FRESH

Hacker News

Reverse engineering Lyft Bikes for fun (and profit?)

76 points by ibigio

by ibigio

2 subcomments

Howdy.
Back in 2019 I reverse engineered the lyft bikes api to unlock them from my bed. It's one of my favorite stories, and after telling it dozens of times I finally decided to write it up in its full technical glory.
I used to love learning about security through blog posts/writeups, so I tried to include as much detail as possible. Let me know if you like this style!

by MarleTangible

3 subcomments

You'd generally expect a company like Lyft to pin its certificates, so it's notable that they don't. Any ideas as to why?

by adamgoodapp

1 subcomments

I used Charles to help me get endpoints for controlling my automatic cat toilet. The Chinese based iOS app was horrible to use and who knows what data it collected.
After getting the endpoints, I was able to plug it directly into Home assistant.

by cptskippy

3 subcomments

> Geofence bypass: As far as I understand, there's no easy way to enforce a geofence server-side other than timing, consistency, etc. You sort of just have to trust whatever the phone tells you.
There's no fool proof method but you can make it very hard and impractical.
Both Apple and Google offer attestation mechanisms to confirm the integrity of the App and Device Environment that it's running on. This ensures that the API requests are coming from an attested device.
To mitigate the MITM attack you can use TLS Certificate pinning on sensitive API requests.
You could have the server side API provide a session specific signing token that the App uses to sign payloads attached to API calls.

by pentamassiv

0 subcomment

Fun read!
Now that some bikes have electronic shifting, you can attack the bike itself. I wrote two blog post about how to downgrade the Shimano Di2 shifters and do a replay attack to remotely shift it. You can find them here:
https://grell.dev/blog/di2_downgrade https://grell.dev/blog/di2_attack

by codetheweb

0 subcomment

this is cool! funnily enough I just did something very similar last weekend: https://github.com/codetheweb/bay-wheels-py

by sampton

1 subcomments

You never know with corporations. Consequences range from "federal pound-in-the-ass prison" or "here is $500".

0 subcomment

by knowitnone3

1 subcomments

you've unlocked hundreds of bikes under your account. That would mean you've reserved the bike and therefore have to pay for damage/loss of property?

by fainpul

0 subcomment

Another "bike hack" if you're into that (from 2004 and in German):
https://www.ccc.de/hackabike/