These Guys Can Hack An E-Skateboard

[Announcer] It turns out those electric skateboards

could be even more dangerous than they look.

Hackers have found a way to control them remotely,

leaving the rider in the lurch.

So a boosted skateboard is a small, electric vehicle

that's in the shape of a long board.

They go about 22 miles per hour

with a range of five miles or so.

You control the skateboard

using this handheld wireless controller here.

It's got a little throttle wheel on it,

so you can make the wheels go faster and slower.

[Announcer] Security researchers

Richard Healey and Mike Ryan

can hack into the controller's Bluetooth and take over.

Richard actually rides this everyday

as his daily commuting vehicle,

and we were curious as to how secure it was.

We found it was using Bluetooth smart, or BLE,

and it also turns out that they weren't using encryption,

so we found out that you could actually jam this guy,

and then we reverse engineer the protocol

so we could take over the skateboard.

They way we hack it is

first, we interrupt the connection

between the user's handheld controller and the skateboard,

and then we immediately connect to the skateboard

from a laptop,

and we issue commands to the skateboard

to tell it what to do.

The best thing you can do once you take over the skateboard,

is to tell the wheels, go full speed backwards.

In all the cases where Mike and I have done this,

except for one recording specifically,

you know it's gonna happen, right,

and you're already starting to brace yourself.

If someone actually tried to deploy this exploit

on an unsuspecting user,

the time between when we jam the Bluetooth signal

and when we replace it with our own malicious signal

instructing the board to do matching things,

is so short that you wouldn't have time to think anything.

I mean, you would be on the ground before you knew it.

[Announcer] The hackers will present their findings

at this year's DefCon Security Conference.

The purpose of this research wasn't to harm people,

or put people at risk.

The real issue is that people are already at risk,

and there are a lot of vendors trying

to either ignore or hide that fact.

The purpose of the research

is to expose the risk then hopefully mitigate it.