A university researcher just proved a city's EV chargers can be switched off with one script- 220

April 24, 2026

At Black Hat Asia, a Tsinghua University researcher showed a room full of security professionals something more unsettling than a proof-of-concept: he asked the audience to pick a Chinese city, pulled up a live app showing available public EV chargers, let the crowd choose a target, and disabled it in front of them in under two seconds. The demonstration was not an edge case. Hetian Shi's research suggests the entire model of rentable IoT infrastructure — EV chargers, shared e-bikes, shared scooters — has been built with convenience prioritized over security so consistently that a single attacker could plausibly take down an entire city's charging network on demand.

Shi's thesis rests on a structural weakness specific to rented IoT services: because anyone can rent the physical device, anyone can also examine it for vulnerabilities, turning every unit in the field into a free audit opportunity for an attacker. Working with ethical disclosure and permission, he found rentable devices exposing debugging ports or UART connectors that made their internals trivial to inspect, shared authentication keys baked into device firmware, and backend services that failed to properly authenticate users at all. On the software side, the provider apps consumers use to unlock and pay for these services proved just as porous — weak enough that Shi could generate phantom clients indistinguishable from real customers, enabling free charging or free scooter rentals, and exposing personal information through the same backend gaps. He packaged the exploit chain into a tool called IDScope and used it, live, against a real charging network in Shanghai's People's Square: audience members named a charger, Shi entered its ID into his script, and its status flipped from available to disabled within seconds.

The generalizability of the finding is what elevates it from a regional curiosity to an infrastructure concern. Shi tested 11 apps published by European providers of shared bikes and scooters and found comparable weaknesses, indicating the pattern is architectural rather than a single vendor's mistake. That matters because rentable IoT has expanded quietly into genuine urban infrastructure — EV charging networks in particular are being treated by cities as load-bearing components of transport and energy transition planning, not merely consumer conveniences. A demonstrated capability to disable availability at scale, city-wide, sits uncomfortably close to the kind of denial-of-service leverage this publication has tracked state and criminal actors pursuing deliberately against harder targets like water and rail systems — except here the vulnerability was found not by an adversary probing for weakness, but by a researcher demonstrating how little effort weakness-finding actually requires.