Nyon Unchained: Forensic Analysis of Bosch's eBike Board Computers

• URL: http://arxiv.org/abs/2404.12864v1
• Date: Fri, 19 Apr 2024 13:03:14 GMT
• Title: Nyon Unchained: Forensic Analysis of Bosch's eBike Board Computers
• Abstract summary: The Bosch Nyon series of board computers are cutting-edge devices from one of the market leaders in the eBike business. We conducted an in-depth forensic analysis of the two available Nyon models released in 2014 and 2021. On a first-generation Nyon device, Telnet access could be established by abusing a design flaw in the update procedure. It was possible to forge the data on the device and transfer it to Bosch's servers to be persisted across their online service and smartphone app.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Modern eBike on-board computers are basically small PCs that not only offer motor control, navigation, and performance monitoring, but also store lots of sensitive user data. The Bosch Nyon series of board computers are cutting-edge devices from one of the market leaders in the eBike business, which is why they are especially interesting for forensics. Therefore, we conducted an in-depth forensic analysis of the two available Nyon models released in 2014 and 2021. On a first-generation Nyon device, Telnet access could be established by abusing a design flaw in the update procedure, which allowed the acquisition of relevant data without risking damage to the hardware. Besides the user's personal information, the data analysis revealed databases containing user activities, including timestamps and GPS coordinates. Furthermore, it was possible to forge the data on the device and transfer it to Bosch's servers to be persisted across their online service and smartphone app. On a current second-generation Nyon device, no software-based access could be obtained. For this reason, more intrusive hardware-based options were considered, and the data could be extracted via chip-off eventually. Despite encryption, the user data could be accessed and evaluated. Besides location and user information, the newer model holds even more forensically relevant data, such as nearby Bluetooth devices.

Related papers

• MoLIFE: Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination [38.124461963829376]
  This paper presents a novel Digital Forensics (DF) methodology for data acquisition and analysis of mobile devices.<n>The proposed methodology is based on NIST SP800-101 for the DF process.<n>MoLIFE can be integrated with new and emerging technologies by exploiting their power.
  arXiv  Detail & Related papers  (2026-07-08T10:51:22Z)
• ScaleCUA: Scaling Open-Source Computer Use Agents with Cross-Platform Data [119.41354691583899]
  ScaleCUA is a step toward scaling open-source computer use data and foundation models.<n>It offers a large-scale dataset spanning 6 operating systems and 3 task domains, built via a closed-loop pipeline uniting automated agents with human experts.
  arXiv  Detail & Related papers  (2025-09-18T17:59:22Z)
• Your Car Tells Me Where You Drove: A Novel Path Inference Attack via CAN Bus and OBD-II Data [57.22545280370174]
  On Path Diagnostic - Intrusion & Inference (OPD-II) is a novel path inference attack leveraging a physical car model and a map matching algorithm. We implement our attack on a set of four different cars and a total number of 41 tracks in different road and traffic scenarios.
  arXiv  Detail & Related papers  (2024-06-30T04:21:46Z)
• Machine learning-based malware detection for IoT devices using control-flow data [0.0]
  I study the applicability of control-flow related data of executables for malware detection. I present a malware detection method with two phases. The first phase extracts control-flow related data using static binary analysis. The second phase classifies binary executables as either malicious or benign using a neural network model.
  arXiv  Detail & Related papers  (2023-11-20T08:43:09Z)
• Unsupervised anomalies detection in IIoT edge devices networks using federated learning [0.0]
  Federated learning(FL) as a distributed machine learning approach performs training of a machine learning model on the device that gathered the data itself. In this paper, we leverage the benefits of FL and implemented Fedavg algorithm on a recent dataset that represent the modern IoT/ IIoT device networks. We also evaluated some shortcomings of Fedavg such as unfairness that happens during the training when struggling devices do not participate for every stage of training.
  arXiv  Detail & Related papers  (2023-08-23T14:53:38Z)
• Berlin V2X: A Machine Learning Dataset from Multiple Vehicles and Radio Access Technologies [56.77079930521082]
  We have conducted a detailed measurement campaign that paves the way to a plethora of diverse ML-based studies. The resulting datasets offer GPS-located wireless measurements across diverse urban environments for both cellular (with two different operators) and sidelink radio access technologies. We provide an initial analysis of the data showing some of the challenges that ML needs to overcome and the features that ML can leverage.
  arXiv  Detail & Related papers  (2022-12-20T15:26:39Z)
• A Survey of Machine Unlearning [56.017968863854186]
  Recent regulations now require that, on request, private information about a user must be removed from computer systems. ML models often remember' the old data. Recent works on machine unlearning have not been able to completely solve the problem.
  arXiv  Detail & Related papers  (2022-09-06T08:51:53Z)
• Connected Vehicles: A Privacy Analysis [8.513938423514636]
  A modern car is capable of processing, analysing and transmitting data in ways that could not have been foreseen only a few years ago. We examine the telematics system of a production vehicle, and aim to ascertain some of the associated privacy-related threats.
  arXiv  Detail & Related papers  (2022-07-13T13:26:12Z)
• Predicting Seriousness of Injury in a Traffic Accident: A New Imbalanced Dataset and Benchmark [62.997667081978825]
  The paper introduces a new dataset to assess the performance of machine learning algorithms in the prediction of the seriousness of injury in a traffic accident. The dataset is created by aggregating publicly available datasets from the UK Department for Transport.
  arXiv  Detail & Related papers  (2022-05-20T21:15:26Z)
• A Non-Intrusive Machine Learning Solution for Malware Detection and Data Theft Classification in Smartphones [0.06999740786886537]
  Successful mobile malware attacks could steal a user's location, photos, or even banking information. There is a need besides just detecting malware intrusion in smartphones to also identify the data that has been stolen to assess, aid in recovery and prevent future attacks. We propose an accessible, non-intrusive machine learning solution to not only detect malware intrusion but also identify the type of data stolen for any app under supervision.
  arXiv  Detail & Related papers  (2021-02-12T13:31:27Z)
• Urban Sensing based on Mobile Phone Data: Approaches, Applications and Challenges [67.71975391801257]
  Much concern in mobile data analysis is related to human beings and their behaviours. This work aims to review the methods and techniques that have been implemented to discover knowledge from mobile phone data.
  arXiv  Detail & Related papers  (2020-08-29T15:14:03Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.