https://www.dcrainmaker.com/2022/12/zwift-uci-cheating-astounding-championship-qualifier.html [svg][logo-opt] Login Become a Member * Login * About Me * Press * Contact * Advertise * Privacy Settings Search for: [Enter Keyword Search] [Search] Skip to content Menu * Home * Blog * Product Reviews + Apple + Action Cams + Activity Trackers + COROS + Drone Reviews + Elite + Fitbit Reviews + Garmin Reviews + GoPro + Peloton + Polar + Power Meters + Samsung + Suunto + Tacx + Trainers + Wahoo Fitness + Weight Scales + Whoop + Everything Else... * Buyers Guides + Best GPS Watches Buyers Guide + Best Bike GPS & Cycling Tech Buyers Guide + Bike Smart Trainers Guide + Smart Trainer App Guide + DCR Sports Gear I Use List + The Girl's Sports Gear I Use List + Photography Gear I Use + Baby/Child Gear We Use * How-To Guides & Tips * Race Reports * Travel + Paris Swim/Bike/Run Resources + Paris Restaurants (DCR Favs!) * Newsletter Heads Up - Massive Sports Tech Deals List! There are some amazing deals, including the Garmin Fenix 6 Pro at $311, the Apple Watch Ultra for $50 off, and the GoPro Hero 11 Black for $100 off. Plus tons more deals including Apple, Fitbit, Garmin, Google, GoPro, Samsung, Elite, Peloton, Tacx, Wahoo, DJI, Saris, and tons more! Huge savings and constantly updated, all here. JUMP TO: * Start * An Unbelievable Mountaintop Finish * The Datastream Attack * Previously Demonstrated at Hacking Conference * Going Forward * Discussion (86) close Astounding Data Stream Hack Gets UCI World Championship Qualifier Banned December 8, 2022 by DC Rainmaker|Sports Technology News and Reviews| Comments (86) I've never been good at writing titles. They're all too factual, and usually too boring. The titles I considered writing here were: 1) UCI Esports World Championship Qualifier Banned after Spicy Real-Time Manipulation of Data Stream 2) Zwift Race Cheating Gets Even More Covertly Brazen During UCI World Championship Qualifier 3) Previously Outlined Zwift Cheating Hack Actually Implemented in UCI eSports World Championships All would work, and there are many more potential good ones! However, I don't think any of those titles really capture just how ballsy this particular attack is, and more importantly, how big of a deal it is going forward to UCI's Esports World Championship series. As for the titles, feel free to add your own in the comments section. The winner gets nothing. So why am I writing about this? Well, I've long found these Zwift cheating bans interesting. To be clear, Zwift is only doing cheating bans on essentially pro-level races. Races where you've agreed to a set of terms, agreed to certain verification standards, etc... These aren't being done on your run-of-the-mill DIRT events. However, what fascinates me about them is just how increasingly technically brazen riders cheaters are getting with these. Mind you, these are only the ones where people have been caught and publicly flogged. In this case, arguably it's the very brazenness of not just the tech, but the race finish usage of it, that outed him. An Unbelievable Mountaintop Finish: 2022-12-08 (7)2022-12-08 (7) Back on November 13th, 2022, Zwift had a continental qualifier event for the upcoming UCI Cycling Esports World Championships. This particular race was for Europe & Africa, though of course, the World Championships cover, ya know, the world. That doesn't occur till mid-February, when everyone is solidly sick of trainers. That race even had a livestream of it, whereby 5,978 people watched the event unfold. This qualifier included 124 starters, with 50 of those advancing to the next race. Additionally, the winner got an automatic ticket to the world championships. Most notably, the livestream even had webcams from some riders - including the individual in question. The 27.2km race of Roule Ma Poule had been progressing normally, but there was one final ~100m ascent for the last couple kilometers, with a hill-top finish. Two riders had broken away from the pack, while the main pack, including our man in question Eddy Hoole, were back quite a ways. It's at that moment, right before the offending action occurred, one of the two announcers, Dave Towle, says (at 34:38), and I quote: "I don't know all 7 of the deadly sins, but I know two of them are greed and sloth. And certainly sloth is not the issue out here, but greed might be." Mere moments later at 37:28, rider Eddy Hoole starts a breakaway from the pack at the base of the final climb of the race - a daunting multi-minute climb to the finish. In doing so he's holding 8 w/kg up this hill for some 4 minutes in duration. At times breaking over 10 w /kg, in the middle of this extended climb. You can listen to the announcers astounded as Eddy inexplicably closes the gap from the peloton to the two leaders, passing them as Nathan Guerra says he "comes flying back like they're standing still", ultimately taking the win and qualification spot: 2022-12-08 (9)2022-12-08 (9) Just after crossing the line (41:23), announcer Nathan Guerra says: "He took on with an amazing effort, something we've almost never seen before"..."that is one of the best efforts, I literally have ever seen for a catch on Zwift, to go flying