Computer scientists at the University of California San Diego and Northeastern University have concluded that wireless groupsets aren't as secure as previously thought, after successfully hacking Shimano Di2. 

Using signal jammers a🍌nd devices known as software-defined radios, the researchers were able to both perf🐼orm unintended shifts remotely, as well as stop a groupset from working entirely.

The trio, which comprises Maryam Motallebighomi, Earlence Fernandes, and Aanjhan Ranganathan, say their findings could be used maliciously at races as big as the 168澳洲5最新开奖结果:Tour de France to gain an unfair advantage. 

“Security vulnerabilities in wireless gear-shi🐬fting systems can critically impact rider saꦚfety and performance, particularly in professional bike races,” states. “In these races, attackers could exploit these weaknesses to gain an unfair advantage, potentially causing crashes or injuries by manipulating gear shifts or jamming the shifting operation.”

In the study, researchers chose to analyse Japanese brand Shimano, described as the market leader, and focussed on its 105 Di2 and Duraꦬ-Ace Di2 groupsets.&🌄nbsp;

Through𒐪 a 'blackbox analysis' of Shimano's wireless protocol, they found three major vulnerabilities. 

The first was a lack of mechanisms to prevent replay attacks, which allows an attacker to capture and retransmit gear-shifting commands, simil🐬ar to the technolo𒐪gy used to hack keyless entry vehicles or wireless garage door openers. 

The second was a susceptibility to targeted jamming, enabling an attacker to broadcast 'noise' at the same freq☂uency as the Shimano pr🌸otocol, in turn disabling shifting on a specific bike without affecting others nearby. 

The third finding was that the use of ANT+ communication can result in information leakage, allowing attackers to inspect telemetry fr🌺om a targeted bike.

While the current setup used by the researchers – a software-defined radio (SDR) and a laptop – is not optimised for size or portability, they warned that technological advancements could🅷 make these attacks more feasible in real-world scenarios. 

"With advancements in miniaturisation and integrated circuit (IC) technology, it is feasible to redu✤ce the size of the attack device significantly," they explained. "By custom designing specific circuits, we can integrate a receiver, a modest amount of memory for signal storage, and a transmitter into a compact, single System on a Chip (SoC) or small circuit board. This miniaturization process makes the attack system more discreet and enhances its portability and deployment ease."

Seeing riders with hacking devices in their pockets to deploy upon their unsuspecting competitors is still highly unlikely, but the researchers draw parallels with cycling's history of dopi✅ng and compare a rider's motivations to cheat. 

"The sport of prof🐟essional cyc♍ling has a long and troubled history with the use of illegal performance-enhancing drugs. Security vulnerabilities in one of the most critical components of the bike could be viewed as an attractive alternative method for people who want to compromise the integrity of the sport."

"Furthermore, our attacks do not leave any d🔯etectable trace, unlﷺike the use of performance-enhancing drugs."

Going forward

The researchers say they're now working with Shimano to patch the vulnerabilities. The Japanese brand has corrobor🎐ated this claim, with our contact at Shimano saying that the brand was worki𒁃ng with the researchers "prior to their paper being presented at the conference."

"Shimano has been working with the researchers to enhance our Di2 wireless communication security for 🌠all riders," began the brand's official statement on the matter. 

"Through this collaboration, Shimano engineers identified and creat✱ed a new firmware update to enhance the security of the Di2 wireless communication systems."

Shimano also adds that the updates have been made available t🐟o pro teams and that a consumer-facing firmware patch will follow. 

"The firmware update has already been provided to the women’s and men’s professional race teams and will be available for all general riders in late August. With this release, riders can perform a firmware update on the rear d🦩erailleur using our E-TUBE Cyclist smartphone app. More information about the update process and the steps riders can take to update their Di2 systems will be🐲 made available shortly."

Cyclingnews has also asked both Shimano and SRAM if they are aware of any real-world instances of groupset hacking for competitive gain, but as yet, 💧neither has responded.