Threat modelling case study: bicycles

Threat modelling case study: bicycles(calpaterson.com)

25 points by mjohn 5 years ago | 12 comments

paultopia 5 years ago |

Just on bikes in particular, I also can't say enough good stuff about folding bikes, especially if you have a private office. My commuter bike is a Brompton: it's stupid expensive (around $1,500), but I literally can just fold it up, carry it up a flight of stairs, and stick it next to my desk in my office, and it's basically thief-proof. At home, it lives in a closet.

laurieg 5 years ago | |

I came in here to say the same thing. I've been riding my brompton for a year and a half. I don't even own a bicycle lock. It is either in my apartment, under my desk at work or being carried by me.

foxyv 5 years ago |

You need active deterrence. I'm really looking forward to getting a Skunk Lock.

https://www.skunklock.com/shop/skunklock

kennywinker 5 years ago | |

Deploying chemical warfare against theft. We are 100% in the capitalist cyberpunk dystopia the 90s predicted.

gruez 5 years ago |

>In fact [both the U-lock and the cable lock] can by cut by an angle grinder, which can be carried in a rucksack.

The recommendation by LockPickingLawyer[1] is to use a chain lock, because the thick, hardened chains are non-trivial to cut with a bolt cutter, and it's hard for an angle grinder to "bite" into the freely moving links.

[1] https://www.youtube.com/watch?v=SpVOTEOMRuE

frabbit 5 years ago |

Good stuff.

Needs to add another persona though: Smashing Sam who will knock you off your expensive bike in order to steal it: https://road.cc/content/news/e-bike-stolen-after-rider-ramme...

Having had to cut through my own U lock with a portable angle grinder I can verify that it is not too difficult. The cables are only for the snatch-and-grab prevention.

Only minor nitpick is that Campagnolo make wheels and groupsets, not bicycles themselves.

kennywinker 5 years ago | |

Skeptical that this is a widespread type of attack. Also, probably much easier and lower risk of someone taking down your plates to just threaten you with a knife/taser/lead pipe after you've unlocked your bike and then ride off.

MarkusWandel 5 years ago |

There's a dig at Sheldon Brown's bike lock strategy, that I think shows technology creep. At the time SB (who passed away quite a while ago) developed his strategy, small, battery powered angle grinders weren't a thing. Now they are so the threat model has evolved. Luckily I live in a relatively low-crime area and ride relatively worthless bikes. Of course the one bike I ever had that was worth something was... stolen.

upofadown 5 years ago | |

The idea behind the SB strategy is that the small U lock prevents the bike from being ridden. So if you can cut just the cable you need a way to transport it somewhere else other than by riding or ghost riding it. "Rucksack Rupert" is not going to carry off the bike on his back and it is unlikely he would add in the risk of a vehicle with recordable plates without upgrading to an angle grinder.

So I think that the article is failing to entirely understand the threat model in this particular case (or simply disagrees with it).

stefan_ 5 years ago |

I'm fully expecting e-bikes to get the radio code treatment, 2020 style. Central motor an integral, welded part of the frame, mutual authentication between battery, motor and headunit before a single joule of power is going into the chain. Chip on board for the integral trust components, then slathering on a few layers of coating on top. Rekey it all with the smartphone of the owner every so often.

Finnucane 5 years ago |

I always figured it was a matter of relative security rather than absolute security: having a good enough lock that it was easier to take the other guy's bike. Sorry, guy with cheap lock.

frobozz 5 years ago | |

Pretty much all security is relative.

However, it's not just about the better lock, but the apparent value of what can be stolen.

You can have the best lock in the park, but if you have a brand new top-of-the-market ebike and all the other bikes are rusty shitheaps with mismatched pedals and tape hanging off the handlebars, yours is still going to be a prime target.