6 ms·

Data stream hack gets UCI world championship qualifier banned

71 points by docdeek 4y ago

brookst 4y ago
I’m not sure “astounding” is the right word when the article notes the hack was demonstrated at a security conference in 2019 using an Xbox controller as an easy UI. But I suppose the author does go on for a bit about how terrible they are at writing headlines.
- jamincan 4y ago
  I think astounding is referring to the brazenness of the cheat. If the racer had been just a bit more discrete in the use of it, they probably wouldn't have been caught.
bennyelv 4y ago
I've been wondering how long it would be before something like this happened ever since e-sports cycling started. Longer than I thought it would is the answer! I'm sure there's simpler ways as well: you could manipulate the spindown test that the turbotrainer does for calibration to make it think the flywheel is heavier than it really is, for example. At the non-pro level cheating is absolutely rife. Mostly through people lying about their weight. In every open zwift race there are performances that would put a person in the top 0.1% of riders globally being put down by half the field!
- nradov 4y ago
  Would attaching some temporary adhesive weights to the trainer flywheel during the calibration test be an effective way to cheat? My Tacx Neo 2T doesn't even have a calibration process, but maybe that could work on other models. Of course that won't affect the separate data stream sent from the power meter on the bike.
  - bennyelv 4y ago
    I've made some assumptions, which on reflection could be incorrect. My Tacx Flux does a spindown test where you spin it up to a high RPM, then stop pedalling and it measures how long it takes to stop. I guess it's actually trying to get an accurate measure of the resistance being applied. A heavier flywheel will be harder to spin up, but will also take longer to spin down at the same resistance, so maybe that doesn't make a difference. Pressing something against the flywheel would make the trainer think it's applying more resistance than it really is, so I'm pretty sure that would work.
- danceparty 4y ago
  These zwift races require two data inputs, one from a power meter (pedal or crank) and one from the trainer. So manipulating just the trainer flywheel would not be enough.
ho_schi 4y ago
https://www.youtube.com/watch?v=eGHGtJiDlxw https://www.youtube.com/watch?v=eGHGtJiDlxw Old but gold. Maybe staged.
- aidenn0 4y ago
  "Maybe" staged in the way that the cyclist in TFA "Maybe" cheated...
JCharante 4y ago
Some context for non-cyclists You can buy and attach smart trainers to the rear of bicycles. They provide resistance to simulate riding outdoors and you can run “games” on your pc that connect to the smart trainers to update your position in the game based off how hard you pedal. This then enables the possibility for people to race online.
- cbm-vic-20 4y ago
  And it's a fun way to get/stay in shape, if the race is low-stakes and you don't care if there's an occasional cheater.
tsumnia 4y ago
As I was reading, I realized this will make e-sports more interesting from an academic standpoint (I know, way to party poop). But with the growth of e-sports, we're even seeing universities create e-sports teams, we may see niche security research on this type of anomaly detection. There's neural network powered aimbots, hardware manipulation, probably more (considering a certain chess incident). Would techniques used for credit card fraud / network anomaly detection work in these environments?
xracy 4y ago
It's wild to me, and possibly seems like the next development in cheating, that these technologies are functionally catching people who have a sudden increase in performance. Everything's catching major differences in performance. I think the same is true of the chess.com evaluation of Niemann, and a lot of speed runs as well. It seems like the harder cheats to catch are gonna be the ones where they just give themselves a small advantage over the course of an entire run. I'm wondering how big a difference we would've seen if the cheater in question here had performed a more consistent w/kg above his V02Max, (but not signifcantly outside the realm of his V02Max), for the entire race. They say he had a sudden performance of 500+W and his V02Max was in the 400s, I feel like a more smooth/consistent race in the higher 400s rather than a burst at the end would've been a lot harder to catch. Basically... just more plausible smoothing so that no individual piece of the race would come into question.
- dylan604 4y ago
  So let's say someone takes your suggestion to do so they become a better cheater. What the next move in the cat and mouse game to catch the cheat you just designed? To be a good cheater, you should be thinking in these kinds of terms. If you can think of a cheat, but not how to get caught, you'll not be a good cheater. If you can think of a cheat, then realize how it can be caught, then modify the cheat, think of how to beat that, lather/rinse/repeat, you'll probably be a really good cheat. At that point though, I think you could be a better use to society doing something else with that critical thinking. So unless there's a bunch of money involved, it probably won't be attracting the brightest.
  - mlyle 4y ago
    It's not exactly rocket science to spend a few minutes thinking about how to make your cheating look just like an athlete who is marginally better than the rest of the field.
    - deleted 4y ago
      [deleted]
  - 4y ago
lelag 4y ago
My take is that you can't have a serious e-sport cycling scene with the current tech. This guy was caught because he was greedy and the cheat was too obvious. What about all the others that could be doing the same but in a smarter way. There is no way as an honest cyclist to know you were beaten fairly. (Maybe you can be sure you were not). The protocols (ANT+ in particular) are totally insecure and it's totally possible to MITM them. The obvious solution would be to upgrade those and start sending data over an encrypted channel instead. Still, this is only going to help momentarily and discourage the hobbyist cheaters. People are starting on PC games using very sophisticated setup with dedicated PCI hardware connected to a second computer where the cheat software actually run. If the devices get secure, people will start cheating at the software level. If the stake are high enough (and there are for those people hoping to get into a World Championship), they will do anything to get an edge. I think it's hopeless to hope to make those online race as anything serious. It can be a fun hobby and way to exercice but any serious competition will need to take place in person. For cycling, it probably means the old fashion way: on the road.
- madrox 4y ago
  This is a challenge across all esports and not just cycling. In other esports, competition may be online, but hardware is usually provided by the organizer and overseen in locations where refs can ensure nothing is being done to machines to cheat. Nowadays cheating scandals only tend to come up in competitions where people are playing from home.
  - lelag 4y ago
    Yes but with cycling, the point of the e-sport is to not travel. If you have to travel with your bike to a physical location, there is no point in cycling on a static smart trainer, you might as well race on the road (which is much more fun anyway). It's no longer an e-sport.
    - madrox 4y ago
      The idea would be you would travel without your bike and use one provided by the organizer. That's what other esports do. There's still advantages to the esport, such as not needing to close public roads, design tracks that don't exist or aren't easily accessed, and allow different racing strategy (I imagine they don't simulate pushing wind).
Raidion 4y ago
People are always like "well, what if he just wasn't so greedy". The greed doesn't quit. You cheat to win smaller races, then you're in bigger races, and need to cheat more, and eventually it gets to the point where you need to lose OR you end up on a big stage where a lot of people have entire hobbies dedicated to finding and exposing cheaters. See https://www.marathoninvestigation.com/ https://www.marathoninvestigation.com/! Like, the same thing that makes people cheat are the same people who can't stop cheating until they get too greedy and get caught. If they weren't greedy, they wouldn't cheat.

