# What's the fuss all about - Chinese e-rikshaw ? Recently, the [BAT-BMS](https://timesofindia.indiatimes.com/business/india-business/centre-removes-bat-bms-linked-apps-from-app-stores-after-e-rickshaw-remote-shutdown-reports/articleshow/132155150.cms) hack scam in India seems to be a hot talking point, with the Government of India doing the usual stuff: “Let’s ban some fucking apps.” But it’s not just the app. It’s the integration ecosystem. First of all, I despise the pranksters who used this cheap, worthless so-called trick to abuse poor people and disrupt their livelihoods. And it is good that the government cleared that anyone doing this will be penalised and charged. With that being said, being a grey hat as a rule — you never touch the poor people. You only take and destroy from the ones who have no value for it. A lot of my LinkedIn feed is filled with garbage AI-generated images showing weird BMS block diagrams, unusually crowded workflows, apps, dashboards, arrows, and all kinds of stupid diagrams. I literally blocked those posts or removed them from my feed. It is evident that a lot of people are getting their inners wet to lubricate content generation out of this — just for popularity, engagement, and to show how cool they are. Most are not ! [![Courtesy TOI](https://cdn.hashnode.com/uploads/covers/690de576a51af7311ea8bc73/22a80f33-3229-431f-8400-cf0ba7e60665.png align="center")](https://timesofindia.indiatimes.com/business/india-business/centre-removes-bat-bms-linked-apps-from-app-stores-after-e-rickshaw-remote-shutdown-reports/articleshow/132155150.cms) So let’s actually break down what is happening. ### What we know so far ? A mobile app or a bunch of apps from Chinese companies are able to pair with an unprotected BMS system and execute commands against the BMS control functions. One of those commands can disengage the discharging circuitry, which effectively disables the motor control function on the actual vehicle. Pretty sad, and fuck this shit. These apps come with BMS control commands already built into them. For any app to talk to such a controller, it must either understand the controller protocol or translate its own UI actions into the protocol that the controller accepts. This communication is realised through Bluetooth as near-end communication, most likely over BLE GATT. At a very basic level, Bluetooth GAP handles discovery, advertising, and connection setup. It allows a nearby device to see the BMS, initiate a connection request, and, after pairing or connection, hand over the actual data exchange to something like GATT. GATT is where the actual shit happens: the app discovers services and characteristics, subscribes to notifications, and writes command payloads to the BMS. So the flow is basically: phone app finds BMS over Bluetooth → connects / pairs if required → discovers GATT service → finds writable characteristic → sends command payload → BMS accepts command → discharge circuitry gets disabled → motor control is effectively dead. And seriously, who the fuck lets a BMS expose this kind of control over Bluetooth without proper protection? Fucking noobs. This is not Chinese-app specific. Any app developed for this kind of functionality would need to do the same basic thing: discover the BMS, speak its protocol, and send commands that the BMS understands. So banning the app is not the real solution. The actual problem is the integration ecosystem: unprotected BLE interface + weak or no pairing/authentication + writable GATT characteristic + BMS accepting safety-relevant control commands + no proper ownership binding + no proper command authorization = remote/local abuse waiting to happen. The app is can be made by anyone if he knows what protocol the BMS understands for controlling battery functions or management functions. Unfortunately I do not have the BMS with me. But most likely this is pretty standard stuff. It would have been great if someone did a packet capture of the communication between the APP and the BMS BT to see what protocol and C&C it talks to and how a command - to engage "Discharge MOS" might have been implemented. But NO, people want to ruin all the fun and let the government step in and impose a BAN. Some snapshot from some app - pretty clear what it can do - but how does it do it ? ![Image from an Alternative BMS control App](https://cdn.hashnode.com/uploads/covers/690de576a51af7311ea8bc73/1297352e-fbdf-4ff8-acf4-8be8425d0c99.png align="center") If the APPs have such level of control on unpaired or insecure communication channels then it's not a security problem - cos there ain't any. Unfortunately such default and open configurations can have devastating consequences as seen in this case with livelihood and yes any connected function affecting safety of a function and a direct path to it without any protection or controls