right on by, Eddy Hoole just did what I thought was absolutely impossible". Which, would turn out to be true. It wasn't possible, and is largely beyond known human performance levels. And again, just three minutes later when they cut to a side-by-side of the announcers, announcer Nathan re-iterated the implausible nature of it, and even seemed to be contemplating it, and seemed less excited and a bit more like the gears were already turning in his head. Follow that another 2 minutes later and announcer Dave Towle actually mentions the verification process ensuring that this data is valid from the trainers and power meters. The Datastream Attack: Yesterday, December 7th, 2022, Zwift published their so-called "Performance Verification Decision" document to their site. This document is basically the final list of charges and included ban for the rider. This doesn't get published immediately after the event, but rather, this is the culmination of that process. The process includes bilateral communication with the rider, teams, etc... It's aimed at figuring out whether cheating was purposeful, or perhaps accidental (such as a misconfiguration/miscalibration of a trainer/ power meter). And in fact, it goes through those very steps here. I think in the past, some of Zwift's initial performance verification decisions were on shaky grounds (while others were very solid), however, they've gotten better over the last two years, and it seems the only cases making it to public view (and thus bans) are the most damning cases. Obviously, Zwift wants to limit its legal liability here. Here's a chart of the entire race for the rider in question, Eddy Hoole: HRChartHRChart The data sets are as follows: * Terrain/Altitude - Grey * Power - Green * Estimated Energy Reserves - Yellow * Heart Rate - Red (In case you're wondering, Estimated Energy Reserves is W'bal, which is a way of estimating potential wattage over time - roughly like MPA from Xert. Here's a bit more detail on W'bal.) The focus area here is on that final climb, basically where all that blue text is at the top, and where the power jumps up. It's also the section I outlined earlier. The rider in question, according to Zwift, nailed the following wattages: * Total effort = 4min 16sec @ 526 Watts average * Best 4min average power = 526 Watts Zwift says that given the rider's weight, this equates to a sustained output of 8.5W/kg, which in turn would require a VO2Max of 90. Zwift goes on to note that the highest-known Tour de France or Olympic Persuiters have a VO2Max of about 85. As usual, Zwift then gives the rider the opportunity to have an independent lab conduct a VO2Max test, which, the rider accepted. Here's that excerpt: RiderTestRiderTest As you can see, at this point you're thinking 'Oh, just a miscalibrated power meter'. Except, remember that Zwift requires dual-recording for these races from both a power meter and a certified trainer. Now, Zwift (still, seriously, 3-4 years later), doesn't dual-process this data in real-time as has been begged for, for years. Instead, it's post-processed when required for stuff like this. So, what'd that data look like? Well, in short Zwift says the two were basically the same: ZwiftDataDualZwiftDataDual Even more, Zwift threw a bit of a knife-to-the-heart in there by noting that the trainer the rider was using is 'self-calibrating', which is basically a recent Wahoo KICKR or TACX NEO series device. I can't quite tell from the webcam angle what he's using. However, here's where the spicy part finally comes in. Zwift noticed that after the rider joined the pen, there was a brief disconnection that occurred to Zwift's servers. Interestingly, no other riders had this happen. Yet inversely, this rider had this happen in every race, but never any regular Zwift training rides. This particular data channel included analytics information about the sensor: ZwiftSpicyMeatballZwiftSpicyMeatball Note about Zwift says: "Zwift considers the absence of this analytics information to be equivalent to the presence of a masking-agent in anti-doping - for example, it would allow the rider to change their paired device from their trainer to a computer-controlled device that gave falsified power information, without such a change being recorded by Zwift's servers." In translation: The rider is inserting a device/software into the middle of the (basically open) data stream to dynamically change it, providing an offset (increased power), that gives the rider a boost. When asked about this, the rider had no answer, but instead deleted 150 publicly visible dual-recordings from ZwiftPower (a website used for displaying these recordings post-race to prove your data). The rider has since deleted or made private all his social media accounts, including his Instagram account which listed him as a "Web Software Developer". RiderDeleteRiderDelete Based on that, Zwift says they're satisfied that the rider knowingly cheated, saying: "The Performance Verification Board is comfortably satisfied that the power recorded by the trainer and used in-game did not match the actual power produced by the rider and/or was not the actual power measured by the trainer, and therefore