14 DAY TRIAL // Richo Healey and Mike Ryan, security specialists at Stripe and eBay, devised a way to hack into electric skateboards, findings that they presented at the DEF CON 2015 conference in Las Vegas over the weekend.
Mr. Healey accidentally discovered that electric skateboards tend to jam whenever going through areas with intense Bluetooth radio noise.
Based on his initial discovery and with the help of his friend Mike Ryan, he created an exploit that allows him to take control of electric skateboards, make them start or stop on demand, permanently disable brakes, and even put the skateboard in reverse while being in use.
Boosted, E-Go, and Revo electric skateboards are vulnerable
The exploit, named FacePlant, works on Boosted electric skateboards, and the two are also working on another exploit nicknamed Road Rash for E-Go boards. As WIRED reports, Revo electric skateboards are also vulnerable, but the researcher had no time to create an exploit for that specific brand.
According to the couple's research, because the Bluetooth communications between the board's remote control and its electric engines are unencrypted, a hacker could easily swoop in and take over a board without too much hard work.
Once in possession of a board, besides the aforementioned operations, an attacker can actually perform more complex routines, like an update to the board's firmware, allowing them to alter its top speed, the way the electric engines work, and even force the skateboard's engine to function even after the rider released the dead man switch.
Human lives are at risk
While most people would think that hacking into an electric skateboard is a waste of time and the two researchers should find something better to do, this exploit can put human lives in serious danger.
Since some electric skateboards are known to reach 20Mph / 32Kmph, disabling or activating the breaks at these kinds of speeds can result in serious injuries or even the loss of human life, if the board is taken over while the rider is on a busy street with lots of traffic.
Because the attacker only needs to be 30 meters away from a board to hijack it and make firmware updates, this doesn't mean accidents cannot happen later on, when the board is used, and the attacker is miles away.
This is not similar to the Tracking Point smart sniper rifle case where the hacker needed to be close to you, so a rider cannot protect themselves unless patches are made to the board's software to use encrypted connections via its Bluetooth communications.