Vulnerability in bike gear systems raises safety concerns

Electronically controlled bicycle equipment offers convenience and precision, but—as evidenced by materials published by Northeastern University—it does not guarantee safety. Bicycle gear settings can be changed remotely, impacting sports results and safety.

Shimano DI2 is an example of electronically controlled bicycle equipment. Traditional mechanical connections involving shifters and steel cables have been replaced with electrical wires and wireless connectivity, allowing the equipment configuration to be controlled remotely via a smartphone.

This setup provides very high precision and avoids issues associated with mechanical components. However, as researchers from Northeastern University in Boston have demonstrated, it also comes with risks.

Reports from cycling routes show that drivetrain operation impacts sports performance and safety and has the potential to cause serious crashes.

Meanwhile, Shimano DI2 employs several wireless communication standards. According to the Sekurak service, these include Bluetooth Low Energy—used for equipment configuration—ANT+ for telemetry, and the proprietary Shimano protocol, operating at a frequency of 2.478 GHz, for gear control. This last component turned out to be the weak link.

Using spectrum observation with SDR (software-defined radio), researchers—according to the Sekurak service—"managed to identify all transmission parameters and replicate and decode data transmitted during this wireless communication."

A computer and an SDR with transmission capabilities are sufficient to control gear operation remotely. During tests, consistent results were obtained up to a distance of 10 metres, which is usually enough to influence the gears of a bicycle passing by the roadside.

According to the manufacturer, a software update can secure the detected vulnerability. However, it's important to note that the competition among equipment manufacturers (with wireless systems also produced by companies such as SRAM) continues, and the growing number of wirelessly connected devices presents more opportunities for hackers.