that the rider's performance in the event cannot be verified. Further, the Board is comfortably satisfied that this was a result of deliberate manipulation of data, masked by the deliberate disconnection of the Zwift analytics datastream channel, rather than accidental miscalibration of two independent pieces of equipment by the same amount coupled with a coincidental accidental loss of analytics data." As a result, the rider received a 6-month ban, given it fell under a Tier 3 section - specifically, "Bringing the Sport into disrepute". In case you're wondering what else is in a Tier 3 ban, I asked Zwift: Tier 3: Bringing the sport into disrepute * Examples include, but are not limited to, the following: - Fabrication or modification of any data - Equipment modification or other external trainer control - Use of bots / simulated riders - Identity fraud - Abuse of race officials * Sanctions include, but are not limited to, the following: - First violation: Six month ban from Zwift Cycling Esports events. - Second violation: One year ban from Zwift Cycling Esports events. - Third violation: Lifetime ban from Zwift Cycling Esports events. Finally, Zwift ended the performance decision with the usual taunt, saying, 'if you can prove it, we'll drop it', which is basically a CYA in case the rider claims their first test was on a bad day. "If, within 1 month of the issuing of this decision, the rider can perform an independent laboratory test & antidoping test to the satisfaction of Zwift that shows that they are naturally physiologically capable of producing the results they have recorded in this event (including, but not limited to, an average power output of 8.5 W/kg for 4 mins), the Board will happily reverse its decision, reinstate the rider's results, and additionally reimburse the rider for the cost of the tests." Concurrently, the team he was riding for has terminated their relationship with him, as noted in a statement they published. "On Saturday 3rd December 2022 Esports Team Toyota CRYO RDT terminated their relationship with rider Eddy Hoole. The team was requested not to make any public statement while a Zwift Accuracy and Data Analysis Group (ZADA) investigation was ongoing. The results of this investigation were released today Wednesday 7th December 2022.... ...As can be seen from ZADA's determination the nature of this case is such that the team would not have the means to suspect / identify / investigate circumstances such as these as they require access to Zwift Server log files and an in-depth knowledge of how to interpret these. However, it was clear to the Management Team that as a result of initial information received from ZADA without any plausible explanation from the rider there was only one decision open to us. Esports requires a basis of trust on the part of all involved to ensure that the sport is fair, and we have and will continue to work with ZWIFT / ZADA in an effort to achieve this. We are saddened by this situation and will now study in detail ZADA's report to establish any lessons which we can learn from it." However, while the story for the rider ends here, it doesn't end here on the tech side. Previously Demonstrated at Hacking Conference: image_thumb-75image_thumb-75 Now, the kicker about this whole thing is that this exact attack vector was previously shown at a security conference back in August 2019 by Brad Dixon and Mike Zusman, from a security consulting firm. However, prior to that, on March 5th, 2019, Uncle Keith Wakeham demonstrated a very similar variant of this too (I say Uncle, because in the sports tech industry, everyone knows Keith and his Titan Labs, and almost all roads involving quirky data things and fun data projects, tend to lead back to Keith). When in doubt, Uncle Keith probably knows the answer, or why it exists. I actually wrote about both back in 2019. Both of these attacks essentially did the same thing - they were so-called 'Man in the Middle' attacks. Essentially, they took the data stream from your trainer or power meter (or heart rate, as also shown), and then tweaked the values before sending it onward. This is relatively easy to do over ANT+, but slightly more complicated over Bluetooth Smart (still, not impossible, just a bit messier). In the case of the attack that Brad/Mike showed, it was a bit more simplistic in terms of how it added spice to your ride. It offered either a set multiplier for your power, or it could just ride for you, and generate a fake HR number. However, the fake HR number wasn't super believable, given it was a bit more of a static value. It didn't have the human nuance that would show like a human suffering with slight ups and downs. Same goes for power. However, the multiplier mode (called EPO mode in their presentation) would be believable, since it was using your real power as a baseline. But it did show how they could execute it, on different channels and even control it via a game controller: [svg][image_thum] Meanwhile, Keith's hack wasn't re-transmitting things, but simply acting as the sole source of data. In other words, he could just sit there and do nothing and control a rider profile to whatever power/HR he wanted. In