CosmicTurtle , 4 months ago

Jesus fucking mother of Christ.

Ok, I’m going to skip my indignation.

I’m not an app developer or a wheel chair person. That said, we need some info to help you better.

• What phone? Android or iOS?
• link to the app (and a link it’s APK or whatever iPhones equivalent to an APK would be)
• instructions on how you register, e.g. is registration tied to your phone, the wheelchair, or both?

Here is some general hacking advice:

• check online for your wheelchairs “provider” manual. I “hacked” my CPAP machine a few years back. My doctor forgot to turn on heated tubing and the setting was hidden behind a “provider” menu. Chances are good that there will be a similar manual for your wheelchair.
• if you haven’t already, search for the make and model of your wheelchair and see if there are forums or discussion boards
• typically, physical access is the best access. Depending on how your phone communicates with the chair, you might able to spy on the signals that it uses. My guess is Bluetooth. It probably is encrypted but medical devices are notoriously easy skimpy on their tech security. Might be worth a try
• If you have the tools and the knowledge, consider taking apart the wheelchair to access the physical components. Information like the processor, chip set, etc will make it easier to understand how it works. While you might expect custom boards and software, more and more devices are going the Raspberry Pi or Pico route because they are cheaper to manufacturer than to do a whole custom board. If it’s a run of the mill consumer board, you have a lot more attack vectors.

Often settings like these are based on PKI(Public Key Infrastructure), meaning that the program on your wheelchair likely knows the public key for the company and will test any input to change the settings will require the private key. Again, generally speaking.

But also generally speaking, medical equipment, especially consumer equipment, has to deal with the lowest common denominator, meaning people who don’t have apps, who don’t know what a smart phone is, etc. Because of that, my hunch is that the setting is in plain text and you just need to change it.

You also have to remember that the people setting this up are often in doctors offices, which means it must be easy to do because time is of the essence. The doctor would not recommend their product if it takes more than a few minutes to set up.

I’m sorry I can’t give you better more specific advice but hopefully you can figure this out.