# Unauth Mobile Apps and AI Scam Pitches: Two Emerging Threats in IoT and Author Targeting


The latest episode of the *Smashing Security* podcast highlights two distinct but equally troubling cybersecurity trends: vulnerable Internet of Things (IoT) implementations in emerging markets and the industrialization of AI-powered social engineering targeting high-profile individuals. Both stories underscore critical gaps in security practices—one in infrastructure deployment, the other in detecting synthetic fraud at scale.


## The E-Rickshaw Authentication Bypass


### The Vulnerability


A mobile application circulating in India has exposed a dangerous security flaw in the growing e-rickshaw industry: any user with a smartphone can remotely stop a passing e-rickshaw without authentication, passwords, or permissions. The app requires no login credentials, no user verification, and no authorization checks—meaning anyone with internet connectivity can disable a vehicle operated by a stranger.


E-rickshaws—motorized three-wheeled vehicles widely used for urban transportation in India—have become a critical component of public mobility. The vehicles serve millions of daily commuters and represent a significant portion of the informal transportation sector. This vulnerability transforms them into potential targets for:


  • Passenger disruption: Malicious actors could strand passengers mid-journey
  • Driver harassment: Competitors could disable rivals' vehicles
  • Traffic disruption: Coordinated attacks could paralyze transportation networks in urban areas
  • Safety hazards: Sudden stops could cause accidents or injuries

    • ### Root Cause: Authentication-Free Design


    The underlying issue reflects a common IoT security failure: the assumption that obscurity provides security. The developers appear to have believed that a lack of documentation or authentication would be sufficient protection. This follows a troubling pattern in IoT development where manufacturers prioritize convenience and rapid deployment over fundamental security controls.


    Security fundamentals violated include:


  • No authentication layer: The app accepts commands without verifying the user's identity
  • No authorization checks: No validation that the requestor owns or operates the vehicle
  • No rate limiting: Repeated commands would face no throttling or blocking
  • No audit logging: No record of who issued commands or when

    • ## AI-Generated Book Marketing Scams


    ### The Attack Pattern


    Meanwhile, cybersecurity journalist Geoff White has become a target of a different breed of scammer: AI-generated book marketing "experts" flooding his inbox with personalized pitches. The scams leverage large language models to generate seemingly legitimate outreach messages, each tailored with real details about his published works and author status.


    Unlike mass spam, these messages are algorithmically personalized, making them harder to dismiss as generic phishing. The attackers combine:


  • Scraped author metadata: Book titles, publication dates, author profiles
  • LLM-generated copy: Contextual pitches that reference the author's actual work
  • Social engineering: Appeals to ego ("Your book is excellent") and urgency ("Limited slots available")
  • Volume: Flooding accounts with dozens of near-identical messages

    • ### Why Authors Are Targets


    Authors represent an attractive scam target profile:


    | Factor | Why It Matters |

    |--------|----------------|

    | Financial incentive | Published authors often have disposable income and view book marketing as a worthwhile investment |

    | Availability of data | Author bios, book descriptions, and publication histories are public and easily indexed |

    | Ego vulnerability | Flattery about their work increases susceptibility to social engineering |

    | Time pressure | Authors facing declining sales are desperate for promotional solutions |

    | Low fraud awareness | The literary community may be less attuned to cybersecurity threats than tech-focused audiences |


    ## Technical Implications and Patterns


    ### The IoT Problem at Scale


    The e-rickshaw incident exemplifies a systemic issue in IoT deployment, particularly in emerging markets:


    1. Pressure for speed to market: First-mover advantage in the e-rickshaw space may incentivize skipping security testing

    2. Cost sensitivity: Adding authentication infrastructure increases development and operational costs

    3. Regulatory gaps: India's IoT regulations lag behind vulnerabilities in practice

    4. Supply chain issues: Third-party app developers may lack security expertise or incentives


    The attack surface is massive: any vehicle with internet connectivity becomes accessible without proper controls.


    ### The Sophistication of AI-Powered Scams


    What makes the author-targeting campaign notable is its industrial efficiency:


  • Personalization at scale: Where traditional spammers send identical messages, AI generates unique pitches for each target
  • Authenticity mimicry: The copy reads like genuine outreach rather than template spam
  • Low-cost infrastructure: A single developer with OpenAI API access can target thousands of victims
  • Rapid iteration: Failed pitches can be analyzed and improved in real time

    • This represents a new category of threat: synthetic personalized fraud—attacks that appear individually crafted but are generated by algorithm.


    ## Implications for Organizations


    ### For IoT Manufacturers and Operators


    The e-rickshaw vulnerability demands immediate action:


  • Authentication is non-negotiable: Every command must require proof of identity and authorization
  • Secure by default: If a feature lacks security controls, it should be unavailable until fixed
  • Regular security audits: Third-party penetration testing should precede public launch
  • Incident response: Immediate disclosure and patching when vulnerabilities surface

    • ### For High-Profile Individuals and Small Businesses


    The author scam campaign signals a new threat to anyone with a public profile:


  • Assume AI-generated pitches: Personalized unsolicited outreach may be algorithmically generated, not human-written
  • Verify independently: Contact agencies or service providers directly via official channels, never via cold outreach links
  • Scrutinize offers: Legitimate services rarely need upfront payments or guarantee results
  • Report patterns: Flag similar scams to your email provider and law enforcement

    • ## HackWire Analysis


    These two incidents reveal a troubling asymmetry in cybersecurity development: manufacturers prioritize feature velocity over fundamental security controls, while simultaneously, attackers have industrialized personalized fraud at near-zero cost using generative AI.


    The e-rickshaw vulnerability exposes the dangers of "security through obscurity" in critical infrastructure—a lesson the industry should have learned decades ago. What's alarming is not the vulnerability itself, but that it exists in 2026. This suggests that security education has failed to reach significant portions of the IoT development community, particularly in regions where regulation is light and speed to market trumps all other concerns.


    The author-targeting scams represent a more sophisticated problem: they are *working*. The rate of AI-generated personalized fraud will accelerate as LLMs become cheaper and more capable. Traditional defenses—like "ignore obvious spam"—fail when the spam is no longer obvious. We're entering an era where humans cannot reliably distinguish human-written pitches from AI-generated ones, and attackers know it.


    Both stories share a common thread: security is being treated as optional rather than foundational. Until organizations accept that authentication, authorization, and fraud detection are non-negotiable costs of doing business—not optional features—we'll see these patterns repeat. The good news: both vulnerabilities are entirely preventable with known security practices. The bad news: neither was prevented, and millions of people are exposed as a result.


    — HackWire Editorial


    ## Recommendations


    ### For Riders and Drivers


  • Report the e-rickshaw app vulnerability to local transportation authorities and the app developer
  • Assume any unsolicited outreach from service providers may be fraudulent
  • Enable multi-factor authentication on email accounts containing personal or financial information

    • ### For Policymakers


  • Establish minimum IoT security standards, particularly for vehicles and infrastructure
  • Require authentication for any remote control or management features
  • Mandate disclosure timelines for vulnerabilities in critical infrastructure

    • ### For Security Professionals


  • Audit IoT deployments for authentication and authorization gaps
  • Implement systems to detect anomalous command patterns that could indicate unauthorized access
  • Monitor for AI-generated phishing and social engineering at scale

    • ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Malware](https://www.hackwire.news/category/malware) and [Social Engineering](https://www.hackwire.news/category/social-engineering)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)