Can Hoverboards Be Hacked? Security Flaws Found In Segway Ninebot MiniPRO Hoverboard

Critical security flaws have been found in a hoverboard produced by Segway that could leave the vehicles vulnerable to attack and put the riders at risk.

The vulnerabilities, discovered by researchers at cybersecurity firm IOActive, affect the Segway Ninebot miniPRO hoverboard and, if exploited, would allow an attacker to bypass safety mechanisms and gain the ability to remotely control the hoverboard.

Read: Hoverboard Fire Safety Hazard: Self-Balancing Scooter Concerns Leads To Store Bans

According to Thomas Kilbride, an embedded devices security consultant at IOActive, it’s possible for an attacker to connect to the Segway hoverboard via Bluetooth by using a default PIN number of 000000—a PIN that works even if the user has set their own PIN.

Once connected to the device, the attacker can see the communications between the hoverboard and the mobile app that allows the user to control the Ninebot miniPRO. Communications between the app and the hoverboard are not encrypted.

The Ninebot mobile application also uses the smartphone’s GPS to index where a rider is using the device, which it lays out in app in real time on a publicly accessible map, making it easy for an attacker to track a person’s location.

Most troubling in Kilbride’s research was the ability of a malicious actor to apply a corrupted firmware update to the board. Segway’s hoverboard doesn’t perform an integrity check to make sure the firmware update is legitimate, so an attacker could push an arbitrary update to the hoverboard and bypass the safety protection.

Read: Are Hoverboards Dangerous? Largest US Seizure Of Counterfeit Self-Balancing Scooter Reported In Chicago

If any of the vulnerabilities were to be exploited, a considerable amount of trouble—and potential harm—could be caused for the hoverboard owner.

The attacker could change the PIN for the board and lock out the user. They could also leverage their access to the board to execute action remotely, including modifying settings, adjusting pace or direction, changing light colors on the board, or bringing the Segway to an abrupt stop while the rider is using it.

A hacker could also do permanent damage to the board by uploading unverified or corrupted firmware updates. Such an attack could do irreversible harm to the internal systems of the board.

IOActive first discovered the security flaws in Segway’s Ninebot miniPRO hoverboard in December 2016 and disclosed the vulnerabilities to the company in January. By April, the vulnerabilities were reportedly patched—though require users to download the update to ensure they cannot be exploited.

Regulators and consumer protection organizations in the United States has taken aim at hoverboards in the past due to mechanical and electrical malfunctions that have resulted in boards exploding and doing significant damage.

However, the commission has yet to issue any technical regulations on the boards to require proper security to prevent against cyberattacks. It is unclear at this point if other hoverboards suffer from similar vulnerabilities and could be exploited by attackers.

​