Hacking an Egret GT e-scooter: hidden CAN bus, silent telemetry, and a Rust rewrite

A tinkerer set out to understand the internals of his Egret GT e-scooter and turned up several questionable design choices along the way. Reverse-engineering the companion mobile app revealed that the scooter streams far more data over Bluetooth than it displays to the owner — driving-mode dwell time, device temperature, motor current, battery voltage, and charging history among them. Some of this, including odometer readings and charge history keyed to the scooter’s ID, is quietly relayed back to the manufacturer without any clear disclosure in the app. He also found weak identity handling: the scooter learns its VIN only when the app sets it, so a Bluetooth debug tool can spoof the model, and holding a keypad button at boot drops into a firmware-update mode that then lets you ride away without entering the PIN.

The more interesting find was physical. The display’s USB-C port, advertised by the manufacturer as charge-only, turned out to carry a CAN bus on two of its pins — a decidedly non-compliant use of the connector. Using a cobbled-together rig built from an ESP32-C6, an SN65HVD230 transceiver, and an MCP2515, he sniffed the bus during startup and began logging and decoding the frames exchanged between the display, controller, and button panel, including what appear to be firmware version strings sent over the wire.

Beyond the novelty, the writeup is a useful case study in consumer IoT security: undisclosed data collection, authentication that leans on trivial client-set values, an update mode that sidesteps the lock, and a debug-friendly bus exposed through a port sold as innocuous. It’s the groundwork for the author’s larger goal of replacing the stock firmware with his own Rust implementation.