MakeShift: Security Analysis of Shimano Di2 Wireless Gear Shifting in Bicycles
summary
Shimano Di2 wireless shifting has no timestamps or sequence numbers and allows replay attacks up to 10 m using captured packets with no cryptographic keys; recordings remain valid as long as components stay paired. The team demodulates the proprietary GFSK stream with USRP v210 and Universal Radio Hacker, observes a fallback burst of 748 packets in 1.5 s, and shows targeted jamming that disables a single bike by inserting 120 μs vacant intervals. ANT+ telemetry leaks require no pairing; rolling codes, timestamps, or distance-based (TOA) checks are proposed.
AI-written summary · about
chapters (7)
- 0:00Introduction to bike hacking
- 0:56Security analysis methodology
- 4:17Protocol breakdown
- 7:37Replay and jamming attacks
- 11:00Attack demonstration
- 13:51Countermeasures and disclosure
- 15:46Conclusion
related talks
40mGrand Theft Drone: Reaching Breaking Point in Drone Proprietary RF Link Security
51mRadio Hacking: Cars, Hardware, and more!
55mAttacking Industrial Remote Controllers
52m"New Tales of Wireless Input Devices - Matthias Deeg, Gerhard Klostermeier
53mHacking the Wireless World with Software Defined Radio - 2.0
59mWireless security testing with attack
44mBreaking the Security of Physical Devices
01h 00mHacking the Wireless World with Software Defined Radio - 2.0