BT Explainer: How EV kill switch BAT-BMS app works and how to prevent misuse

In recent weeks, social media has been flooded with videos showing individuals halting moving e-rickshaws on busy streets using just their smartphones. While it may seem like a harmless prank, this phenomenon has revealed a significant security vulnerability in the battery management systems of electric vehicles (EVs). Reports indicate that this flaw stems from certain Bluetooth-enabled battery systems that allow unauthorized users to connect and disable the vehicle's power. The technology at the center of this issue involves the lithium-ion batteries used in modern e-rickshaws, which are equipped with Bluetooth-enabled Battery Management Systems (BMS). These systems are designed to monitor critical data such as charge levels, voltage, temperature, and overall battery health. To facilitate this monitoring, many owners use companion apps, with BAT-BMS being the most prevalent. The crux of the problem arises from budget battery packs that ship with their Bluetooth functionality activated by default, lacking any password or authentication measures. This oversight permits anyone within approximately 15 meters to connect to the battery using the compatible app and activate a "Discharge Switch," which cuts off power to the vehicle. As a result, the e-rickshaw effectively comes to a halt and cannot be restarted until the battery is reactivated through the same app. BAT-BMS, developed by Shenzhen Grenergy Technology, allows users to track battery charge (SOC), voltage, current, and temperature, along with battery health and charging cycles, all within a 15-meter range thanks to Bluetooth 5.0 connectivity. However, the absence of basic security measures like passwords makes it a potential target for misuse. It's important to note that not all electric vehicles are at risk. Older e-rickshaw models that operate on lead-acid batteries are unaffected, as they lack Bluetooth capabilities. Additionally, newer lithium-ion systems are increasingly incorporating password protection or proprietary apps that prevent unauthorized access, limiting the concern primarily to low-cost Bluetooth BMS units. Fortunately, the security issue can be mitigated without the need for new hardware. There are several strategies that vehicle owners can implement to safeguard against unauthorized app access and enhance the security of their electric vehicles.