his case, he did add variability to the power/cadence/ HR numbers so that it was believable (or at least, more believable). Given in this case we saw the rider actually riding his bike via webcam, it's unlikely that he was just using an Xbox controller as in Keith's hack. However, that doesn't mean aspects weren't leveraged. PowerDataCheatingPowerDataCheating The implementation shown by the rider in question seems to be closest to what was demonstrated at the DefCon event. However, what's interesting is the channel drop portion. Zwift isn't clear in their document precisely what channel was dropped. However, given that Zwift notes *both* datasets transmitted/recorded for the race showed similar values, that tells you that this cheat was being applied to not just the trainer or power meter, but actually both of them. That's because if it applied to just one of them, it would have demonstrated a difference between the two required data sources. And notably, in this cheat, the rider was seemingly able to turn it on or off at will. Or, perhaps he just rode easy for the majority of the race with the multiplier always on. Going Forward: 2022-12-08 (10)2022-12-08 (10) The challenge with this cheat is that it's relatively hard to detect when used properly. In this case, the rider effed up by using it on a mountain-top finish with a crazy breakaway win. Had he stayed with the leaders and then just edged them out at the line, he'd probably never been flagged. Further complicating things is that he'd apparently been using the cheat for *all races*, effectively establishing a very good baseline that large data set algorithms might have ignored. Though, he screwed up by also not using it for training - which would have given him some plausibility excuse of a weird technical issue. The mitigation for this type of attack is the same as it was in 2019 when I posted about: Encryption or digital signing at the trainer level, which ensures the data stream isn't tampered with. In fact, Keith goes into detail on this in the second half of his video (there are YouTube chapters in it). Of course, the challenge there is that getting the trainer industry to agree upon even the most basic of standards has been impossible in recent years. They can't agree on how to implement steering; how are they going to agree to fundamentally change the direction of smart trainer protocols? All at a time when one trainer company is suing other trainer companies, and the remainder are closing their openness doors. The problem is: The cat's out of the bag. Sure, the idea was published years ago, but there wasn't much proof anyone was using it. Now, not only are people using it, but someone that had won an automatic ticket to the UCI World Championships used it. And he would have used it successfully had he not been, to quote Dave Towle, "greedy". And there's no doubt he would have eventually used it in the actual UCI World Championships, likely to outright win. It's at this point that I remind you that the UCI has a person (division in fact), dedicated to esports racing and trying to establish believability in the sport. It's a heck of a lot different when the UCI knocks on Zwift/Wahoo/Elite/Tacx/Saris/etc's door and says they need to implement something, than if someone like me says it. But at this point, the presence of this cheat in the wild demonstrates that if the UCI wants this title to have any meaning at all, then they need to start demanding some changes. With that - thanks for reading! Share Tweet Share 0 Shares Tags: Cheating, Zwift << New Shimano Di2 Workaround for Hammerhead Karoo 2 The Massive 2022 Sportswatch Year in Review with DesFit >> Related Posts * [svg][image-34-124x82]>> Zwift Bans Two Pro Racers For Altering Data: An Explainer of Sorts * [svg][Zwiftracing_thum]>> Zwift Bans Another Pro, This Time With History of Data Tampering * [svg][UndetectedCheat-]>> Zwift Bans Cheat Whistleblower: A Deeper Dive Into the Issue * [svg][ZwiftHerdWhiteOu]>> Zwift Racer Caught Cheating Using Recent Weight Changing Hack Post a Comment Cancel reply Reply link does not work in your browser because JavaScript is disabled. Your email address will not be published. Required fields are marked. If you would like a profile picture, simply register at Gravatar, which works here on DCR and across the web. [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] Subscribe me to the newsletter [ ] I would like to support DCR and enjoy ad-free DC Rainmaker ($20 per year). [ ] Notify me of followup comments via e-mail. You can click here to Subscribe without commenting Your name: [ ] E-mail: [ ] [Subscribe now] Add a picture [ ] Name *[ ] Email *[ ] Website[http:// ] [Submit Now!] