Threat modelling case study: bicycles • Hacker News Board

Re: Threat modelling case study: bicycles

#11

Post by gruez » Mon, Sep 07, 2020, 7:58 PM UTC

>In fact [both the U-lock and the cable lock] can by cut by an angle grinder, which can be carried in a rucksack.

The recommendation by LockPickingLawyer[1] is to use a chain lock, because the thick, hardened chains are non-trivial to cut with a bolt cutter, and it's hard for an angle grinder to "bite" into the freely moving links.

[1] https://www.youtube.com/watch?v=SpVOTEOMRuE

Re: Threat modelling case study: bicycles

#12

Post by kennywinker » Mon, Sep 07, 2020, 8:03 PM UTC

frabbit wrote: post #5

Good stuff. Needs to add another persona though: Smashing Sam who will knock you off your expensive bike in order to steal it: https://road.cc/content/news/e-bike-stolen-after-rider-ramme... Having had to cut through my own U lock with a portable angle grinder I can verify that it is not too difficult. The cables are only for the snatch-and-grab prevention. Only minor nitpick is that Campagnolo make wheels and groups…

Skeptical that this is a widespread type of attack. Also, probably much easier and lower risk of someone taking down your plates to just threaten you with a knife/taser/lead pipe after you've unlocked your bike and then ride off.

Re: Threat modelling case study: bicycles

#13

Post by stefan_ » Mon, Sep 07, 2020, 8:22 PM UTC

I'm fully expecting e-bikes to get the radio code treatment, 2020 style. Central motor an integral, welded part of the frame, mutual authentication between battery, motor and headunit before a single joule of power is going into the chain. Chip on board for the integral trust components, then slathering on a few layers of coating on top. Rekey it all with the smartphone of the owner every so often.