The Indian government has directed Google and Apple to take down three mobile applications, BAT-BMS, Lossigy, and Epoch-i-ion, after they were allegedly misused to remotely disable e-rickshaws and other battery-operated three-wheelers mid-journey, putting passenger safety at risk.
  • Iced Raktajino@startrek.websiteEnglish
    17 days

    My house batteries for my PV system are also susceptible to this. Ugh.

    They’ve both got Bluetooth for monitoring and configuration. Some config changes require a PIN but not the settings to enable/disable charge and discharge. Someone could just get within range of them, install the official app, and set discharge to “off” and shut down my house.

    I’ve also not found a way to disable bluetooth on them. Gonna have to put them in a damn Faraday cage if I decide to worry about that possibility. :sigh:

    • NickeeCoco@piefed.socialEnglish
      17 days

      I’ve never before appreciated enough that the shitty bluetooth emitter of my system has such short range that I have to lay my phone on top of it in order to work

      • Iced Raktajino@startrek.websiteEnglish
        17 days

        Yeah. These are pretty short range and my house (block construction + metal roof) blocks the signals pretty well. Batteries are installed in the basement, and even upstairs I struggle to keep a signal, especially with a crowded 2.4 GHz wifi with all my smart bulbs, etc.

        Someone would have to be right at my doorstep to pull this off unless they hook up a directional antenna and point it right at them. Still, would be nice if I could just turn off Bluetooth since I can just use a wired serial connection. At least the inverter has an external Wifi/BT module I can just choose not to connect (it also has a serial connection for monitoring/config).

    • zod000@lemmy.dbzer0.comEnglish
      17 days

      That really sucks. My Solar system from my previous home used zigbee instead of bluetooth, but it was pretty much only for monitoring. I was glad that they failed to lock it down as getting access to that was the only way I could get to see interesting data, the company refused to let owners have access to their own data.

        • zod000@lemmy.dbzer0.comEnglish
          16 days

          It was Vivant Solar, but they have since been bought out by another company (apologies, I don’t recall the name) that also didn’t grant us access to data.

    • Creat@discuss.tchncs.deEnglish
      17 days

      There is a Bluetooth chip somewhere that is connected somehow. Assuming you can somehow get to it without destroying the battery, disconnecting it shouldn’t be difficult.

      • Iced Raktajino@startrek.websiteEnglish
        17 days

        I thought about that, but one of the safety features of these batteries an an active fire suppression system that fills the interior with some kind of fire-extinguishing foam. I’m terrified to try to take these apart for fear of somehow triggering that. Plus, they’re hella expensive lol.

    • Tar_Alcaran@sh.itjust.worksEnglish
      15 days

      Wait, mine requires I scan a QR code physically on the device, or typing in the serial number. You can just… connect without any security?

  • SayCyberOnceMore@feddit.ukEnglish
    17 days

    Govt. bans public use of APIs, but keeps them available for their own use…?

    I didn’t see anything about fining the manufacturers and securing the APIs…