Harley-Davidson Vehicle Vulnerabilities

Nobody ever thinks it will happen to them or their systems.

I’m talking about building a digital defense and cybersecurity vulnerabilities.

Heads up Harley-Davidson!  The more connected motorcycles become, the more likely they are to get hacked.  Each new “connected” motorcycle feature introduces greater complexity, and with complexity inevitably comes vulnerability.

Motorcycle enthusiasts have spoken and Harley-Davidson listened.  Riders want increased connectivity not simply for productivity’s sake, but also for convenience.  It’s easier to, for example,  interact through the head unit and display an interactive map as the motorcyclist drives towards their destination, versus putting the address into the user’s cell phone’s app and trying to watch the map on the phone and drive.  So, riders use apps for Android and iPhone (Apple CarPlay), that leverage the smartphone for the head unit (HU) display.

At what point does the motorcycle become a data center on two-wheels?  Any part of the motorcycle that talks to the outside world is a potential inroad for attackers. And malicious actors have been incredibly productive, creating immense numbers of threats world-wide.

Do you think I’m ‘inflating’ this out of proportion?

Car versus motorcycle hacking makes great headlines and let’s take a look at a few recent vehicle examples: a moving Tesla Model S is hacked and the hacker remotely controls the brakes (Tesla was forced to develop and distribute a software update to resolve); a Jeep Cherokee was remotely accessed via the UConnect entertainment center from a laptop miles away and disabled it’s transmission (Fiat Chrysler, was forced to recall 1.4M vehicles); a 100M Volkswagen vehicles can be unlocked by hacking the signals from their keyless entry fobs; and then there was Hyundai’s Blue Link, a cell phone application for users to interact with their vehicle.  Users are able to lock, unlock, start and stop the air conditioning or heat, and start the vehicle from a remote location. In addition, the app allows for stolen vehicle recovery and vehicle health reports to be emailed to the user and other parties for scheduling service etc.

SOUND FAMILIAR?

Consider that earlier this year the Harley‑Davidson™ App and the H-D™ Connect service launched which allows owners to connect remotely to select 2020 Touring and LiveWire motorcycles.  The H-D Connect service provides cellular connectivity that can link a Touring and LiveWire owners with their motorcycle through their smartphone using the Harley-Davidson App. H-D Connect allows owners to connect remotely to their motorcycles and allows for viewing of key vehicle health information as well as stolen vehicle recovery and other parties for scheduling service etc.

A computerized motorcycle’s main defense against hacking used to be the fact that all of its systems were separated from any network. But with the rise of telematics systems, connected apps, and onboard WiFi, that’s no longer the case. Harley-Davidson owners now face similar security issues to computers or smartphones and, like those devices, “ironclad” software is the main line of defense and will be as susceptible to attack, just as the user’s home and office PC are.

I’ve previously posted about the larger Internet of Things (IoT). Basically, this means everything in your home that connects to the world wide web. Smart TVs, digital assistants, smart watches, fitness trackers, home security devices, thermostats, refrigerators, and even light bulbs are all on the connected list. Add to that all of the fun stuff: remote-controlled robots; games and gaming systems; interactive dolls; and talking stuffed animals … the list is endless.

And now we have connected Harley-Davidson motorcycles.  What do all of these have in common?   They send and receive data.  The essence of the Harley-Davidson digital transformation is interconnectivity. Interconnectivity is about more than the connections between devices — it is about the connections between customers, partners, and suppliers.  But, do you know how that data is collected, where it is stored, for how long and where it is going?

It’s not clear how serious Harley-Davidson takes the threat of potential cyberattacks on their motorcycles. Given the concerns of hackers doing a “drive-by” on your digital life and the number of malicious actors I’d like to see more transparency from them in regards to motorcycle digital defense — or we risk ending a road trip before it really begins.

Harley-Davidson Privacy Policy – HERE
Harley-Davidson Information Sharing Policy – HERE
FBI 2018 Internet Crime Report (PDF) – HERE

Photo courtesy of Cyber Defense Magazine and FBI

All Rights Reserved © Northwest Harley Blog

Read Full Post »

Was That Harley-Davidson CEO Matt Levatch’s Big Misstep?

Project LiveWire

It might make a good chapter in his memoir:  Harley-Davidson’s Matt Levatch:  “My Biggest Mistake.”

I’m talking about Project LiveWire and pivoting the motor company faster toward electric motorcycles.

As I previously posted, Mr. Levatch was “selected” to run the company after Keith Wandell retired.  A year after Harley-Davidson debuted the prototype for its LiveWire battery-powered motorcycle, Mr. Levatch states it will be much longer before the company’s new e-motorcycle will hit the market.  When pressed, Mr. Levatch narrowed down the possibility of an e-motorcycle launch sometime between 2018 and 2020.  Really?

Battery recharges seem to be the culprit.

