obike

oBike 协议说明（BLE/HTTP） 本文档提供了截至 2018 年 1 月 oBike 通信协议的分析。 相关成果已在 insomni'hack 安全大会 2019 上展示： 幻灯片 录像 同时也在 AREA41 安全大会 2018 上展示： 幻灯片 录像 通用 oBike 通信 oBike 车锁由 TI CC2541 微控制器构成，这是一款用于蓝牙低功耗（BLE）应用的功耗优化型片上系统（SoC）。车锁本身不具备 IP 连接能力；它借助移动设备的 3G/4G 连接与 oBike 后端进行通信。车锁通过 BLE 与移动设备上的 oBike 应用通信。协议消息随后通过 REST AP...

EUVD-2018-8094

Malware in sbrugna...

CVE-2018-16242

oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy BLE to replay ciphertext based on a predictable nonce used in the locking protocol...

CVE-2018-16242

oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy BLE to replay ciphertext based on a predictable nonce used in the locking protocol...

Design/Logic Flaw

oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy BLE to replay ciphertext based on a predictable nonce used in the locking protocol...

CVE-2018-16242

oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy BLE to replay ciphertext based on a predictable nonce used in the locking protocol...

CVE-2018-16242

The CVE-2018-16242 entry describes oBike’s use of Hangzhou Luoping Smart Locker, where an attacker can bypass the locking mechanism by replaying ciphertext in a BLE-based protocol that uses a predictable nonce. Affected component is the bicycle lock system's BLE lock protocol; the underlying issu...

oBike Electronic Lock Bypass

CVE-2018-16242 - oBike Electronic Lock Bypass Product: oBike bicycle-sharing service Vendor: oBike Inc. CVE ID: CVE-2018-16242 Subject: Access control bypass by replay attack on predictable nonce Effect: Unauthorized unlocking of bikes, cirumventing the ride-fees Author: Antoine Neuenschwander...