Bankrupt scooter startup left one private key to rule them all
- Reference: 1768564798
- News link: https://www.theregister.co.uk/2026/01/16/bankrupt_scooter_startup_key/
- Source link:
The company in question, Äike, [1]which filed for bankruptcy last year , built app-controlled electric scooters that rely on a phone and backend servers to do as basic a task as turning them on. That setup worked while the startup was still around. Once it wasn't, owners were left with pricey scooters that only unlocked when the cloud happened to answer.
Some features limped along for a while, others stopped altogether. So rather than trust his commute to a bankrupt startup's servers, one owner, Rasmus Moorats, an Estonian security researcher and penetration tester, [2]took matters into his own hands and started poking around to see how the scooter really worked.
[3]
A closer look at the Android app and Bluetooth traffic showed that locking, unlocking, and basic status checks all occur locally over Bluetooth, with the cloud mostly along for the ride.
[4]
[5]
Before accepting commands, the scooter runs a simple authentication check: it sends a short challenge, the app replies with a cryptographic response, and access is granted. It's designed to stop random passers-by from hopping on and riding off. In theory, at least.
In practice, the secret used to generate that response was, Moorats claims, never properly set. Instead of a unique key per scooter, the manufacturer shipped all models with the same placeholder value: a default private key that appears to have been intended to be replaced before production and simply never was.
[6]Cops developing Ghostbusters-esque weapon to take out e-bike thugs
[7]Devs reverse-engineer 16,000 Android apps, find secrets and keys to AWS accounts
[8]Infinite Machine e-scooter is like the offspring of a Vespa and a Cybertruck
[9]Welcome to the World Of Tomorrow, where fridges suffer certificate errors. Just like everything else
Once Moorats had worked that out, unlocking his own scooter without the cloud was trivial, and the exact same method works on every other Äike scooter within Bluetooth range, he says. With a short proof-of-concept script and standard tools, he says he was able to unlock any nearby scooter, whether it belonged to him or not.
This isn't a blueprint for a mass scooter theft spree. Äike never sold scooters at the scale of big rental fleets, and shared scooters appear to use different hardware. Still, the mistake is a familiar one in IoT: default settings left in place, no real key management, and nothing to fall back on once the company vanishes.
[10]
Moorats says he disclosed the issue to the hardware supplier, only to be told that key management was the manufacturer's responsibility – a dead end when that manufacturer is bankrupt.
When smart devices die with their makers, reverse engineering becomes less of a hobby and more of a basic ownership skill. ®
Get our [11]Tech Resources
[1] https://ariregister.rik.ee/eng/company/16530912/%C3%84ike-Mobility-O%C3%9C
[2] https://blog.nns.ee/2026/01/06/aike-ble/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aWpuvqjWe42KKeGUy__mTQAAAYk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWpuvqjWe42KKeGUy__mTQAAAYk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWpuvqjWe42KKeGUy__mTQAAAYk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2024/05/14/ghostbuster_ebike_weapon/
[7] https://www.theregister.com/2017/01/17/hackers_reverse_16000_apps_find_secrets_and_keys_for_aws_others/
[8] https://www.theregister.com/2025/12/19/infinite_machine_electric_scooter/
[9] https://www.theregister.com/2019/10/15/welcome_to_the_world_of_tomorrow/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWpuvqjWe42KKeGUy__mTQAAAYk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
Re: First law of IoT
Microsoft, Google and Apple would like a word.
Re: First law of IoT
I think the word they'd like would be "concealed". They'd like it applied to the OP's comment.
Re: Never buy a device that doesn't work if the internet is down or the server is not responding.
It's easy to say that, but it's not like anyone is going to advertise this fact to potential customers.
Usually something you find out a few months down the line, when the servers go TITSUP and suddenly nothing will respond.
Re: Never buy a device that doesn't work if the internet is down or the server is not responding.
If it requires an app to function, it's immediately suspect.
Re: Never buy a device that doesn't work if the internet is down or the server is not responding.
