How I Unlocked a City's Electric Scooters Remotely
Remotely Unlocking Electric Scooters
A security researcher found a way to remotely unlock electric scooters from a fleet in his city. Starting with public WordPress enumeration, he identified an admin account, brute-forced its weak password, and gained access to the operations panel. The panel allowed him to view the entire fleet map, user data, and financial modules, and even send commands to unlock and lock a physical scooter. The root cause: no rate limiting, a 950-day admin token, and no extra confirmation for IoT commands.
The password was the only thing standing between the open internet and a button that moves physical hardware.