A disturbing new cyber-physical prank is making headlines across northern India, where a popular battery monitoring application has been weaponized by pranksters to remotely shut down moving e-rickshaws. The app, known as BatBMS (Battery Alarm Telematics Battery Management System), was never intended for such use, yet a glaring lack of authentication has turned thousands of commuter vehicles into easy targets for anyone with a smartphone. This situation serves as a stark reminder of the dangers lurking in the insecure design of internetaa-connected devices, a phenomenon often discussed by cybersecurity experts like Graham Cluley on the Smashing Security podcast.
How the BatBMS App is Being Used to Stop E-Rickshaws
The prank exploits the design of BatBMS, an app developed by a Chinese company for managing solar panels and marine batteries. Its function is to connect via Bluetooth to specific lithium battery management systems, providing users with data on charge level, voltage, and temperature. Crucially, it also includes a feature to completely disable the battery’s power output for maintenance. The original design assumed that anyone within Bluetooth range (typically 10 to 15 meters) was the legitimate owner of the battery. Consequently, the app requires no password, pairing code, or any form of authentication to establish a connection and take control.
In northern Indian cities like Delhi, where thousands of battery-powered e-rickshaws (locally known as “thiris”) are a core part of daily transportation, this represents a critical flaw. Many of these vehicles use battery packs compatible with the BatBMS system. A prankster standing on a busy street can simply open the app, scan for nearby devices, select a target, and tap a button to cut power. The result is an immediate and complete loss of power, causing the vehicle to come to an abrupt halt, potentially endangering the driver, passengers, and other traffic. Videos of these incidents have been widely shared on social media platforms like YouTube and TikTok, showing drivers stranded and struggling to understand why their vehicle has stopped.
Is the Remote E-Rickshaw Shutdown a Crime?
While many online observers find the videos amusing, the implications are serious. For the drivers, whose e-rickshaw is often their primary source of income, a stalled vehicle means lost earnings. The practice also poses a clear public safety risk, as a sudden stop in heavy traffic can easily lead to accidents. According to reports featured on the Smashing Security podcast, local computer security experts have stated that an e-rickshaw, by virtue of its computerized battery management system, qualifies as a computing device under Indian law.
Therefore, unauthorized access to it constitutes a criminal offense. Under India’s Information Technology Act, perpetrators could theoretically face up to three years in prison and fines of up to ₹500,000 (approximately £4,500). However, practical enforcement remains a significant challenge. Identifying the individual standing nearby holding a smartphone who caused the shutdown is difficult, and convincing local law enforcement to pursue such a case is another hurdle entirely. Despite these practical difficulties, the act of hijacking a vehicle’s controls without consent is a clear violation of computer misuse laws.
How the BatBMS Vulnerability is Being Patched
In response to the widespread misuse and public outcry, authorities have intervened. The Indian government has reportedly instructed both Google and Apple to remove the BatBMS app, along with similar applications capable of the same exploit, from their respective app stores. The Chinese manufacturer of the battery system has also pushed out an update to the app that now requires a password to be entered before granting access to the battery’s controls.
However, this fix has a significant limitation. The vulnerability involves two components: the app on the phone and the firmware on the battery’s internal Bluetooth transmitter. While the user-facing app can be updated easily, the underlying firmware on the battery also needs to be patched to actually enforce the new password requirement. The process for updating firmware on these devices is not straightforward for most drivers. Many may not be aware of the problem, may not know how to perform the update, or may not have a compatible device to do so, meaning a large number of e-rickshaws may remain vulnerable for an extended period.
The Broader Implications for IoT Security
The BatBMS incident is a textbook example of a pervasive security flaw in the Internet of Things (IoT): the assumption that physical proximity equals authorized access. This “no password by default” approach has been a source of vulnerabilities in everything from baby monitors to medical devices for years. The case highlights a critical failure in the product’s design lifecycle, where a feature intended for maintenance convenience was exposed to anyone within Bluetooth range without any security controls.
This is not merely a prank; it is a vulnerability that allows a stranger to take control of a moving vehicle. The incident should serve as a powerful lesson for manufacturers of any connected device—whether a battery, a smart plug, or a security camera. Implementing robust, mandatory authentication mechanisms should be a foundational requirement, not an afterthought. For consumers, it emphasizes the importance of researching the security posture of the smart devices and components they rely on for safety and their livelihood.
What Affected E-Rickshaw Drivers and Users Should Do Now
If you or someone you know operates an e-rickshaw using a compatible battery management system, the immediate priority is to check for and install any available firmware updates for the battery itself. This may require contacting the battery supplier or manufacturer for guidance. The most effective long-term solution is to ensure that authentication is properly configured. Users should be proactive in setting a unique and strong password on the system once the patch is applied, and they should verify that this password is actually enforced before anyone can control the battery. This incident is a potent reminder that any device with a network connection is a potential attack surface, and that treating all connected components with a security-first mindset is no longer optional.
