UW Computer Security Research and Course Blog

EDIT: It appears that I goofed with the “more” tag when I first posted this, so I’ve included the rest of the article below.

Since the days of waking up at 5am to watch the Tour de France live with my dad at eight years old, I’ve been a big fan of bikes. I’ve since grown to love riding them, and spent several years as an avid road racer. While I’m somewhat of an anomaly, many of you also rely on cycling for transportation to class, to work, and elsewhere. Unlike cars, which are just slightly harder to steal, bikes are the candy-from-a-baby in the world of theft. One magazine article I read several years ago had a “professional bike thief” (probably a security professional who learned methods of theft in his research) attempt to steal a bike secured by one each of every available bike lock on the market at the time. In public. The result? All but a single lock could be circumvented so quickly that nobody in the area even noticed that it was not unlocked by normal means.

I have to say, I am particularly bitter about bike security. A few years ago I was living in Stevens Court with a few friends. A past summer job at Gregg’s Greenlake Cycles had yielded an absurdly cheap employee purchase of a Lemond Tourmalet, a very nice road bike. I wasn’t using it to commute to school (who locks up a bike like that around the Ave?), but I did have it in our apartment so I could go riding. One day I came home and it had been stolen from my living room. My roommates had left the front windows wide open and the door unlocked. Go go speed racer, go.

Ahem…anectodes. So back to bike locks. Here’s the breakdown:
Assets:

• The bike: This one is fairly straightforward. The main asset is the bike itself.
• The value of the bike, either monetary or functional.

Adversaries/Threats:

• Many bike thefts are crimes of opportunity. Often, adversaries are not hardened criminals, but those taking advantage of an easy gain.
• Scalpers are the most common pre-meditated bike thiefs. They steal bikes for resale of the bike or its parts. Especially on more expensive bikes, the parts are, separately, worth more than the bike as a complete product. A 10-speed Shimano Dura-Ace component set (just shift levers, gears, chain, brakes, and derailleurs) could run almost $1,500. A pair of good Ksyrsium road wheels (not tires, just the wheels) can cost $1,100.
• Generic thiefs.

Potential Weaknesses:
Bikes are incredibly difficult to secure. Part of this has to do with the way they are built. Each bike component is just screwed or bolted on. Bikes need to be light and mobile so emphasis is not on security. Often security is a non-consideration. Moreover, due to the common use cases (transportation, recreation, or racing), it is impractical to transport heavy-duty security mechanisms along with the bike.

• Parts are not well-secured. They can be removed quickly and easily with conventional tools.
• With the exception of the frame, most components are either plastic, carbon, or very lightweight metal alloys that can be snapped or cut with hands or the most basic of implements.
• Because the various components all come apart, it is impossible to secure all of the securable and valuable parts of the bike without multiple locks.
• Most locks are just for show. Cable locks can be cut with wire or bolt cutters. Chains can be dealt with using bolt cutters of varying strengths. Hacksaws can cut most any cable, chain, or lock bolt, since all but the most expensive locks use cheap, unhardened, and generally low-quality steel. Finally, many of the locks themselves are insecure. Keyed locks are often easy to pick. Circular locks were shown crackable with a mere ball-point.
• People don’t bother. Many bikes are left unsecured, especially if the owner anticipates a short stop.
• Human error causes locking to fail. Many fail to grasp the detachability of the various bike components or underestimate the time it would take for a good thief to disassemble impeding components. You’ll see many lone wheels still locked to racks, or a frame by itself without any wheels, the fork and drivetrain stripped.

Potential Defenses:

• The greatest defense for a bike locked in public is to not be worth stealing. Nobody will ever waste their time trying to jack a cheap, old, or poorly maintained bike. If you’re commuting, especially in sketchy parts of time (*cough* the ave *cough*), don’t do it with a $2,500 road bike. Get yourself a used bike at a garage sale and ride that. If you are going to ride a nice bike, obfuscate it. Paint it over with an ugly color and bad paint job. Scratch it up. Plaster it with stickers. Get it dirty. None of these will work spectacularly well, but it never hurts.
• By a GOOD lock. This is especially true if you don’t heed the advice above. I would have no problem spending $100 on a bike lock for a nice bike. The very best bike lock out there will not stop a thief, but the best lock used correctly may impede them enough that they are deterred in a given context. So what is a good lock? Usually the way to go is either a good U-lock or fat, FAT chain and lock. If you actually care, I would recommend either the Kryptonite New York Fahgettaboudit Chain (https://www.kryptonitelock.com/products/ProductDetail.aspx?cid=1001&scid=1002&pid=1168) or U-Lock (https://www.kryptonitelock.com/products/ProductDetail.aspx?cid=1001&scid=1000&pid=1095). If you do get a U-lock, make sure it’s brand new and doesn’t have a tubular lock (the kind that gets insta-picked with a pen).
• Lock the bike properly. The frame MUST be locked to a secure beam. Ideally, you want to lock the frame, back wheel, and front wheel. With a single good lock, however, this is impossible. I, personally, simply lock the back wheel and frame with a single lock (carrying two locks is far too impractical…but I may come back to find a missing front wheel one of these days).
• Don’t take a bike to a known sketchy area in the first place.

Conclusions:

The bottom line is that if a crew with a van and power tools wants your bike…it’s just going to go. Sorry. If a single good bike thief with hand tools wants your bike, there’s also a good chance it won’t be there when you come back. The good news is that by far, most thefts are NOT committed by experts, but rather by fools taking advantage of an opportunity that you’ve given them. Take your lock seriously, lock your bike properly, and hope for the best.