E-spoofer: attacking and defending xiaomi electric scooter ecosystem

Users connect and manage their Xiaomi e-scooter over Bluetooth Low Energy (BLE) through the Mi Home mobile app. We reverse-engineer the four iterations of the Xiaomi proprietary protocol spoken over BLE and exploit six vulnerabilities to break security, privacy, and safety. We develop four proximity and remote attacks that we call Malicious Pairing and Session Downgrade. As a result, we are able to unlock software-locked e-scooters (and steal them) or prevent access to the e-scooter via Mi Home. We evaluate three e-scooters and five BLE subsystems using our open-source toolkit, and we fix the attacks by proposing two practical countermeasures.