Ducati has been at the vanguard of driving technology into motorcycles of late starting with traction control in the Ducati 1098R in 2008 and then taking it up several notches with the Multistrada 1200 in 2010 which allows for on the fly changes to suspension and engine mapping. The new Ducati Diavel includes many of the same systems including a proximity key with a PIN code immobilizer override which has been causing a stir on the interwebs.
A proximity key is one that allows the bike to be started as long as the fob is within close proximity to the motorcycle (e.g in a jacket pocket). Ducati allows a 4 digit PIN code to be set which would allow the bike to be started without the key fob in the case of a system malfunction.
Recently claims have surfaced on many web forums that suggested that the Diavel can be started easily without the key since the PIN code is set by default to the last 4 digits of the VIN. All of these claims turn out to be sourced from one blog post where the writer, who claims to be in the IT security industry, test rides a Ducati in Denver, CO only to find he cannot re-start the bike after stopping the engine. The date of this purported test ride? – April 1st!
“On my way back to the dealership I stopped by one of my good friends house to get a second opinion before I put down the deposit. After turning the bike off (via the On/Off electronic button) I went to grab him from the house but he wasn’t home. So, I hopped back on the bike and was headed back to the dealership. Except it wasn’t that easy. I got on the bike and hit the start button. The pretty screens fired back up with an electronic buzz and the TFT read “password” and showed 4 spaces.”
link: Security in Motion
The blog post goes on to recount how ultimately the bike was started by entering in the pin code, which happened to be the last 4 digits of the VIN. The implication, if true, was that would be thieves could easily start any Diavel after glancing at the VIN number. The post went on to claim that 4 other Diavel’s at dealerships could be started this way.
So what are the facts? Ducati does in fact offer an immobilizer over-ride option on the Diavel and the Multistrada 1200 as outlined in their respective user manuals (Diavel shown). It is indeed possible to set a 4 digit code in order to start the bike without the fob. It is also possible to change it (if you know the original code).
Responding to Ducati News Today’s enquiry, Ducati pointed out that this code is not set at the factory so this feature must be enabled if desired. According to Ducati:-
“There is no code set at all by the factory- it is supposed to be set at the dealer during PDI (pre-delivery inspection). They should be asking the customer what PIN code they want.” – Ducati North America
It is certainly possible that some demonstrator machines could have had their immobilizer over-ride set to the last 4 digits of the VIN but this would have been done by the dealer themselves.
The lesson here is that if you are purchasing a Ducati Multistrada 1200 or Diavel you should ensure the dealer sets the code to one you select as you take delivery. If you are concerned about the possibility of a thief virtually hot wiring your machine remember that there are 10,000 possible permutations available.
Given that the process of trying to enter a code is hardly a simple process (given that there is no keypad), it would take almost 28 hours of continuous trial and error to try all the permutations (assuming one code could be entered every 10 seconds).
So in summary, there is no code set at the factory and if you purchase a Diavel (or Multistrada 1200) your dealer should ask what PIN code you would like the override set to. If the remote possibility that a thief could brute force your code disturbs you, note that you can always not set an immobilizer override at all or have your dealer turn the feature off. Then you can only start the bike with the key fob in your possession.