or mitigations in place is surely a nightmare ! ### Why did the government ban only a few apps ? The best theory is cos that's what pranksters were using - someone in the government must tell the ministry of BAN that there are a huge number of such apps that would still be able to control the BMS's bluetooth. Here is a list of some more here ( I had to remove this list). Items in this list can be fairly easily be found and corrected. Disclaimer - do not use these apps to get yourself h\*\*\*\* on the road. ### The Interesting Question - Why are these apps able to control BMS ? Cos they all probably talk the same protocol that these BMS systems understand. I am not a BMS expert so unaware of the protocols in use or the way they are supposed to control the battery functions (I can find out, but I don't have so much time right now) So imagine, Chinese BMS vendors - all go a sit in a room, and think hey how can app from my company control the BMS from your company and vice-versa ? The solution - tada - let's define a command and control protocol that we all agree to and code that in our BMS and our Apps. Someone else - Why would you do such thing guys ? - cos we want to standard size the interface that the BMS and App can talk so we sell this stuff separately to buyers probably from all over the world so we want cross-functionality to work as we in some cases might now have control over which BMS is integrated with which vehicle - so someone having BMS from company A can rest assured that app from company B can talk to it ? Don't believe me - I had a look at a couple of such apps and they seem to support this theory(reality). (This is a very shallow analysis done in absence of dedicated time) ### What is the problem and is not yet solved ? The problem lies in the fact that India and a lot of other countries take a [lot of stuff from China](https://www.cnbc.com/2025/10/29/india-is-dependent-on-china-for-electronic-components-now-its-trying-to-change-that-.html) - believe or not its true and assembly is done in India and that's how low cost businesses or low tech reassembled businesses are done. Here is the statistics for electronic imports from China - [here](https://tradingeconomics.com/india/imports/china/electrical-electronic-equipment) and some or most of it gets assembled at various places thats how some money is made with cheap items with no guarantee. ![](https://cdn.hashnode.com/uploads/covers/690de576a51af7311ea8bc73/ad7c03f7-a2d4-489d-9577-5be9db845bd7.png align="center") What does this really mean, is that a lot of assembled technology coming in as spare parts or BOM' (bill of material) for an integrated component are not usually secure enough and have only bare minimum that is functionality and this is probably why the cost is low. Now imagine our previous example of Chinese companies A and B, one makes the BMS system, the other makes the app and both have agreed on what protocol and commands to use, and what functionality to expose. Now multiply this with various such configurations: company A makes the BMS, company B makes the app, company C clones or rebrands the same BMS, company D ships another app for the same or similar controller, and so on. This then gets propagated to global customers in a completely asymmetric way. The hardware may come from one supplier, the Bluetooth module from another, the app from another, and the branding from yet another. To the end customer, it looks like different products from different vendors, but underneath, the same tech, same controller family, same BLE profile, or same command protocol may be shared across multiple brands. This is why vendor identification becomes messy for overseas customers. You may think you are dealing with company C, but the actual BMS controller logic may come from company A, the app protocol may come from company B, and the final product may just be rebranded and sold through company D. I am not an expert in export and international trade, so this is not a trade-analysis claim. This is logical guesswork based on my previous experience dealing with supply-chain security. But from a product-security perspective, this kind of rebranding, cloning, protocol reuse, and shared underlying tech is exactly the kind of mess that makes these issues hard to trace and easy to underestimate. Once such systems are procured by assembly companies and hubs in India sometimes under the disguise of "[Make in India](https://indianexpress.com/article/business/market/china-dominates-supply-of-electronic-components-for-made-in-india-products-9519844/)" the supply chain of the entire BOM is coming from several disconnected or single supplier to realise a whole system, in this case the "e-Rikshaw". ![](https://cdn.hashnode.com/uploads/covers/690de576a51af7311ea8bc73/d9c8b2ab-e699-4a88-81ef-7a2a099bf99e.jpg align="center") ### APP-BMS