The Indian government has directed Google and Apple to take down three mobile applications, BAT-BMS, Lossigy, and Epoch-i-ion, after they were allegedly misused to remotely disable e-rickshaws and other battery-operated three-wheelers mid-journey, putting passenger safety at risk. Authorities have also warned that any additional apps found to enable similar remote-kill functionality will face the same consequences. The order follows a wave of viral videos showing individuals using these apps to locate nearby e-rickshaws via connected battery management systems and switching them off with a single tap, sometimes while vehicles were in motion carrying passengers. These apps were originally designed as legitimate Battery Management System (BMS) tools, allowing fleet operators, financiers, or vehicle owners to monitor charge levels, track location, and remotely immobilize vehicles in cases of loan default or theft. The misuse arose when this remote-kill switch capability was exploited by unauthorized actors, including rival financiers, disgruntled individuals, or even pranksters, to disable e-rickshaws belonging to other operators, regardless of legitimate ownership or consent. Indian Govt Bans Apps Being Misused Unlike a standard vehicle-tracking app, apps like BAT-BMS, Lossigy, and Epoch-i-ion reportedly retained an always-on API or Bluetooth/cellular link between the e-rickshaw’s battery controller and the app’s backend, meaning any user with access credentials, sometimes weakly protected or shared across dealer networks, could send a shutdown command remotely. This design flaw effectively turned a fleet-management convenience feature into a safety hazard, since it lacked adequate authentication controls, driver consent verification, or geofencing restrictions to prevent third-party interference. Security researchers have long flagged that IoT-enabled kill switches in low-cost electric vehicles are particularly vulnerable because manufacturers often prioritize cost and functionality over robust access control, leaving credential leakage or insider misuse as an easy attack vector. While specific enforcement details for this case remain limited in public disclosures, India has a well-established precedent for such interventions: the Ministry of Electronics and Information Technology has previously invoked Section 69A of the Information Technology Act to block applications deemed prejudicial to public safety and order, as seen in the 2020 ban of 59 apps citing security concerns. This same legal framework, combined with directives issued to app stores appears to underpin the current action against BAT-BMS, Lossigy, and Epoch-i-ion, following a similar pattern where state or central cyber units formally notify Google and Apple to remove non-compliant or unsafe apps from their platforms, as recently demonstrated when Maharashtra Cyber ordered the removal of unauthorized bike-taxi apps over passenger safety violations. This incident underscores a growing concern around IoT-enabled remote disablement features embedded in affordable electric vehicles across India’s booming e-rickshaw and last-mile mobility sector. As BMS vendors race to add remote-lock and anti-theft features to compete in a price-sensitive market, weak authentication and poor access segregation can transform safety features into attack surfaces. Recommendations for Fleet Operators Enforce multi-factor authentication for any app command capable of remotely disabling a moving vehicle. Implement geofencing and speed-based lockouts to prevent shutdown commands while a vehicle is in transit. Maintain audit logs of every remote command issued, tied to verified device ownership. Conduct third-party security audits of BMS backend APIs before public release.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now . The post Indian Govt Bans Apps Being Misused to Stop E-Rickshaws Remotely appeared first on Cyber Security News .

The Indian government has ordered the removal of BAT-BMS, Epoch Li-ion and Lossigy apps after reports they were allegedly used to remotely disable e-rickshaws via Bluetooth. Here's everything you need...

Introduction: The Indian government’s recent directive to remove seven mobile applications—including BAT-BMS, Lossigy, and Epoch-i-ion—from app stores has exposed a critical cybersecurity vulnerability in the nation’s rapidly expanding electric vehicle ecosystem. These apps, designed as legitimate diagnostic tools for monitoring battery health, were allegedly being misused to remotely disable e-rickshaws mid-journey via unsecured Bluetooth-enabled Battery Management Systems (BMS), leaving drivers stranded and passengers at risk.

India’s electronics ministry ordered app-store removals for BAT-BMS, Epoch-i-ion and Lossigy after reports that Bluetooth battery-management controls could disable e-rickshaws remotely. The removal order covers

The Indian government has directed Google and Apple to take down three mobile applications, BAT-BMS, Lossigy, and Epoch-i-ion, after they were allegedly misused to remotely disable e-rickshaws and other battery-operated three-wheelers mid-journey, putting passenger safety at risk.

Social media feeds over the past week have been flooded with videos of people accessing the battery management systems (BMS) of electric rickshaws and loaders to remotely disable the vehicles. While the videos may have amused the pranksters and viewers, they left drivers stranded, disrupted trips, and raised concerns about the security of connected EV systems. At the centre of the controversy are the BMS that communicate through widely used mobile applications such as BAT BMS, Lossigy and Epoch Li-ion, with a few of these apps being of Chinese origin. These apps connect to the BMS over Bluetooth, allowing users to monitor battery health, charge levels, voltage, temperature, and discharge behaviour. A BMS is an embedded controller inside a lithium-ion battery pack that monitors these parameters while also preventing overcharging and overheating. However, experts say the BMS installed in budget EVs lack adequate authentication mechanisms or rely on default access settings. Consequently, anyone within the Bluetooth range – typically 10-15 metres – can connect to the BMS using the aforementioned apps. Depending on the BMS configuration, users can view battery data or issue commands to disable the battery’s output, making the vehicle inoperable. In simple terms, the person is not...

The Indian government has directed Google and Apple to take down three mobile applications, BAT-BMS, Lossigy, and Epoch-i-ion, after they were allegedly misused to remotely disable e-rickshaws and other battery-operated three-wheelers mid-journey, putting passenger safety at risk. Authorities have also warned that any additional apps found to enable similar remote-kill functionality will face the same consequences. The order follows a wave of viral videos showing individuals using these apps to locate nearby e-rickshaws via connected battery management systems and switching them off with a single tap, sometimes while vehicles were in motion carrying passengers. These apps were originally designed as legitimate Battery Management System (BMS) tools, allowing fleet operators, financiers, or vehicle owners to monitor charge levels, track location, and remotely immobilize vehicles in cases of loan default or theft. The misuse arose when this remote-kill switch capability was exploited by unauthorized actors, including rival financiers, disgruntled individuals, or even pranksters, to disable e-rickshaws belonging to other operators, regardless of legitimate ownership or consent. Indian Govt Bans Apps Being Misused Unlike a standard vehicle-tracking app, apps like BAT-BMS, Lossigy, and Epoch-i-ion reportedly retained an always-on API or Bluetooth/cellular link between the e-rickshaw’s battery controller and the app’s backend, meaning any...

Government removes BAT-BMS, Epoch Li-ion and Lossigy apps after reports of remote e-rickshaw shutdowns. Here's how the BMS issue worked and whether other EVs are affected.