71 points by docdeek 4y ago

I’m not sure “astounding” is the right word when the article notes the hack was demonstrated at a security conference in 2019 using an Xbox controller as an easy UI. But I suppose the author does go on for a bit about how terrible they are at writing headlines.

jamincan 4y ago
I think astounding is referring to the brazenness of the cheat. If the racer had been just a bit more discrete in the use of it, they probably wouldn't have been caught.

bennyelv 4y ago

I've been wondering how long it would be before something like this happened ever since e-sports cycling started. Longer than I thought it would is the answer! I'm sure there's simpler ways as well: you could manipulate the spindown test that the turbotrainer does for calibration to make it think the flywheel is heavier than it really is, for example. At the non-pro level cheating is absolutely rife. Mostly through people lying about their weight. In every open zwift race there are performances that would put a person in the top 0.1% of riders globally being put down by half the field!

nradov 4y ago
Would attaching some temporary adhesive weights to the trainer flywheel during the calibration test be an effective way to cheat? My Tacx Neo 2T doesn't even have a calibration process, but maybe that could work on other models. Of course that won't affect the separate data stream sent from the power meter on the bike.
- bennyelv 4y ago
  I've made some assumptions, which on reflection could be incorrect. My Tacx Flux does a spindown test where you spin it up to a high RPM, then stop pedalling and it measures how long it takes to stop. I guess it's actually trying to get an accurate measure of the resistance being applied. A heavier flywheel will be harder to spin up, but will also take longer to spin down at the same resistance, so maybe that doesn't make a difference. Pressing something against the flywheel would make the trainer think it's applying more resistance than it really is, so I'm pretty sure that would work.
danceparty 4y ago
These zwift races require two data inputs, one from a power meter (pedal or crank) and one from the trainer. So manipulating just the trainer flywheel would not be enough.

ho_schi 4y ago

https://www.youtube.com/watch?v=eGHGtJiDlxw https://www.youtube.com/watch?v=eGHGtJiDlxw Old but gold. Maybe staged.

aidenn0 4y ago
"Maybe" staged in the way that the cyclist in TFA "Maybe" cheated...