Command Analysis I ran some analysis on some of the apps in this area that were banned and also the other ones that are mentioned in the paste bin. They all support BLE GATT and the best way to summarise them would be understand the command and payload structure they use to talk to the target BMS. As pointed out earlier, BMS company A may support multiple protocols that may be supported by a dedicated APP or a bunch of Apps named differently to increase market penetration. Below table shows some of the similarities and dissonance. High Level "GATT-Shit" - Redacted of course cos I don't want the stupid not so legal government to BAN me. ![](https://cdn.hashnode.com/uploads/covers/690de576a51af7311ea8bc73/46bd9c98-4dd4-4d6f-81a5-29837182dc15.png align="center") Banned App protocol Payloads ![](https://cdn.hashnode.com/uploads/covers/690de576a51af7311ea8bc73/34ec0bea-0b3c-4ca4-b979-c5424a621a25.png align="center") Important: - There could be some differences in the exact payload and apps from actual Playstore - these apps were picked up from some random corner of the internet and may not be the accurate. After seeing this table - one can see why the government only banned specific apps - probably cos the command and control and payload formatting they support is understood by the target BMS in the electric rickshaws that were part of the disruption. However, this also doesn't mean that other apps in the market can't control the same BMS with similar precision. Without a few actual BMS'es and Apps and some simple dynamic analysis and packet capture could conclude on this problem but without it I can only guess it to a certain extent. The point to convey is "This is not a model that the vendor wants - its a problem of integration when there is no control and things are expected to just work without any oversight - but end up getting royally abused as in this case" Just like this eco-system of BMS'es and its apps there are other similar areas in which similar concept are used when integration and assembly is concerned. ### Putting it all together Bottom line: * Some e-rikshaw integrator sources components from China like BMS and APP * Assembles them into a functional product and ships them to customers only to realise its a security nightmare later * No one is at fault here - as this is low-cost equipment and is not seriously a cybersecurity hardening contender from a Chinese point of view, cos they dont care how you integrate them. Unfortunately, people on the internet and the Linkedin keyboard warriors are leveraging this without actually understanding the problem and just using to milk some views like and create misinformation about - this and this specific problem cannot be solved no matter how hard you try - cos you don't control the supply chain security here - at least not yet - Imagine a e-rikshaw integrator trying to convince a Chinese BMS and App vendor to incorporate Cybersecurity controls and request a Pentest and a TARA report. The fucking shit would cost them more money to just do that instead of making it functional and it doesn't come with warranty. I am also seeing people trying to pitch business solutions and rooting for some make in India garbage thats not worth the knowledge their paycoheck can cash in, by showing or instilling fear that this and only this is the problem and here is how our snake oil solution solves it. ### Some Questions to ask ? 1. Which BMS'es are imported or used in such vehicles or others ? 2. How many of them come from China and How many from India ? 3. For sure Security is a distant dream for assembled components but who in India is taking this side seriously ? Most of them are pitching marketing shit on your face. 4. To what other industries is this supply chain problem applicable ? probably a lot and a lot more when you already made a list. 5. Who's responsible for such 3rd grade products or accountability ? 6. Quality and Low Cost doesn't go hand-in-hand in India ? 7. How many people and companies out there don't know shit about this and are trying to make money using this news ? probably lots I wrote this purely out of frustration cos I can't literally stand my Linkedin feed right now which has AI generated garbage images and some random dude who thinks he works in automotive cybersecurity but throws generated LLM's puke and claims. Note: Feel free to suggest technical changes/corrections to the protocol payloads in GATT from these apps. And please reach out if you have any BMS'es from China. Actual protocol and payload values are redacted for obvious reasons - if someone wants them please reach out to me. DISCLAIMER: If someone misuses this information then you are on your own and I take no responsibility for your stupid shit. No details about how to find these payloads is mentioned in this and this article is free from any liabilities.