Diavel Security Flaw

T

T101

New member
I do some work in IT security and came across this in a security discussion group. Just thought I'd share it as it if anybody on here has got,or thinking of getting, a Diavel you should be aware.

It seems that, unless the factory password PIN has been manually changed by you or the dealer, anybody can potentially ride of with your pride and joy....

More details on: http://www.laresblog.com/2011/04/why-cant-i-just-buy-motorcycle-without.html

Per the owner's manual, the four digit PIN can be modified (See page 93 http://www.diavel-forum.com/docs/manuals/2011diavel.pdf) but how often does someone ever change the default password? (Page 109 says there is no limit or lockout on PIN tries.)

Can't believe IT security problems now appear on motorbikes!
 
I'll try that when I see one. It'd be quite good to have something else in the garage as company for the 998. :)
 
T101 said:
I do some work in IT security and came across this in a security discussion group. Just thought I'd share it as it if anybody on here has got,or thinking of getting, a Diavel you should be aware.

It seems that, unless the factory password PIN has been manually changed by you or the dealer, anybody can potentially ride of with your pride and joy....

More details on: http://www.laresblog.com/2011/04/why-cant-i-just-buy-motorcycle-without.html

Per the owner's manual, the four digit PIN can be modified (See page 93 http://www.diavel-forum.com/docs/manuals/2011diavel.pdf) but how often does someone ever change the default password? (Page 109 says there is no limit or lockout on PIN tries.)

Can't believe IT security problems now appear on motorbikes!
Click to expand...

The Multistrada 1200 uses the same system and in that case there is no default set.

The dealer sets the pin with you at handover time - but if the PIN hasn't been set, you can't use that method to start the bike.

In the US of A, some of the dealers aren't that clever and set the PIN to a default (often something like the last 4 digits of the VIN!) Sounds like that's what happened in this case - a inept dealer.
 
Errr, this story is a complete load of utter bull! :jerkoff:

The Diavel and Multistrada come with no PIN from the factory and it is certainly not the last four digits of the chassis number, 100% guaranteed. Until it is set up the key is the only thing that can switch the bike on.

There is a sequence we have to go through (and I assume every responsible dealer does prior to delivery) to put the code in for the first time. We ask the customer for a memorable number, so to the thieves, best of luck if you wanna guess what it is, you've got 10,000 possible combinations to try.

There is also a vital step missing from this story and also the training we give on how to enter the code.

So anyone with a Multi or Diavel, please don't worry, your bike and PIN are quite secure.:)
 
miloVanMultistrada said:
The Multistrada 1200 uses the same system and in that case there is no default set.

The dealer sets the pin with you at handover time - but if the PIN hasn't been set, you can't use that method to start the bike.

In the US of A, some of the dealers aren't that clever and set the PIN to a default (often something like the last 4 digits of the VIN!) Sounds like that's what happened in this case - a inept dealer.
Click to expand...

You beat me to it Miles.:cool:
 
I do some work in IT security , some work.. the infiltrator says mmm?

first post , not even hi, its me ,

"potentially ride of with your pride and joy"...

the word off has as you see two ffffffffffs in it :)
 
molenz said:
I do some work in IT security , some work.. the infiltrator says mmm?

first post , not even hi, its me ,

"potentially ride of with your pride and joy"..
the word off has as you see two ffffffffffs in it :)
Click to expand...

Your point is???
Sounds like he read the story and thought he was doing some of us a favour.
If he was up to no good he's hardly likely to advertise it :flash:
 
You must log in or register to reply here.
Back
Top Bottom