Usually when we think of performance enhancing in professional sports we think of . But there are other, more externalised approaches too. Equipment tweaks in things like or can potentially do just as much as doping to affect outcomes.

But a new trend in professional cycling involves some hilariously blatant scamming: riders are installing electric motors on their bikes.

On Sunday, journalists at Italian newspaper Corriere della Sera and French TV network Stade 2 published evidence alleging in Italy last month. The International Cycling Union (UCI) has been using iPads to check bikes for electromagnetic irregularities, but the journalists used thermal cameras to collect additional data.

Speculation about tiny, battery-powered motors in the sport started around 2010. At the time, a spokesperson for the ICU : “Maybe we are facing a general problem. You never know with technology.”

In January, these concerns finally bore out when the “technological fraud”. It discovered that 19-year-old Belgian competitor Femke Van den Driessche had a hidden electric motor on the bike she used in an off-road cyclo-cross competition. “We believe that it was indeed technological doping,” Brian Cookson.

The Corriere della Sera and Stade 2 journalists allege that five riders were using electric motors similar to Van den Driessche’s, and two others had magnetic propulsion systems on their rear wheels. These electromagnetic wheels can add 20 to 60 watts of power on top of someone’s pedalling.

Power boost

Hidden motors can add , though probably in practice. A February article about the technologies : “You can do more miracles with electricity than chemistry.”

Electromagnetic wheel systems are somewhat mysterious and don’t seem to be sold openly, but electric motors are a consumer product marketed for the average rider. Who wouldn’t want an extra boost on the way to work or the grocery store?

So-called “e-bikes” like the cost about $2000 to $3000 and proudly advertise their motors. But conversion kits like the and can be in a similar price range or higher, especially if you are paying for special low-profile options like Vivax’s “Invisible Performance Package”.

Vivax in October that it hadn’t been contacted by the UCI and that its customers were mainly people over 60 who were trying to keep up with riding buddies.

Though electromagnetic wheels are no better, you can at least see how an athlete could justify them as a sort of equipment upgrade. Concealed motors, though, are just flat-out ridiculous. You’re basically doing a biking competition on a motorcycle.

The UCI clearly needs to continue improving its bike-scanning tech. Meanwhile, athletes should stop cheating. Or at the very least have some dignity about keeping the techniques subtle.

This article was first published on

Defining “terrorist”

Electronic stewards

As more and more everyday objects get connected to the internet, there is a pressing need to protect them as we do computers, says Slate‘s Future Tense blogger Lily Hay Newman

As the grows and more devices than ever have network connectivity baked in, you might start to wonder what protects all of these smart home appliances and media streaming dongles against hacks. The answer: pretty much nothing. Companies can release security updates or patches when they learn about vulnerabilities in their devices, but who is going to do a software update on their refrigerator?

The problem is particularly troubling in an industry where there are internet routers in every office and a voice over internet protocol (VoIP) phone on every desk. Even if attackers can’t get into your computer because it’s running anti-virus software, they can still get eyes and ears in your office by hacking a VoIP phone or video console unit. And since those devices are behind office firewalls, they might even be able to infiltrate network servers from there.

In an attempt to implement a large-scale solution for corporate and government application, a group of researchers at Columbia University in New York have started a company, , to sell security defences for embedded devices – that is the little computers in electronics that don’t look recognisably like a laptop, desktop, or server. The group has funding from Columbia and the US Department of Homeland Security, and had funding from the Defense Advanced Research Projects Agency for earlier research. Last week at the security summit , Red Balloon presented a of Avaya-brand VoIP phones and showed how their defence system, known as the Symbiote, can alert a device’s owner to an attack.

Spot the weakness

“Now that we know that these phones can be hacked and used as eyes and ears by the attackers, it’s time we started demanding real security on the phones,” says Ang Cui, Red Balloon’s chief scientist. “These phones, like most other embedded devices I’ve looked at, are about as protected as my laptop back in 2006, without anti-virus.”

In the past, Red Balloon has exploits of multiple . Combined with the Avaya demonstration, they have now exposed vulnerabilities in products that together represent more than half of total worldwide. That’s a lot of vulnerable phones.

Cui, along with Red Balloon’s director Salvatore Stolfo and the rest of their research team, are offering corporations and government agencies a free pilot licence of their package of defence products, . The goal is to install the product on the large quantity of devices these groups already use to offer protection, but also do recon to see if the devices have already been exploited, and by whom. Long term, the idea is for Red Balloon software to come standard on new devices so they are pre-protected for consumers.

The Symbiote

The main component of Red Balloon’s defence, the Symbiote, is a small piece of code that is injected into a “host” device. The product is “operating system agnostic”, meaning it can analyse and protect any device even if it is running a proprietary operating system that Red Balloon couldn’t have accessed and parsed in advance. Once injected, the Symbiote lies in wait, monitoring the system for suspicious activity like modifications in certain parts of the code. If it detects something, the Symbiote alerts the device’s owner and other Symbiotes running on the same network.

The Red Balloon researchers aren’t the only group working on defence solutions for embedded devices, though. At MITRE, a non-profit organisation that runs federally funded research and development centres, researchers are using work in Pittsburgh, Pennsylvania, to develop their own approach to system security. Xeno Kovah, MITRE’s information security engineer, explains that the approach he is working on also lives on a device, but isn’t looking for code modifications.

Instead it assumes that an attacker has full knowledge of the system they are hacking, and allows her to try to conceal her presence on the device. This very attempt at concealment involves sending requests to the device system that create a detectable change in the amount of time it takes for requests to be answered on a device, indicating the presence of the attacker.

Kovah points out that if Red Balloon’s Symbiote is focused on checking whether code is intact, an attacker could manipulate the system to make the Symbiote think that the system still looks the same when it has actually been modified. Additionally, Kovah points out that not all attacks involve modifying code. Instead, some are targeted at redirecting the flow of data through a system in deleterious ways.

In the wild

“The software Symbiote definitely does defeat the type of attackers that are in the wild right now,” Kovah says, but “I don’t have a lot of faith in it long-term”. Kovah worries that if attackers can control and warp measurements of a system, they can make products like the Symbiote send back normal readings even though a device has been compromised.

Cui says that he thinks timing-based attestation is a strong option in some contexts, but is “infeasible for the general case”. And he adds that AESOP, the security software suite, includes a component for evaluating the code that coordinates software and hardware (the firmware) and removing any unnecessary or easily repeatable code that a hacker could infiltrate or hide behind. Most importantly, AESOP is both a pilot of Red Balloon’s products and “a recon mission for us to find real embedded attacks in places we think we’ll find them”. The data from the pilot will inform Red Balloon’s next development steps by giving the group more information about who is currently exploiting embedded device weaknesses and why.

Everyone agrees, though, that embedded devices “have negligible security”, as Kovah says. “At least the Red Balloon approach gives you some ability to detect whether or not there’s manipulation of the device. That’s the kind of capability that’s not widely available.”

This article first appeared in