'An attractive alternative to doping' - Hackers could compromise wireless groupsets to cheat at Tour de France, study finds
Three 'no-trace' vulnerabilities found in Dura-Ace Di2, but researchers partner with Shimano to provide a fix
![Shimano Dura-Ace R9150 Di2 side view of shift buttons](https://cdn.mos.cms.futurecdn.net/gJHgDMhD46Vu4EdhK7mK63-320-80.jpg)
Computer scientists at the University of California San Diego and Northeastern University have concluded that wireless groupsets aren't as secure as previously thought, after successfully hacking Shimano Di2.
Using signal jammers and devices known as software-defined radios, the researchers were able to both perform unintended shifts remotely, as well as stop a groupset from working entirely.
The trio, which comprises Maryam Motallebighomi, Earlence Fernandes, and Aanjhan Ranganathan, say their findings could be used maliciously at races as big as the Tour de France to gain an unfair advantage.
“Security vulnerabilities in wireless gear-shifting systems can critically impact rider safety and performance, particularly in professional bike races,” the paper states. “In these races, attackers could exploit these weaknesses to gain an unfair advantage, potentially causing crashes or injuries by manipulating gear shifts or jamming the shifting operation.”
In the study, researchers chose to analyse Japanese brand Shimano, described as the market leader, and focussed on its 105 Di2 and Dura-Ace Di2 groupsets.
Through a 'blackbox analysis' of Shimano's wireless protocol, they found three major vulnerabilities.
The first was a lack of mechanisms to prevent replay attacks, which allows an attacker to capture and retransmit gear-shifting commands, similar to the technology used to hack keyless entry vehicles or wireless garage door openers.
Get The Leadout Newsletter
The latest race content, interviews, features, reviews and expert buying guides, direct to your inbox!
The second was a susceptibility to targeted jamming, enabling an attacker to broadcast 'noise' at the same frequency as the Shimano protocol, in turn disabling shifting on a specific bike without affecting others nearby.
The third finding was that the use of ANT+ communication can result in information leakage, allowing attackers to inspect telemetry from a targeted bike.
While the current setup used by the researchers – a software-defined radio (SDR) and a laptop – is not optimised for size or portability, they warned that technological advancements could make these attacks more feasible in real-world scenarios.
"With advancements in miniaturisation and integrated circuit (IC) technology, it is feasible to reduce the size of the attack device significantly," they explained. "By custom designing specific circuits, we can integrate a receiver, a modest amount of memory for signal storage, and a transmitter into a compact, single System on a Chip (SoC) or small circuit board. This miniaturization process makes the attack system more discreet and enhances its portability and deployment ease."
Seeing riders with hacking devices in their pockets to deploy upon their unsuspecting competitors is still highly unlikely, but the researchers draw parallels with cycling's history of doping and compare a rider's motivations to cheat.
"The sport of professional cycling has a long and troubled history with the use of illegal performance-enhancing drugs. Security vulnerabilities in one of the most critical components of the bike could be viewed as an attractive alternative method for people who want to compromise the integrity of the sport."
"Furthermore, our attacks do not leave any detectable trace, unlike the use of performance-enhancing drugs."
Going forward
The researchers say they're now working with Shimano to patch the vulnerabilities. The Japanese brand has corroborated this claim, with our contact at Shimano saying that the brand was working with the researchers "prior to their paper being presented at the conference."
"Shimano has been working with the researchers to enhance our Di2 wireless communication security for all riders," began the brand's official statement on the matter.
"Through this collaboration, Shimano engineers identified and created a new firmware update to enhance the security of the Di2 wireless communication systems."
Shimano also adds that the updates have been made available to pro teams and that a consumer-facing firmware patch will follow.
"The firmware update has already been provided to the women’s and men’s professional race teams and will be available for all general riders in late August. With this release, riders can perform a firmware update on the rear derailleur using our E-TUBE Cyclist smartphone app. More information about the update process and the steps riders can take to update their Di2 systems will be made available shortly."
Cyclingnews has also asked both Shimano and SRAM if they are aware of any real-world instances of groupset hacking for competitive gain, but as yet, neither has responded.
![](https://cdn.mos.cms.futurecdn.net/flexiimages/j0riqebpsw1715769462.png)
Thank you for reading 5 articles in the past 30 days*
Join now for unlimited access
Enjoy your first month for just £1 / $1 / €1
*Read any 5 articles for free in each 30-day period, this automatically resets
After your trial you will be billed £4.99 $7.99 €5.99 per month, cancel anytime. Or sign up for one year for just £49 $79 €59
![](https://cdn.mos.cms.futurecdn.net/flexiimages/j0riqebpsw1715769462.png)
Join now for unlimited access
Try your first month for just £1 / $1 / €1
Josh is Associate Editor of Cyclingnews – leading our content on the best bikes, kit and the latest breaking tech stories from the pro peloton. He has been with us since the summer of 2019 and throughout that time he's covered everything from buyer's guides and deals to the latest tech news and reviews.
On the bike, Josh has been riding and racing for over 15 years. He started out racing cross country in his teens back when 26-inch wheels and triple chainsets were still mainstream, but he found favour in road racing in his early 20s, racing at a local and national level for Somerset-based Team Tor 2000. These days he rides indoors for convenience and fitness, and outdoors for fun on road, gravel, 'cross and cross-country bikes, the latter usually with his two dogs in tow.