JCharante 4y ago

Some context for non-cyclists You can buy and attach smart trainers to the rear of bicycles. They provide resistance to simulate riding outdoors and you can run “games” on your pc that connect to the smart trainers to update your position in the game based off how hard you pedal. This then enables the possibility for people to race online.

cbm-vic-20 4y ago
And it's a fun way to get/stay in shape, if the race is low-stakes and you don't care if there's an occasional cheater.

tsumnia 4y ago

As I was reading, I realized this will make e-sports more interesting from an academic standpoint (I know, way to party poop). But with the growth of e-sports, we're even seeing universities create e-sports teams, we may see niche security research on this type of anomaly detection. There's neural network powered aimbots, hardware manipulation, probably more (considering a certain chess incident). Would techniques used for credit card fraud / network anomaly detection work in these environments?

xracy 4y ago

It's wild to me, and possibly seems like the next development in cheating, that these technologies are functionally catching people who have a sudden increase in performance. Everything's catching major differences in performance. I think the same is true of the chess.com evaluation of Niemann, and a lot of speed runs as well. It seems like the harder cheats to catch are gonna be the ones where they just give themselves a small advantage over the course of an entire run. I'm wondering how big a difference we would've seen if the cheater in question here had performed a more consistent w/kg above his V02Max, (but not signifcantly outside the realm of his V02Max), for the entire race. They say he had a sudden performance of 500+W and his V02Max was in the 400s, I feel like a more smooth/consistent race in the higher 400s rather than a burst at the end would've been a lot harder to catch. Basically... just more plausible smoothing so that no individual piece of the race would come into question.

dylan604 4y ago
So let's say someone takes your suggestion to do so they become a better cheater. What the next move in the cat and mouse game to catch the cheat you just designed? To be a good cheater, you should be thinking in these kinds of terms. If you can think of a cheat, but not how to get caught, you'll not be a good cheater. If you can think of a cheat, then realize how it can be caught, then modify the cheat, think of how to beat that, lather/rinse/repeat, you'll probably be a really good cheat. At that point though, I think you could be a better use to society doing something else with that critical thinking. So unless there's a bunch of money involved, it probably won't be attracting the brightest.
- mlyle 4y ago
  It's not exactly rocket science to spend a few minutes thinking about how to make your cheating look just like an athlete who is marginally better than the rest of the field.
  - deleted 4y ago
    [deleted]
- 4y ago

lelag 4y ago

My take is that you can't have a serious e-sport cycling scene with the current tech. This guy was caught because he was greedy and the cheat was too obvious. What about all the others that could be doing the same but in a smarter way. There is no way as an honest cyclist to know you were beaten fairly. (Maybe you can be sure you were not). The protocols (ANT+ in particular) are totally insecure and it's totally possible to MITM them. The obvious solution would be to upgrade those and start sending data over an encrypted channel instead. Still, this is only going to help momentarily and discourage the hobbyist cheaters. People are starting on PC games using very sophisticated setup with dedicated PCI hardware connected to a second computer where the cheat software actually run. If the devices get secure, people will start cheating at the software level. If the stake are high enough (and there are for those people hoping to get into a World Championship), they will do anything to get an edge. I think it's hopeless to hope to make those online race as anything serious. It can be a fun hobby and way to exercice but any serious competition will need to take place in person. For cycling, it probably means the old fashion way: on the road.

madrox 4y ago
This is a challenge across all esports and not just cycling. In other esports, competition may be online, but hardware is usually provided by the organizer and overseen in locations where refs can ensure nothing is being done to machines to cheat. Nowadays cheating scandals only tend to come up in competitions where people are playing from home.
- lelag 4y ago
  Yes but with cycling, the point of the e-sport is to not travel. If you have to travel with your bike to a physical location, there is no point in cycling on a static smart trainer, you might as well race on the road (which is much more fun anyway). It's no longer an e-sport.
  - madrox 4y ago
    The idea would be you would travel without your bike and use one provided by the organizer. That's what other esports do. There's still advantages to the esport, such as not needing to close public roads, design tracks that don't exist or aren't easily accessed, and allow different racing strategy (I imagine they don't simulate pushing wind).

Raidion 4y ago

People are always like "well, what if he just wasn't so greedy". The greed doesn't quit. You cheat to win smaller races, then you're in bigger races, and need to cheat more, and eventually it gets to the point where you need to lose OR you end up on a big stage where a lot of people have entire hobbies dedicated to finding and exposing cheaters. See https://www.marathoninvestigation.com/ https://www.marathoninvestigation.com/! Like, the same thing that makes people cheat are the same people who can't stop cheating until they get too greedy and get caught. If they weren't greedy, they wouldn't cheat.