The Convenience Trap: How Rentable IoT Became a City-Scale Attack Surface- 203
June 20, 2026
The proliferation of rentable IoT infrastructure is fundamentally challenging traditional security assumptions that rely on remote, distant attackers. The business model of these services—which necessitates easy, smartphone-based access for any user—makes it impossible to distinguish between legitimate customers and attackers. This report explores the structural security consequences of prioritizing user convenience, highlighting research by Hetian Shi that demonstrates how common vulnerabilities, such as shared authentication keys and easily accessible debugging ports, can be exploited to disable critical infrastructure like public EV charging networks at scale. These findings, which extend beyond specific geographies to include shared mobility services in Europe, underscore a critical need for security standards that reflect the infrastructure's true societal importance rather than its initial commercial design.
The security assumption underlying most connected infrastructure is that attackers operate at a distance — probing networks remotely, exploiting exposed services, attempting to reach devices they cannot physically touch. Rentable IoT infrastructure breaks that assumption by design. When the business model requires anyone with a smartphone to access, use, and interact with a device, the attacker and the paying customer are indistinguishable by definition. Hetian Shi, a hardware and IoT security researcher at Tsinghua University, spent his Black Hat Asia session exploring what follows from that observation, and demonstrated the answer live: from a conference hall in Singapore, in front of an audience that nominated the target city, he disabled a specific public EV charger in Shanghai's People's Square within seconds of selecting it from a charging app.
The vulnerabilities Shi found are not exotic. Shared authentication keys embedded in device firmware mean that a single compromised device exposes every device on the same network using the same key. UART connectors and debugging ports physically present on rentable hardware make firmware extraction straightforward for anyone willing to spend an afternoon with a rented device and basic electronics knowledge. Backend services that fail to properly authenticate users, and apps that cannot distinguish legitimate customers from phantom clients created by an attacker, compound the firmware-level weaknesses. Together these create what Shi describes as a structural consequence of prioritising user convenience: every security shortcut that makes a service easier to use for a legitimate customer also makes it easier to abuse.
The scale implications are what elevate this beyond a conventional IoT vulnerability disclosure. Because public EV charging networks in a given city typically share the same backend infrastructure and the same app ecosystem, the same technique that disabled one charger in People's Square can, Shi argues, disable every charger in the city simultaneously. That is not a theoretical possibility but a demonstrated capability extrapolated from a live, working exploit. The EV charging network is, in countries with significant electrification of transport, becoming critical infrastructure — a city whose charging network goes dark at rush hour faces consequences that extend well beyond inconvenience.
Shi tested eleven apps published by European providers of shared bikes and scooters and found the same category of vulnerability. The findings are not China-specific. The architecture of rentable IoT — centrally managed, app-accessible, physically open, optimised for frictionless user experience — reproduces the same security trade-offs regardless of geography. The developers building these services are not primarily security engineers, and their incentive structure rewards low-friction onboarding over attack surface reduction.
The policy implication is one that applies well beyond EV chargers: as shared mobility infrastructure becomes woven into the transportation fabric of cities, the security standards applied to it need to reflect its criticality rather than its commercial origins. A service that looked like a consumer convenience app when it launched may, three years later, be the infrastructure underpinning how a city moves. The security model should have been built for the latter, not the former.
