How I Unlocked a City's Electric Scooters Remotely
Remotely Unlocking Electric Scooters
A security researcher found a way to remotely unlock electric scooters from a fleet in his city. Starting with public WordPress enumeration, he identified an admin account, brute-forced its weak password, and gained access to the operations panel. The panel allowed him to view the entire fleet map, user data, and financial modules, and even send commands to unlock and lock a physical scooter. The root cause: no rate limiting, a 950-day admin token, and no extra confirmation for IoT commands.
The password was the only thing standing between the open internet and a button that moves physical hardware.
- TobiWestside
Did you contact the scooter company to report this and give them a chance to improve the security of their admin panel before posting?
With a couple minutes of research, I'm pretty sure I found their website and was able to confirm the painel subdomain still displays a user/password login form. If the admin password is actually trivial to guess (I won't try) I'm pretty sure you won't be the only one visiting their system if the weakness still exists and this post gets some traction.
- _def
> None of it matches the real company.
oh well don't worry, these companies are basically off the shelf business
- IshKebab
Was the hacking done by AI or just the write-up?