Thread: What’s Next?
View Single Post
Old 07-26-2017, 10:34 PM   #5
SegwayUtah
Advanced Member
SegwayUtah is just really niceSegwayUtah is just really niceSegwayUtah is just really niceSegwayUtah is just really nice
 
SegwayUtah's Avatar
 
Join Date: Apr 2003
Location: New York, NY
Posts: 2,644
5 yr Member HT/PT Owner SegwayFest Attendee
Default

TL;DR: for pretty much all users this scenario is very unlikely and much lower risk than, say, some devious jerk going low-tech and throwing a bunch of marbles in front of your Ninebot.

As someone who spends some time working in computer security...

From the researcher's video, it looks like the attack relies on a modified Ninebot to succeed. In other words, a hacker would need access to your paired phone and Ninebot (or the ability to pair their own phone to your Ninebot)--and would then need to reprogram the Ninebot with special "attackable" firmware.

That's a much different scenario than some random stranger being able to force your machine to turn off at will. [And again, a bucket full of marbles, or a bucket full of slippery goo, or maybe even a low-power EMP...would all be simpler and more effective troublemaking.]

This is a common issue shared by many, many millions of devices...if someone has physical access to modify a device (either by reprogramming its hardware or by modifying some of its parts) then they can make the device do their bidding.

In this particular case, Segway could issue a firmware update which required all future firmware to be digital-signature-authenticated. For reference, desktop operating systems made that exact move over the last two decades. [There are also nifty things that can be done with crypto-authentication microchips...a topic for another day perhaps.]

Also, please note that everything I just said is a gross oversimplification of the hardware/software security issues inherent in any wirelessly-connected device.

Chris
SegwayUtah is offline   Reply With Quote