- A security researcher writing in The Hindu says e-rickshaw battery 'hacks' come from Bluetooth battery modules that lack authentication, not from apps built for sabotage.
- He argues that removing the apps from stores leaves vulnerable modules as they were, and that the gap lies in how parts are sourced and vetted.
- Companies that buy connected components should ask suppliers about authentication, firmware audits and part traceability before the parts reach production.
Taking an app off a store does not fix the part it talks to. That is the plain lesson from a week of viral e-rickshaw "pranks" in India. It also matters to any company that builds products from other firms' connected parts.
What happened
Karan is an independent security researcher in New Delhi. Writing in The Hindu, he describes a flood of videos. They show people using phone apps to switch off e-rickshaw batteries over Bluetooth. The apps named are BAT-BMS, Lossigy and Epoch-i-ion.
Most clips were posted as pranks. Some viewers guessed the apps were built for sabotage by Chinese manufacturers. Karan says the truth is "far less dramatic".
How the apps and the battery talk
A battery management system, or BMS, is a small module that watches a battery for faults. Overvoltage and undervoltage are two examples. In most vehicles, reading it takes physical access and a computer.
Makers have since added Bluetooth to these modules, Karan explains. A fleet owner or technician can then check a battery without taking the vehicle apart.
Apps like BAT-BMS search for devices that announce themselves as battery modules. They connect to one device at a time. They show diagnostic data and offer basic debugging functions. Karan says they were almost certainly not meant to disable as many vehicles as possible.
BAT-BMS is built to find modules from Jiabaida, a Chinese electronics company. Karan points to a public GitHub discussion from seven years ago. It recorded that Jiabaida modules have no authentication. Its author even posted a workaround.
Authentication means the module checks who is asking before it obeys. Without it, the module cannot tell a technician from a stranger. Karan says people appear to have found the gap over time and then exploited it. Short prank videos spread the misuse.
Two limits apply. The article does not say how many e-rickshaws use these modules. It also does not say which modules Lossigy and Epoch-i-ion target.
Why pulling the apps leaves the gap open
The official response went after the apps. Once the clips went viral, Google and Apple were told to delist several well-known battery tools. Karan argues this does not make weak modules any safer. It may also make life harder for owners who are trying to get their vehicles running again.
He draws a parallel with the reported Telegram block during the Re-NEET period. Suppose exam papers leaked, he says. The breach would happen at the source or in transit, not on Telegram. Blocking one platform would only move the sellers elsewhere.
In both cases, he sees the same habit. A tool becomes linked with harm, so the tool is treated as the harm.
This shows where the risk really sits. A diagnostic app is a visible symptom. The defect lives in a component that shipped without a lock.
A risk that was bought, not built
Karan notes that almost all e-rickshaw components come from China. Most makers import the electronics. At home, they do only the aluminium frame and chassis. That leaves the assembler holding every supplier's weaknesses, whether or not it knows about them.
The rules do not close that gap. Karan cites two gazette notifications dated 8 October 2014: GSR 709(E) and S.O. 2590(E). They set requirements for dimensions, tyres, brakes, horns and vehicle identification numbers. They give no detailed standards for electronic components.
Other countries, he writes, have tackled supply chain risk before a product reaches the assembly line. Their tools include vetting suppliers, auditing firmware, and tracing where parts come from and what they can do. Regulation can require these steps. He adds that a simple Google search seven years ago could have warned manufacturers about the BMS issue.
He argues that standards and liability should cover every product with electronic parts, not only vehicles. Cheap sourcing may suit a quick prototype, he says. Long-term production needs more care than placing a few orders and starting a line.
Questions to put to your team
Which wireless parts from outside suppliers sit inside the products we make, sell or run? Does each one require authentication before it accepts commands? Did anyone search public sources for known flaws before we bought it?
Do supplier contracts require firmware audits and part traceability? When a flaw becomes public, who owns the fix? And how do honest users keep the diagnostic tools they need while it is repaired?
A missing lock on a part is a purchasing decision long before it is a headline. Buyers who ask the question early pay less than those who learn the answer from a video.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Hindu.
