Weak security means attackers could disable all of a city's public EV chargers
(2026/04/24)
- Reference: 1777003833
- News link: https://www.theregister.co.uk/2026/04/24/rentable_iot_security_flaws/
- Source link:
Black Hat Asia Developers of rented internet of things infrastructure – stuff like public EV chargers and shared e-bikes – are prioritizing user convenience over security, and leaving themselves exposed to wide-scale denial of service attacks on their services.
That frightening thesis was the subject of a Friday talk at the Black Hat Asia conference, delivered by Hetian Shi, a hardware and IoT security researcher at China’s Tsinghua University.
Shi told the conference the very nature of rented IoT services means they have a unique security problem: Anyone can access devices and examine them for vulnerabilities. The researcher conducted his probes with permission, and disclosed the results ethically – for which we should all be thankful because he discovered that some rentable devices include either a debugging port or a UART connector that makes examining their operations an uncomplicated task for an educated attacker.
[1]
His own efforts yielded evidence of shared authentication keys in device firmware, and backend services that don’t properly authenticate users.
[2]
[3]
The researcher also investigated the apps that rentable IoT providers publish so consumers can access their services and again found weak security that allowed him to do things like create phantom clients that rentable IoT services could not distinguish from actual customers. Using phantom clients makes it possible for an attacker to charge cars or rent scooters at zero cost.
Shi said the techniques he’s developed can also compromise personal information by exposing rentable IoT services’ back ends.
[4]Hybrid clouds have two attack surfaces and you’re not paying enough attention to either
[5]EV charger biz ELECQ zapped by ransomware crooks, customer contact data stolen
[6]Pwn2Own Automotive 2026 uncovers 76 zero-days, pays out more than $1M
[7]Tesla asks customers to stop being wet blankets about chargers
He’s created a tool called “IDScope” that makes it possible to exploit many of the flaws he found and during his talk demonstrated it by running the iOS app for a Chinese provider of public electric vehicle charging stations.
Shi asked the audience to nominate a Chinese city – Shanghai was the popular choice – and then looked up available chargers in People’s Square, a major shopping and recreation district. The app produced a list of chargers and which ones were available to use.
[8]
Shi asked the audience to choose which of the available chargers he should attack, noted the ID number for that charger listed in the app, entered that number into a script. A second or two later, the icon in the app for that charger changed color from green – which denotes availability for charging – to the grey hue that indicates a disabled port.
The app was in Chinese and your correspondent can’t read that language so I can’t say with certainty what I witnessed, but the demo drew spontaneous applause from others in the audience – and plenty of people here at Black Hat have come from the Chinese-speaking world.
Shi thinks the techniques he created also make it possible to deny service, and do so at scale – creating the possibility of taking out an entire city’s network of EV chargers.
[9]
And not just in China: The researcher tested 11 apps published by European providers of shared bikes and scooters, and found similar problems - suggesting his findings will be applicable elsewhere.
He theorized that the flaws he found are the result of developers trying to build services that users find convenient, at the expense of security. ®
Get our [10]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2026/04/23/wac_flaws_hybrid_cloud_security/
[5] https://www.theregister.com/2026/03/09/ransomware_crooks_hit_ev_charger/
[6] https://www.theregister.com/2026/01/25/pwn2own_automotive_2026_identifies_76_0days/
[7] https://www.theregister.com/2024/07/29/tesla_harging_wet_rag/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
That frightening thesis was the subject of a Friday talk at the Black Hat Asia conference, delivered by Hetian Shi, a hardware and IoT security researcher at China’s Tsinghua University.
Shi told the conference the very nature of rented IoT services means they have a unique security problem: Anyone can access devices and examine them for vulnerabilities. The researcher conducted his probes with permission, and disclosed the results ethically – for which we should all be thankful because he discovered that some rentable devices include either a debugging port or a UART connector that makes examining their operations an uncomplicated task for an educated attacker.
[1]
His own efforts yielded evidence of shared authentication keys in device firmware, and backend services that don’t properly authenticate users.
[2]
[3]
The researcher also investigated the apps that rentable IoT providers publish so consumers can access their services and again found weak security that allowed him to do things like create phantom clients that rentable IoT services could not distinguish from actual customers. Using phantom clients makes it possible for an attacker to charge cars or rent scooters at zero cost.
Shi said the techniques he’s developed can also compromise personal information by exposing rentable IoT services’ back ends.
[4]Hybrid clouds have two attack surfaces and you’re not paying enough attention to either
[5]EV charger biz ELECQ zapped by ransomware crooks, customer contact data stolen
[6]Pwn2Own Automotive 2026 uncovers 76 zero-days, pays out more than $1M
[7]Tesla asks customers to stop being wet blankets about chargers
He’s created a tool called “IDScope” that makes it possible to exploit many of the flaws he found and during his talk demonstrated it by running the iOS app for a Chinese provider of public electric vehicle charging stations.
Shi asked the audience to nominate a Chinese city – Shanghai was the popular choice – and then looked up available chargers in People’s Square, a major shopping and recreation district. The app produced a list of chargers and which ones were available to use.
[8]
Shi asked the audience to choose which of the available chargers he should attack, noted the ID number for that charger listed in the app, entered that number into a script. A second or two later, the icon in the app for that charger changed color from green – which denotes availability for charging – to the grey hue that indicates a disabled port.
The app was in Chinese and your correspondent can’t read that language so I can’t say with certainty what I witnessed, but the demo drew spontaneous applause from others in the audience – and plenty of people here at Black Hat have come from the Chinese-speaking world.
Shi thinks the techniques he created also make it possible to deny service, and do so at scale – creating the possibility of taking out an entire city’s network of EV chargers.
[9]
And not just in China: The researcher tested 11 apps published by European providers of shared bikes and scooters, and found similar problems - suggesting his findings will be applicable elsewhere.
He theorized that the flaws he found are the result of developers trying to build services that users find convenient, at the expense of security. ®
Get our [10]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2026/04/23/wac_flaws_hybrid_cloud_security/
[5] https://www.theregister.com/2026/03/09/ransomware_crooks_hit_ev_charger/
[6] https://www.theregister.com/2026/01/25/pwn2own_automotive_2026_identifies_76_0days/
[7] https://www.theregister.com/2024/07/29/tesla_harging_wet_rag/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aes_QEydiLAHpkVWBO_xnAAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Re: EVs in a war
Androgynous Cupboard
The article is about public charging networks, not the drive system itself.
Chewi
Long live Lemons!
Lemons?
Fruit and Nutcase
Forget public charging infrastructure and Lithium batteries - just drive up to your local greengrocer and fill the boot up with Lemons, for your Lemon/Copper/Zinc battery!
Well yeah
DrXym
These companies are basically racing to a finished product, before the funding dries up and things like security take a backseat.
It doesn't help that security is *hard* and has to be done in depth and distributed systems like e-bikes / chargers are probably using cloud services. There are plenty of potential attack vectors when things are up in the cloud and if they are not locked down properly then somebody will figure out what the endpoints are and start poking around.
EVs in a war
It'a a good thing that Tanks, Ships, Planes etc still use conventional fuel systems.
Imagine the warfield with soldiers stuck at home base due to lack of charging....