Schneier on Security

finagle • August 20, 2024 3:55 PM

Not disputing their results, but when SRAM first mooted wireless shifters as a response to issues over them launching a competitor to the wired Di2 Shimano system there were immediate concerns over security and whether a bike could be hacked. Quite a lot of conversations ensued.
How the SRAM security was described to me at the time was wireless signals would use AES256 encryption, with the components needing to be paired in advance to setup a unique shared secret across the components. Once the parts were paired then signals would be unique to the components on the bike. Replay attacks were mentioned and I think a simple single use token was incorporated in each message, to ensure playback attacks were impossible. A wired connection to a laptop was needed to change the pairing. They weren’t Bluetooth at that time either, as Bluetooth was higher battery consumption, and range was severely limited, so interception required you to be really close to a moving bike.
Shimano implemented their wireless more recently, so I would have expected it to be more secure, but clearly not.
For those that don’t build or maintain bikes, or maybe even ride them who are scratching their heads as to why wireless shifting is even a thing, electronic shifting is smooth and less susceptible to wear. Wireless systems don’t need to run relatively thin fragile wires either over or through a frame, and can be bolted on the outside, reducing the complexity of frame design, build up and maintenance. They are less bothered by dirt as well so better for cyclo cross or mountain bikes. Definitely a place for them, but like all things, they need to be secure, and honestly, I thought they were after getting involved with talking through it publicly before the first system even launched.

finagle • August 21, 2024 6:27 AM

It’s important to remember this is not an Internet of Things situation. The controllers here are dedicated controllers, not general purpose computers. They are dedicated systems and have no internet connection. They have specific and limited Bluetooth APIs, and are not going to be infecting your fridge with a virus.
That aside the level of logistics required to create a targeted exploit against a specific bike and the potential impact of that makes it relatively hard. Technically it might be easy, but getting recordings of a specific bike (note not rider, bike) is non trivial. Getting a recording of a pro on their number one race bike is not going to be simple. These people rarely ride their race bikes alone, and even then they may replace components regularly in or between races, and often ride second or third or training bikes. While the video makes it look relatively cheap and simple to create, I’d characterise it as hard in real world conditions. Then deploying it requires you to set the transmitter at a specific point in a race where it might make a worthwhile difference and there are few places where top level racing is that predictable. It would have been possible to deploy this to say stop Cav getting his 35th stage win, assuming you had a recording of the bike he was on, but stopping Pogacar attacking on a climb, or impeding him, well his attacks are not that easy to predict.
Realistically just dropping a bidon, or letting a dog loose, or getting your cousin to wave a hello mum banner in front of the race is cheaper and easier.
As for an extortion attack, we have your gear change messages, pay us to avoid us using them, well the gear manufacturers sponsor the teams at the top level and the equipment you’ve targeted will be replaced in a matter of minutes. While they call the police.
So on sober contemplation, this a weakness in a very specific set of equipment that is technically easy but logistically hard to exploit and even harder to exploit with any hope of benefit. At the top level, or even just trying to bring down your annoyingly fit and healthy local lycra lout.