Hacking paywalled features on an electric wheelchair

Wheelchair features locked behind a paywall

The speaker discovers that the companion app for their power wheelchair locks core functionality behind digital rights management paywalls. Basic capabilities like driving faster than 6 km/h or using a phone as a remote require extra fees.

Wheelchairs Now Have In-App Purchases

After discovering that switching drive modes required a paid upgrade, the speaker checked dealer mode and recovered the unlock password in plain cleartext straight from the Android app.

Finding the Dealer Password in Cleartext

Paying 100 euros to unlock wheelchair speed

A review of official app store add-ons shows users charged 100 euros for a slight speed boost alongside paid cruise and parking modes.

In-App Purchases for Wheelchair Speed and Cruise Control

DRM in medical devices is getting out of hand

The speaker argues against digital rights management inside medical and mobility hardware, pointing out how manufacturers charge extra fees for essential convenience.

Why DRM in Medical Devices Pushed This Hacker to Act

The master encryption key is printed on the wheel hub

A researcher demonstrates that the secret AES key granting total wireless control over an electric wheelchair is printed as an unencrypted QR code directly on the wheel hub.

The Master Encryption Key Printed on the Wheel

Paying for speed is literally illegal in Germany

The speaker points out that paying 99 euros to boost the wheelchair speed over six kilometers per hour violates German federal traffic law, effectively turning the paid upgrade into a criminal offense.

When Wheelchair Speed Upgrades Become a Crime

Wheelchair hardware upgrades locked by Google Play purchases.

The speaker reviews an official app store response proving that paid speed upgrades on motorized wheels are tied entirely to Google Play accounts rather than physical hardware.

Manufacturer Admits Wheelchair Upgrades Are App Paywalls

An assistive tech app offered a 30-day trial for high-speed driving features, but flawed firmware logic meant the timer never actually expired, unlocking full power permanently.

The Infinite 30-Day Trial Bug

Self-driving wheelchair live demo on stage

The speaker demonstrates an autonomous wheelchair navigating and spinning on stage with nobody seated in it, joking about self-driving mobility.

Autonomous Wheelchair Live Stage Demo

Why we must inspect the medical devices we rely on

The speaker emphasizes why users should inspect and understand the medical devices they rely on to hold manufacturers accountable.

Why Medical Devices Must Be Reverse Engineered

[04:38] Wheelchairs Now Have In-App Purchases
[05:35] Finding the Dealer Password in Cleartext
[09:17] In-App Purchases for Wheelchair Speed and Cruise Control
[10:32] Why DRM in Medical Devices Pushed This Hacker to Act
[19:57] The Master Encryption Key Printed on the Wheel
[26:11] When Wheelchair Speed Upgrades Become a Crime
[33:23] Manufacturer Admits Wheelchair Upgrades Are App Paywalls
[42:00] The Infinite 30-Day Trial Bug
[46:19] Autonomous Wheelchair Live Stage Demo
[47:59] Why Medical Devices Must Be Reverse Engineered

Hacking paywalled features on an electric wheelchair

Explorer des sujets liés