True, manufacturers generally don't advertise that, but that doesn't mean it's hopeless. If you think that it might, for example because there's an app, you can ask them. If they lie, you can use that from anything from a return outside normal windows to a legal complaint. It's also something you can check after having bought something to know whether that can affect you later.
In a perfect world, there would be a requirement to disclose this. Since we don't have that yet, it is still something you can do before you feel the consequences.
Law...
This should covered by some sort of "buyer protection law" IMHO. If the manufacturer/retailer goes out of business there should be an obligation to either refund the customers or provide a way for them to keep using the devices they have paid for.
I understand that this is kind of a "new" things, but since this is the world we live in, it should be addressed.
Re: Law...
I like the idea, but I'm not sure how it might be implemented. If the company is out of business, how do they fund either the refund or provide a new way to use things? Obviously they don't have the money, and I suspect that any insurance - particularly for a startup - is going to be prohibitively expensive.
Anything which requires a cloud connection to provide basic functionality (rather than value added) is, I think, broken. Whether it's a TV, a cat feeder, an electric scooter (or car?), if it relies on the manufacturer (or a third party) to remain in business, then really, you're a hostage to fortune, not an owner. This applies equally to e-books, downloaded music/videos, anything that works on this model of 'you will own nothing, and rent everything'.
Which needs a change in the operation of the supplier, to make his money by selling the product and not from ongoing subscriptions.
Re: Law...
escrow - either of funds or of code
Re: Law...
How about a complete ban on any hardware that loses basic functionality, if it loses the internet connection?
(I wrote hardware to stop the inevitable "Internet Explorer stopped working because I lost internet! I want my money back!" comments).
A TV, fridge, phone, scooter, vacuum cleaner, washing machine, dildo, door, car, and god knows what else should all remain functional without an internet connection. Yeah you might lose additional functionality ("My fridge no longer sends me a list of items that I'm running low on.", "My Dildo no longer operates to the beat of The Prodigy - Smack My Bitch up!", "My door no longer thanks for walking through it!"), but the thing should bloody well work at perform at least their basic function.
Sigh... I know it's not going to happen in this world. But it would be nice to believe it could...
Re: Dildo
Doesn’t that have a fallback to Local Intranet Management Program?
Mine has a spare battery in the pocket.
Re: Law...
> I suspect that any insurance - particularly for a startup - is going to be prohibitively expensive.
So vulture capitalists will not be able to litter our streets with ejunk without paying for it?
Don't threaten me with a good time.
Re: Law...
"This should covered by some sort of 'buyer protection law' IMHO"
In the UK, if the manufacturer goes out of business, the seller still has legal obligations to you the purchaser. This is on the basis that the buyer has a contract in law with only the seller, not the manufacturer or the seller's supplier. (If you go back to a shop with a broken thing after only a few days and the shop says you have to contact the manufacturer, the shop is breaking the law). If the seller also goes out of business, then you are pretty much stuffed. If you bought it using credit (e.g. a credit card or bank overdraft) then the Consumer Credit Act says the credit supplier has some joint liability to you. This is the way you can get a refund from your credit card supplier for faulty equipment if the supplier goes bust or refuses to play fair.
But otherwise, if the supplier and manufacturer go bust, then you can register as a creditor of the company and join the queue of people that the bankruptcy administrators will have to deal with. Problem is that customers are at the back of that queue, with investors, lenders, staff, suppliers etc. all ahead of past customers.
I think that there should be some sort of compensation/refund pot that manufacturers should have to pay into, to compensate consumers for when the products are artificially killed off when some sort of online service required for continued functioning of the product stops working. There should be statuary mandated periods for which such online required services must be maintained for (maybe even including security updates too). Manufacturers must state at the point of sale the minimum time for how long those services will stay active, the longer that period, the less they have to pay into that compensation pot. If they go off before that minimum period, the consumer gets compensation from the pot, according to some sliding scale declared well in advance. You could follow the example of the pensions industry, and have the pot filled up sufficient to pay all the manufacturer's liabilities under this scheme, at any time. If a product is standalone and requires no online connectivity to function, then no need to pay anything. If a manufacturer never causes the pot o pay out, they get a refund later, once the product is finally deemed to be beyond end of life. Consumer protection law would mandate minimum periods for how long those online services must stay active for, inline with the anticipated lifetime of the products. Maybe 5yrs for smart watches, 15yrs for white goods and cars, 20 yrs for smart speakers (SONOS, I'm looking at you!), 100yrs for any medical implants, Something like that.
