Norway discovers that its Chinese electric buses can be remotely disabled

Oslo’s public transportation agency, Ruter, decided to conduct a security audit of the city’s electric buses and found that the Chinese ones could be remotely disabled by their manufacturer. Security experts aren’t even surprised.

Ruter took two electric bus models inside a Faraday cage room – a room entirely enclosed by a conductive material, such as a metal mesh or sheet, that blocks external electromagnetic interference and radio frequency signals – and tested them, according to a local newspaper, Aftenposten.

Apparently, buses from the Chinese company Yutong could be disabled via remote control capabilities found in the bus software, diagnostics module, and battery and power control systems.

“In theory, the buses could therefore be stopped or rendered unusable by the manufacturer, Ruter reported to the government.

The buses can’t be controlled, though, the agency soon clarified, so it’s safe to take the bus home.

Similar backdoor control capabilities, usually at least officially frowned upon in Western tech companies, weren’t found in buses bought from Dutch company VDL.

Ruter disabled web connectivity on the buses by removing SIM cards from the onboard modems, Aftenposten said. This was done on all of the 300 Yutong electric buses in Oslo and 550 buses elsewhere in the country.

Ståle Ulriksen, a national security expert from the Norwegian Naval Academy, told NRK, the Norwegian public broadcaster, he was disappointed with the country’s “naive politicians.”

“I cannot comprehend and understand that politicians refuse to listen to the security authorities’ repeated, annual warning,” said Ulriksen.

This might be a storm in a teacup, of course. Remote control systems are simply cheaper for the manufacturers.

They don’t have to send support teams across the world because, quite obviously, they can repair the devices remotely. These features are usually found in port cranes or Chinese smart cars.

Power inverters, which are also predominantly produced in China and used throughout the world to connect solar panels and wind turbines to electricity grids, typically also allow remote access for updates and maintenance.

This might be a storm in a teacup, of course. Remote control systems are simply cheaper for the manufacturers.

However, in the case of Chinese solar panels, US experts said this year that they found “rogue” communication devices not listed in product documents that could be used to skirt firewalls and switch off inverters remotely.

That’s risky, the experts said, because this is effectively a way to physically destroy the grid in the country where the panels have been installed. Widespread blackouts could then be expected.

Unlock more exclusive Cybernews content on YouTube.