BLE authentication design challenges on smartphone controlled IoT devices: analyzing Gogoro Smart Scooter

Smartphones are commonly used as the controller and Internet gateway for BLE-enabled IoT devices. Designing a strong authentication protocol between them is the key part of IoT security. However App design has challenges such as limited input / output interfaces and privacy protection standards. Due to these restrictions, many vendors has given-up BLE build-in security manager and choose to build their own authentication protocols.

This study focused on the method to analyze these BLE protocols, discovering and solving these challenges. We applied this method on commercial products, including popular Gogoro Smart Scooter from Taiwan. We will demo under some certain circumstances we are able to dump key used to unlock your Gogoro Scooter and send fake BLE signals to steal your scooter.

Download Slides

About the Speakers

Shi-Cho Cha

Shi-Cho Cha (CSC) is currently an associate professor at the Department of Information Management in the National Taiwan University of Science and Technology, where he has been a faculty member since 2006. He received his B.S. and Ph.D. in Information Management from the National Taiwan University in 1996 and 2003. He is a certified PMP, CISSP, CCFP and CISM.

From 2000~2003.He was a senior consultant in eLand technologies and played the role of project leaders to develop several systems about e-marketing. From

2003~2006, he was a manager at PricewaterhouseCoopers, Taiwan and helped several major government agencies to develop their information security management systems. Recently, he helped NTUST to establish security analysis workforce and help several organizations to evaluate their system security. His current research interests are in the area information security management, identity management, smartphone security, and IoT security.