Companies that make decent products that continue to be supported, or that don't require ongoing online connectivity to continue working will benefit from cheaper overheads. Companies that turn stuff off prematurely will be punished with higher overheads.
"basic ownership skill"
Interesting concept. One needs basic skills to exercise "ownership" ?
Hitherto just breathing was considered adequate.
The ventilated comatose patient retains ownership of his or her property — so even breathing, at least unassisted, also seems optional.
The whole phone app and cloud idea is a bit daft when a simple key switch has provided the same service for decades.
Just last week members of a gang half·inching high end Toyotas were apprehended in AU. They electronically unlocked the vehicles from a laptop and drove off with the vehicles — whole process taking mere seconds.
A "security expert" interviewed afterwards opined that vehicle owners would been better protected with an old school steering wheel clamp. Indeed.
Re: "basic ownership skill"
I don’t disagree but the car makers will only see this as a reason to make it into a SlaaS offering ( steering lock as a service)
Re: steel clamp
I remember when a neighbourhood kid bought an old Fiat Punto and was shown that to open his car's boot you just had to pull a cable underneath it. He then bought one of those locks and duly locked the steering wheel for the night. Next morning he found the car doors unlocked and the steering lock open and waiting for him on the driver's seat. Never found out who did it, but I'd buy him a pint for the laughs!
This sort of thing is going to be needed on a rather larger scale when Tesla goes bust. Or if Elon Musk simply decides to brick every car in Europe when the shooting starts in Greenland.
Elmo will "accidentally" shut down Starlink too I'm sure.
The above 2 are the reason I never buy/use Elmo products. Someone did a thing where they compared Elmo 2005-2015 to present day Elmo. Old Elmo was a green leftie. Present day Elmo is a right wing trump nazi. How anyone can stomach driving/using let alone buying new Elmo products is a mystery to me.
Van Oof
If there was some law on the books to open the IP necessary to continue running the kit when a cloudy bollocks manufacturer goes titsup it could ensure stuff isn't useless e-waste and it would prevent IP being bought up by prior competitors to "catch and kill" it.
In other news, don't buy cloudy bollocks toys kids, buy stuff you can actually own
"did what any determined engineer might do"
I suppose it's the "determined" bit that persuaded him it would be OK to buy the thing in the first place, being well aware, as an engineer, that the thing's basic depended on the presence of a cloud server whose continued existence.
Lotus
I'm reminded of the copyright protection applied to Lotus software back in the 1989's. You could install 1-2-3 or Symphony onto a PC HD but the original floppy had to be in the drive to get it to load and run. If that floppy disk was damaged (and they weren't designed to be very robust) you had to buy another from Lotus. However, their protection scheme worked on the basis that their disk had a faulty sector and the start up routine looked for that sector - if the disk was present it would return a specific error code and the program continued to load and run from the HD. Once you knew that, it was relatively easy to hack the code to simply bypass the check. Even simpler was to get a program (quite inexpensive, sold on a floppy disk) that made the change for you. Where I worked at the time, we bought all the copies we needed to run legitimately and had plenty of original FDs to borrow should one get corrupt (it was only needed to get the program running, and could be removed to safety thereafter). However, our department went belt and braces on a couple of critical installations and unprotected the HD copies.
There was something similar with Ashton-Tate's dBase (I can't recall the bypass for that, though I used it a few time for clients when their legal system crashed and was urgently needed).
Strictly illegal but I don't think Lotus or A-T ever took action against anyone bypassing the protection on otherwise legally licensed copies...
First law of IoT
Never buy a device that doesn't work if the internet is down or the server is not responding.