Some low-cost e-rickshaws reportedly use BMS units with default or no authentication credentials, exposing them to unauthorised access through publicly available mobile applications.
The Indian Computer Emergency Response Team (CERT-In) has received reports of a cybersecurity vulnerability in the battery management systems (BMS) used in some electric three-wheelers that could allow unauthorised individuals to abruptly switch off a moving e-rickshaw.
According to the ministry of heavy industries, the vulnerability is linked to the Bluetooth modules integrated into BMS units used in certain low-cost e-rickshaws. Some of these systems reportedly operate with default or no authentication credentials, allowing unauthorised users to connect through publicly available BMS mobile applications.
An attacker could potentially alter BMS settings or stop battery discharge, resulting in a sudden loss of power while the vehicle is in motion. CERT-In has identified mobile applications that can be used to remotely shut down the batteries of e-rickshaws and has reported them to the Ministry of Electronics and Information Technology (MeitY) for removal from application stores.
The ministry of heavy industries has also issued an advisory on Bluetooth-related BMS vulnerabilities in e-rickshaws to industry bodies, including the Society of Indian Automobile Manufacturers (SIAM), the Automotive Component Manufacturers Association of India (ACMA), and vehicle testing agencies.
The government has said that specific cybersecurity regulations for e-rickshaws and e-karts have not yet been framed. However, their battery safety requirements are governed by AIS-156, while electric powertrain safety must comply with AIS-038 Revision 2.
The Ministry of Road Transport and Highways has also published draft rules for vehicle cybersecurity covering L, M and N categories. The proposed framework refers to AIS-189 and AIS-190.
Under Rule 126 of the Central Motor Vehicle Rules, 1989, vehicle manufacturers and importers must submit prototypes to notified testing agencies. These agencies issue type approval certificates after verifying compliance with the Motor Vehicles Act and central motor vehicles rules (CMVR) provisions.
The information was provided by minister of state for heavy industries Bhupathiraju Srinivasa Varma in a written reply to the Lok Sabha.
