BAT-BMS / E-Rickshaw Cyber-Physical Attack

What Looks Like a Social Media Prank Is Actually a Serious Cyber-Physical Security Failure.

Viral videos are flooding Instagram, YouTube, and X.

A person walks up to a moving e-rickshaw.

Opens a free app on their phone. Taps a button.

The vehicle dies — mid-road, mid-route, mid-traffic.

Everyone is calling it a prank. But what is actually happening is far more serious.

What is really going on:

Millions of e-rickshaws across India run on budget lithium battery packs sourced from Chinese manufacturers. These come with a Battery Management System (BMS) chip that includes a discharge switch — designed to cut power safely during repairs.

The Bluetooth module controlling that switch has zero security.

No password. No PIN. No authentication. Nothing.

The BAT-BMS app — built by Shenzhen Grenergy Technology in China — was designed for solar and marine battery management. But pointed at an unprotected e-rickshaw battery within 15 metres, any stranger can instantly cut all power to a moving vehicle.

The attack chain no one is talking about:

Mobile App → Bluetooth → BMS Firmware → Battery Output → Vehicle Safety

Every link in that chain is a security decision. Not one was made correctly.
The human cost:

→ Drivers stranded mid-route with no idea why their vehicle stopped
→ Daily wage losses of ₹400–500 per incident — an entire day's earnings, gone
→ Drivers paying mechanics to "fix" a problem that isn't mechanical
→ Moving vehicles losing power suddenly — collision risk, passenger safety risk

The Delhi Transport Department has launched an investigation. But investigating the app misses the point entirely. The app is not the problem.
The problem is a safety-critical vehicle system was shipped to millions of drivers with no authentication and no protection whatsoever.

What this exposes:

✦ OT and embedded security ignored completely in India's EV supply chain
✦ Chinese BMS hardware imported with default open Bluetooth — zero security by design
✦ Security testing covers the mobile app — never the full hardware chain

The fix is not complicated:

→ Mandatory Bluetooth authentication on all BMS hardware before sale
→ PIN protection enabled by default
→ OT security testing: App → BLE → BMS → Vehicle Behavior

Convenience without security in a safety-critical system is not a feature. It is a failure.

cyberaxislabs.com
#CyberAxisLabs #EVSecurity #OTSecurity #IoTSecurity #Cybersecurity #BluetoothSecurity #CyberPhysicalSystems #InfoSec

We appreciate your feedback - share your comments at [email protected]