High-end racing bikes are now vulnerable to hackers

A team of computer scientists has discovered that wireless gear-shifting systems on high-end bicycles are vulnerable to cybersecurity attacks that could harm popular races like the Tour de France.

Wireless gear shifting systems are intended to give riders better control of their bikes, according to the University of California San Diegowhose researchers collaborated with those at Northeastern University on the study. But modernization also introduces a new set of problems in the form of hacking vulnerabilities. These weaknesses could be exploited “to gain an unfair advantage, potentially causing accidents or injuries when manipulating gear changes or disrupting shift operation,” the researchers wrote.

The group looked specifically at bicycles with Shimano Di2 wireless gear shifting technology, which it called “market leading.” According to UC San Diego, the system works by “deploying wireless links between shift levers controlled by cyclists and the device that moves chains between the bike’s gears, called a derailleur.” By recording and retransmitting these commands, researchers found they were able to carry out an attack from up to 10 meters away with “off-the-shelf devices.” They also discovered that it is possible to disable a specific bike’s gear shifting with a targeted interference attack, rather than impacting all others around it.

Researchers are now working with Shimano to fix the vulnerabilities, UC San Diego says, and the company has already started using some of the suggested countermeasures. Shimano did not immediately respond to a request for comment.

“The history of professional cycling’s struggles with illegal performance-enhancing drugs highlights the appeal of such undetectable attacks, which can also compromise the integrity of the sport,” the researchers say. “Given these risks, it is essential to adopt the adversary’s point of view and ensure this technology can withstand motivated attackers in the highly competitive environment of professional cycling.”