I'm working on a bike with Shimano Di2 (electronic shifting with servo motors in the derailleurs), and I use the e-tube software on a laptop to configure it. What I would like to do is be able to password protect the derailleurs setup so it is not able to be changed unless the owner wants it changed. So it's not able to be changed by someone else without the owners permission.

  • What is the use case here? What is not physically secure? The laptop, the bike, or both?
    – paparazzo
    Jun 7, 2014 at 18:30
  • It is not the physical that I would like to protect, it is the firmware or program in the components.
    – bykfxa
    Jun 8, 2014 at 7:45
  • 1
    When gold medals and world #1 placing's are concerned I would suggest anything is possible, or I would not ask!
    – bykfxa
    Jun 8, 2014 at 7:47
  • 3
    Really, what is your actual goal here? I know you're saying you only want to protect the firmware, but... why? If someone has physical access to the bike and malicious intent surely you have bigger problems, so you have to guard against physical access anyway, so this becomes a non-issue, right?
    – Cascabel
    Jun 8, 2014 at 23:58
  • 2
    While it begs the question, the issue of WHY has not been addressed. Assuming this could be done (pretty big assumption), this could be used to "lock in" a purchaser to a single bike mechanic or shop. Sort of like some automotive electronic codes can only be read/changed by the dealer due to proprietary interfaces. This is a dangerous proposition.
    – user12615
    Jun 13, 2014 at 18:41

4 Answers 4


The edit from freiheit did change the question. He removed the word firmware.

I am a software developer and did system support for many years.
Including highly secure systems.
In my world firmware and software are not the same.
Software is compiled - firmware is a raw set of instructions to specific hardware.

Yes it is possible to password protect firmware but it is not a common practice.
Not something you would simply add with a firmware update - there is typically hardware involved.
Firmware rarely has a password.
Even if firmware does have a password you can typically defeat it by just removing the battery.
Putting a password on a firmware is problematic at best.
Password is a point of failure.
This is device that is designed for reliability and weight.

I seriously doubt they have security / authority on the firmware.
Unless the product came with a default password that you had the option to reset the firmware does not have a password.

You must have physically access to attach the device.
Physical security does protect the firmware.
It is not something that can be changed without physical access.

If gold medals are at stake then I suggest physical security.

Really there are so many things on a bike you could sabotage.
If they got to the bike and you had a password on the firmware they would find something else to sabotage.
If someone wanted to sabotage the device the easiest hack would be to scramble the password.
If you are worried about tampering while the bike was out of your control then you should inspect all component including the e-tube.

A router is a great example of firmware and physical security.
(the answer from ewwite that firmware devices are relatively dumb is naive at best)
If you connect directly to the router you can set anything.
The assumption is that if you can touch the box you are trusted.

Gamers is the closest example to your use case.
You can password protect the BIOS (firmware) with a password.
In a money tournament the PCs will typically have BIOS passwords.
While you are on break you don't want someone to boot to a floppy and trash your system.

  • 4
    This is more a rant than an answer. Jun 8, 2014 at 21:42
  • @whatsisname I seriously doubt they have security on the firmware is not an answer?
    – paparazzo
    Jun 8, 2014 at 21:45
  • Thanks Blam , exactly what I wanted to know, and thanks to all other contributors.
    – bykfxa
    Jun 9, 2014 at 22:36
  • firmware often has some form of security, it's just it's usually rubbish - not so much true security as anti tamper (one example might be before you can set write-enable you have to set magic values on a particular combination of input lines.
    – Chris H
    Jun 10, 2014 at 11:34
  • @CareyGregory They vote for pretty over accurate. Question was posted by Shimano tutor and stated my answer was exactly what he wanted to know. OP even stated the answer with the most points did not address the question. How do you reconcile that?
    – paparazzo
    Jun 10, 2014 at 12:35

This is an odd question. The sentiment that the only security here is physical security is correct. Think about the following:

  • The Shimano Di2 components are not mated/matched to a specific computer or instance of E-Tube software. So there's no 1:1 relationship.
  • Therefore, any computer equipped with the SM-PCE1 or SM-BCR2 programming cables can be used to modify the configuration and firmware of the Di2 componentry.
  • This has to be done via the junction box/charging port.
  • Firmware can only be downloaded from Shimano and applied through this interface. And while the application has comprehensive logging, it's unique to the computer. There's no audit trail on the devices themselves.
  • Since this is the case, where or when would there be an opportunity to password-protect anything? You could protect your computer, but any computer can be used. The devices are relatively dumb, and the firmware is likely overwritten during updates.
  • E-tube is basically used to apply firmware and manage custom settings. You can save presets and load from a configuration file, but firmware is not revved very often.

Given all of this, use common sense. You can just keep the bike secured or limit access to the bike's junction box (think low-tech, like duct-tape or hot-glue). Or you can inspect settings and check firmware revisions.

In the end, the Di2 junction box is the brain of the system. Someone with ill-intent (and physical access) could just replace the entire module in 30 seconds or so. You're seeking a technological solution to a people problem.


physical junction box and proprietary port enter image description here

programming interface recognition enter image description here

application and communication logging enter image description here

device settings enter image description here

firmware revision dialog enter image description here

  • Thanks for the lengthy answer, I am a Shimano Bicycle tutor so I do know how to configure and build the bike.
    – bykfxa
    Jun 9, 2014 at 22:24
  • My question is Can this firmware or setup be pass numbered/worded or not, a simple yes or no, then I can move on to How can it be done. You guys are so OTT.
    – bykfxa
    Jun 9, 2014 at 22:26
  • 3
    @bykfxa NO!!!
    – ewwhite
    Jun 9, 2014 at 22:41
  • 2
    I explained why firmware passwords are irrelevant for your use case, as well as how it can be circumvented. In the systems administration world, the physical aspect is your security. Reaching for other solutions/answers is moot because the simplest solution is non-technical!
    – ewwhite
    Jun 9, 2014 at 22:47
  • 1
    Great answer and background. I think about an ill player swapping the junction box is a great point why passwords would be security theatre rather than real security
    – Rider_X
    Jan 31, 2017 at 3:53

Perhaps instead of password protecting it, you might want to think of ways you could detect that the device was tampered with. I'm not certain how often you would change settings or plug into it, but you may want to cover the port with security tape or something similar so that you are aware when somebody has been messing with the equipment. This may not be the best solution, but perhaps someone more familiar with the hardware could offer a solution to detect tampering with the hardware that would work better. Or perhaps you should just have your desired settings and firmware backed up and reload them before each ride or race.

  • +1 for this: "Or perhaps you should just have your desired settings and firmware backed up and reload them before each ride or race." Jun 10, 2014 at 4:29
  • 1
    A simple piece of steel could be made to cover the port and module, secured with a padlock - this would also prevent swapping out the module (until the lock was cut). Obviously you'd need to protect the frame from the steel, and it's no replacement for physical security on the bike - if someone wanted to sabotage you there are many ways this could be done much more quickly (let air out of tyres, grit on chain, right up to grease on braking surfaces).
    – Chris H
    Jun 10, 2014 at 11:38

If you have a bike with Shimano Di2, physical security should be paramount - I'm not sure why an unsavory person should even be physically near enough to the bike to be able to make those changes. And they'd have to be carrying the right cable and everything.

It seems like a highly implausible situation to occur, and certainly which should not occur provided the bike is physically secured so someone can't connect the e-tube software to begin with.

That being said, the software is likely proprietary, so it isn't clear if that functionality could be added - you'd have to probably reverse engineer it and see if you could mod it to do that.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.