Engineer rewrites e-scooter firmware in Rust after reverse engineering CAN bus and Bluetooth

The project began with an observation: the scooter’s firmware update mode could bypass PIN security, prompting deeper investigation. This led to reverse engineering the Bluetooth protocol, revealing undocumented firmware update paths and hidden telemetry data. The scooter transmitted metrics like motor current, battery voltage, and driving history to the manufacturer without explicit user consent. This raises concerns about data privacy and transparency in consumer IoT devices, where telemetry is often buried in proprietary protocols.

Hardware analysis uncovered a non-compliant use of the USB-C port, repurposed as a CAN bus for internal communication. This required custom hardware to sniff and decode CAN frames, exposing the scooter’s internal messaging between components. The CAN bus carried critical data like speed, battery status, and control signals, which were not fully documented. This approach demonstrates how consumer hardware can be probed with minimal tools, but also highlights the risks of non-standard implementations that may violate USB-C specifications.

The firmware rewrite in Rust targeted the display unit, replacing the original proprietary code with a custom implementation. Rust’s memory safety and performance make it a compelling choice for embedded systems, though its adoption in firmware remains niche. The project’s success shows that even closed consumer devices can be modified with sufficient effort, but the lack of documentation and proprietary protocols impose significant barriers. This work underscores the trade-offs between security, openness, and aftermarket customization in embedded systems.

Security implications are notable: the scooter’s Bluetooth interface allowed firmware updates and VIN spoofing, which could enable unauthorized modifications or bypass safety limits. While the VIN spoofing attempt failed to unlock higher speeds, it revealed weak checks in the system. The project also exposed how easily hidden telemetry can be extracted, raising questions about user consent and data ownership. These findings suggest that consumer IoT devices often prioritize convenience over security, leaving them vulnerable to reverse engineering and exploitation.