That low-pitched whine we hear isn’t the aluminum-bodied prototypes in the wind.  Rather, it’s the ringing of cash registers at Zero Motorcycles and Polaris Industries who plans to release an e-motorcycle later this year.

Is it time for Matt and Musk to meet?  You know, that “Project Tiger” (the local code name for the Tesla battery factory east of Reno, NV) is on track and continues to move forward.  Mr. Musk might have some battery IP to provide Harley-Davidson.

Until they launch LiveWire, we can check it out in the action on the big screen. The latest Marvel blockbuster, called Avengers #27 or is that Age of Ultron, which features a prototype version of the electric bike driven by actress Scarlett Johanssen’s character Black Widow.

Photos courtesy of H-D.

All Right Reserved © Northwest Harley Blog

Read Full Post »

The Annual Biker Crawl

By now the campground dust has settled after the 70th Annual Sturgis Motorcycle Rally which brought thousands of motorcyclists and music fans to the legendary Buffalo Chip.

There were raucous crowds mixed with top tier entertainment at the “Chip” this year.  Even Pee Wee Herman lived through it to write on a blog for The Huffington Post about his experience.  See his video HERE.  But, overall it cemented the venue as one of the better entertainment locations with an array of art, vendors, food and people gawking (responsibly of course!).  The selection of musical guests resulted in one of the biggest music festivals of its kind in South Dakota. Doing a bit of name dropping, the entertainment included; Ozzy Osbourne, Bob Dylan, Kid Rock, Motley Crue, the Scorpions, ZZ Top, The Doobie Brothers, Dave Mason, Lee Rocker, Tesla, Drowning Pool, Creedence Clearwater Revisited, The Guess Who, Trailer Choir, Buckcherry, Orianthi, Stone Sour, Jason Aldean, Williams & Ree and Disturbed.

But here’s the rub… there were a lot of people going to/from the Chip.  I was part of the 5 mile commute from town to the campground traffic jam that ran from the Buffalo Chip to I-90 on Tuesday night (August 10th) as rally-goers sat on over heating motorcycles for a couple of hours on what locals call the annual “biker crawl” to catch the Bob Dylan/Kid Rock show.

The Chip celebrated it’s twenty-ninth year of operation.  That’s twenty-nine years of motorcyclists trapped in wicked heat and traffic grid lock.  There’s no excuse for an experience like this.  In Sturgis there were NO law enforcement officers directing traffic nor were there any Buffalo Chip staff.  Just grid lock. What went wrong and why is there no traffic coordination?  Were people improperly trained?  Did too many people overwhelm the event or have budgets been cut so slim that the job can no longer be done?  It’s a case of pointing fingers.

Bob Dylan at The Buffalo Chip -- 2010

Ron Woodruff is the owner of the Buffalo Chip campground who I’m sure has great pride having overseen the tremendous growth and World Wide recognition the “Chip” has earned as one of the premier concert venues in the mid-west.  Tried to correct this situation, he has and last fall he tried again to get the Meade County commissioners to take corrective action, but the commissioners defeated a Woodruff backed bill which would have set aside money to purchase land for a shortcut from the major campgrounds to I-90.   I’m sure the meeting went something like this: “We don’t need no road that will only be used for two weeks out of the year. It will kill the vendors who depend on Main and Lazelle traffic for their business.”

The dust settles on "The Chip"

But as a business, the Sturgis town council and the Buffalo Chip should never be happy when people attend the rally, put down hard earned money for music concerts and have a bad experience for any reason.  It’s a simple situation.  How many times a year can someone afford to drop $300 for two people to go to a concert, drink a few beers, eat a Gyro and buy a t-shirt?  Not many.  So, they need to listen to the customer and make changes.   How about traffic police coordination? How about traffic alerts?  Or Twitter updates on the expected delays or reasons?  How about park and ride buses with express lanes?  Something.  Anything!

And while I’m on this rant… how about that lame video set up on the Chip stage?   Hey Ron, 1979 called and said they want their VCR camcorder back!  Are margins so tight that a short-term rental of a couple video JumboTrons for people to see the artists or the Miss Buffalo Chip Beauty Contest be out of question?  Lastly, there use to be a TV segment on ABC called the “Fleecing of America”… I suggest a segment called the Sturgis “Fleecing of Every Motorcycle Music Fan?”  You see those stop signs that help create the grid-lock, become after the Chip concert, mixed with Monkey Rock and Full Throttle motorcyclists into a law enforcement sobriety stop as police officers stood in the street wafting for alcohol with their scientifically trained nose.  When they found an offence they processed tickets speedier and more efficient than the Hertz rental car return!

Were there irresponsible riders?  Oh yeah, and many of those who participated a bit more than others caught a free ride out of the traffic jam.  Yep, the Chip truly captures the essence of the motorcycle lifestyle, but it’s time for some changes.

Photo’s taken at the Buffalo Chip.

All Rights Reserved © Northwest Harley Blog

Read Full Post »