75811 : Ducati Diavel Motorcycle Default Ignition Password
Printer | http://osvdb.org/75811 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
42	17344	about 2 years ago	about 1 year ago	10 times	80%

Timeline

Disclosure Date
2011-04-05

Description

By default, Ducati Diavel motorcycles install with a default ignition password. The bike can be started using a manufacturer default PIN, set to the last 4 numbers of the Vehicle Identification Number (VIN), which is publicly known and documented. This allows attackers to trivially access the bicycle and enjoy the 162 horsepower and wind blowing through your hair.

Classification

Location: Physical Access Required
Attack Type: Authentication Management
Impact: Loss of Integrity
Solution: Workaround
Exploit: Exploit Public
Disclosure: Vendor Disputed, Third-party Disputed

Solution

Immediately after purchase, change the startup PIN as directed in the instruction manual (you did read that, right?).

Products

Unknown or Incomplete

References

Other Advisory URL: http://nakedsecurity.sophos.com/2011/10/28/ducati-diavel-power-speed-looks-and-a-vulnerability-lesson-for-friday-afternoon/
http://twitpic.com/4hd6up
http://www.asphaltandrubber.com/news/steal-ducati-diavel/
http://www.ducatinewstoday.com/2011/04/the-ride-of-your-life-just-4-digits-away/
http://www.laresblog.com/2011/04/why-cant-i-just-buy-motorcycle-without.html

Credit

Chris Nickerson - Lares Consulting

CVSSv2 Score

NVD does not currently have a CVSSv2 score assigned.

Comments

Add Comment Hide Add Comment

Anonymous - 2011/09/30 06:40:00

Actually this is an internet runour that has spiralled out of control and is not even remotely true.
If you are to believe the internet, a dealer had a pin with the last 4 digits of the VIN and told a customer this info. The customer then decided, in his infinite wisdom, to create and widely spread the story that all Diavels are the same. He couldn't have been more wrong.

This story has become so widespread that even Ducati Motor Holdings released a statement confirming my note below.

The truth is that all Diavel and Multistrada models COME WITH NO PIN NUMBER INSTALLED in the system, in other words, the PIN-start system is not actuated yet.

We as responsible dealers, ask the lucky new owner which PIN they would like installed in the first instance. We then show the new owner how to change the PIN whenever they want.

So for any new Diavel and Multistrada owners out there, please relax and don't believe everything you read, if you are unsure, please contact your nearest authorised dealer but they will only confirm my notes.

Best Regards
Martin Rees
Managing Director Ducati Glasgow

Anonymous - 2011/10/07 22:28:55

Exactly right. I even know the dealer that this guy went to and they configure it themselves. When I got my Diavel (from the same dealer), there was no PIN and thereby the function is disabled. Sillyness.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.