Anyone Could Stop Electric Rickshaws in India With a Phone App (No Password Needed)

An app used in India to manage electric rickshaws has a serious security problem. Anyone with a smartphone can use it to stop any e-rickshaw remotely, with no password, login, or permission required.

This means a stranger could stop someone's vehicle while they are riding in it. The flaw highlights dangers that come with connecting vehicles to the internet without proper security measures. This directly affects people in India who ride in or operate electric rickshaws.

If you use these vehicles, someone could potentially stop your ride without warning. The broader lesson applies to anyone who uses connected vehicles, smart cars, or ride sharing services anywhere in the world. As more vehicles connect to apps and the internet, security flaws like this could affect many types of transportation.

If you are in India and use e-rickshaws, take these steps:

1. Be aware that your vehicle could be stopped remotely and have backup transportation options.
2. Report any suspicious stops to the rickshaw company and local authorities.
3. Ask your rickshaw service provider what security measures protect their vehicles. For everyone else:
4. Before using any connected vehicle service, research whether the company has experienced security problems.
5. Choose services from established companies with better security track records when possible. This incident is part of a larger pattern where convenience features get added to products without adequate security testing. Whether it's vehicles, home devices, or apps, connected technology should require strong passwords and proper access controls. When choosing smart devices or connected services, consider the security reputation of the company. Ask questions about how your data and control systems are protected before trusting new technology.