrs for smart speakers (SONOS, I'm looking at you!), 100yrs for any medical implants, Something like that.

Companies that make decent products that continue to be supported, or that don't require ongoing online connectivity to continue working will benefit from cheaper overheads. Companies that turn stuff off prematurely will be punished with higher overheads.

"basic ownership skill"

Bebu sa Ware

Interesting concept. One needs basic skills to exercise "ownership" ?

Hitherto just breathing was considered adequate.

The ventilated comatose patient retains ownership of his or her property — so even breathing, at least unassisted, also seems optional.

The whole phone app and cloud idea is a bit daft when a simple key switch has provided the same service for decades.

Just last week members of a gang half·inching high end Toyotas were apprehended in AU. They electronically unlocked the vehicles from a laptop and drove off with the vehicles — whole process taking mere seconds.

A "security expert" interviewed afterwards opined that vehicle owners would been better protected with an old school steering wheel clamp. Indeed.

Re: "basic ownership skill"

Gavin Chester

I don’t disagree but the car makers will only see this as a reason to make it into a SlaaS offering ( steering lock as a service)

Re: steel clamp

MiguelC

I remember when a neighbourhood kid bought an old Fiat Punto and was shown that to open his car's boot you just had to pull a cable underneath it. He then bought one of those locks and duly locked the steering wheel for the night. Next morning he found the car doors unlocked and the steering lock open and waiting for him on the driver's seat. Never found out who did it, but I'd buy him a pint for the laughs!

Ian Johnston

This sort of thing is going to be needed on a rather larger scale when Tesla goes bust. Or if Elon Musk simply decides to brick every car in Europe when the shooting starts in Greenland.

BartyFartsLast

Elmo will "accidentally" shut down Starlink too I'm sure.

retiredFool

The above 2 are the reason I never buy/use Elmo products. Someone did a thing where they compared Elmo 2005-2015 to present day Elmo. Old Elmo was a green leftie. Present day Elmo is a right wing trump nazi. How anyone can stomach driving/using let alone buying new Elmo products is a mystery to me.

Van Oof

BartyFartsLast

If there was some law on the books to open the IP necessary to continue running the kit when a cloudy bollocks manufacturer goes titsup it could ensure stuff isn't useless e-waste and it would prevent IP being bought up by prior competitors to "catch and kill" it.

In other news, don't buy cloudy bollocks toys kids, buy stuff you can actually own

Doctor Syntax

"did what any determined engineer might do"

I suppose it's the "determined" bit that persuaded him it would be OK to buy the thing in the first place, being well aware, as an engineer, that the thing's basic depended on the presence of a cloud server whose continued existence.

Lotus

Anonymous Coward

I'm reminded of the copyright protection applied to Lotus software back in the 1989's. You could install 1-2-3 or Symphony onto a PC HD but the original floppy had to be in the drive to get it to load and run. If that floppy disk was damaged (and they weren't designed to be very robust) you had to buy another from Lotus. However, their protection scheme worked on the basis that their disk had a faulty sector and the start up routine looked for that sector - if the disk was present it would return a specific error code and the program continued to load and run from the HD. Once you knew that, it was relatively easy to hack the code to simply bypass the check. Even simpler was to get a program (quite inexpensive, sold on a floppy disk) that made the change for you. Where I worked at the time, we bought all the copies we needed to run legitimately and had plenty of original FDs to borrow should one get corrupt (it was only needed to get the program running, and could be removed to safety thereafter). However, our department went belt and braces on a couple of critical installations and unprotected the HD copies.

There was something similar with Ashton-Tate's dBase (I can't recall the bypass for that, though I used it a few time for clients when their legal system crashed and was urgently needed).

Strictly illegal but I don't think Lotus or A-T ever took action against anyone bypassing the protection on otherwise legally licensed copies...

Brief History Of Linux (#17)
Terrible calamity

IBM chose Microsoft's Quick & Dirty Operating System instead of CP/M for
its new line of PCs. QDOS (along with the abomination known as EDLIN) had
been acquired from a Seattle man, Tim Paterson, for the paltry sum of
$50,000. "Quick" and "Dirty" were truly an accurate description of this
system, because IBM's quality assurance department discovered 300 bugs in
QDOS's 8,000 lines of assember code (that's about 1 bug per 27 lines --
which, at the time, was appalling, but compared with Windows 98 today, it
really wasn't that shabby).

Thanks in part to IBM's new marketing slogan, "Nobody Ever Got Fired For
Choosing IBM(tm)", and the release of the VisiCalc spreadsheet program
that everybody and their brother wanted, IBM PCs running DOS flew off the
shelves and, unfortunately, secured Microsoft's runaway success. Bill
Gates was now on his way to the Billionaire's Club; his days as a mediocre
programmer were long gone: he was now a Suit. The only lines of code he
would ever see would be the passcodes to his Swiss bank accounts.