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] 86 Comments 1. [svg][default] Dr. Jones December 8, 2022 at 6:59 am #1 Good article, one typo I saw: "Even more, Zwift THROUGH a bit of a knife to the heart in there" Reply + [svg][55926d1] DC Rainmaker December 8, 2022 at 7:02 am #2 Thanks! Reply + [svg][default] Warren December 8, 2022 at 8:37 am #3 Hy"s 'n poes! Reply + [svg][default] Charlie Anderson December 8, 2022 at 2:29 pm #4 Here's a small typo Olympic Persuiters Reply 2. [svg][0b4882b] Jimmy December 8, 2022 at 7:00 am #5 I'm not sure how he even got on the bike with stones big enough to try to pull this off. Reply + [svg][55926d1] DC Rainmaker December 8, 2022 at 7:02 am #6 I guess go big or go home. He selected both. Reply 3. [svg][default] FrankJ December 8, 2022 at 7:17 am #7 One of the many reasons not to ride indoors on Zwift. Reply + [svg][default] JP December 8, 2022 at 7:38 am #8 I couldn't disagree with you more. Zwift is an excellent indoor training and social tool (albeit with some bugs), allowing cyclists to both improve their fitness, meet new friends, and challenge themselves further, all in the safety of their own home. What this will hopefully motivate is continued insights into detecting and banning cheaters from ruining a great platform for others, as was done here. To me, this is pretty much the equivalent of warning, you should never go online because you could get a virus. Reply + [svg][default] MichalW December 8, 2022 at 7:41 am #9 Because someone, somewhere might be cheating? If that's a good reason not to do something we should stop most of the activities in our lives. Reply + [svg][default] Paul S. December 8, 2022 at 7:53 am #10 Yeah, why would this stop you from using Zwift? Would you stop riding outdoors if you heard that someone was doping in outdoor races? Reply + [svg][default] Chad McNeese December 8, 2022 at 9:47 am #11 I'm not sure there's a better example of "Throwing the baby out with the bath water.", Frank. As covered well by JP, MicahlW and Paul S., that is a very bad reason to discount Zwift in it's entirety. There are MANY ways to use Zwift that don't touch on racing. And for the many that do race, bad power data (intentional or otherwise) happens. The key to using Z racing is understanding that those examples exist, recognizing your interest in racing and choosing to ignore the stuff that is out of your control. I and others happily race and take what we need from it, along with the many other aspects Z offers. As mentioned, if that's your litmus test for life (any cheater invalidates the whole entity), you must not take part in many other things in life, since cheating and/or rule breaking are parts of just about everything I can envision Reply + [svg][default] BRIAN QUAN December 8, 2022 at 10:05 am #12 Well Said Chad. s Reply + [svg][default] Luciano December 8, 2022 at 10:16 am #13 Fully agree. 90% of the time I am on Zwift for structured training and workouts. I value this a lot however I have alternatives as good as Zwift for that (RGT or even MyWhoosh). Even free ones. What creates a real difference in Zwift is that notion of community for racing on top of the rest. Therefore valuing Zwift does not prevent from pointing at the incoherences of Zwift towards fair racing. They are the ones throwing ads on Eurosport claiming that Zwift competition is very similar or the same than IRL. IMO this is plainly deceiving. Plus there is a huge gap between claimed intentions and actual facts and investments in order to solve the issues that are well known for ages. I believe there are different ways to look at things, one of them has also to do with making the platform better. Reply 4. [svg][default] James Eastwood December 8, 2022 at 7:25 am #14 "Guy that openly and clearly cheated on his own youtube stream and called out by hundreds finally banned" Reply + [svg][55926d1] DC Rainmaker December 8, 2022 at 7:39 am #15 Ohh...that's a good one! (For context for others, the rider had previously posted videos of himself in various sticky watts type situations, though, perhaps those were just this in testing...) Reply 5. [svg][default] Mark December 8, 2022 at 7:29 am #16 Took a lot longer than I thought for this to show up in the wild. I personally enjoy Zwift racing, but it has a very very long way to go before it can be trusted. Is there any reason this can't be done without the tell-tale channel drops? Reply + [svg][55926d1] DC Rainmaker December 8, 2022 at 7:41 am #17 It's a bit fuzzy what 'channel' precisely Zwift is referring to, but, this sounds like something that Uncle Keith would know... Reply + [svg][default] matt December 8, 2022 at 9:07 am #18 There are others out there clearly using the same method to cheat in races and stream. Happy to point it out privately if you are able to get someone like Keith Wakeham to check. Reaching out to zwift and organisers of the larger race series, seems like either they don't care or some folks can already do this without these 'channel drops' to give it away. Reply 6. [svg][default] Hoot December 8, 2022 at 7:31 am #19 "It wasn't possible, and is largely beyond known human performance evels". BTW, the Open House last weekend was great...thanks again for this splendid event with the chance to meet you, The Girl and Des and to enjoy free beer/food and great company!!! Reply + [svg][55926d1] DC Rainmaker December 8, 2022 at 7:41 am #20 Thanks Hoot, and glad you enjoyed the event. Super fun to catch-up with everyone! Reply 7. [svg][b306ae9] Sam December 8, 2022 at 7:37 am #21 I do have some code out there which fakes ant power, if you have two ant usb key it would fetch the value from one source (the real power meter) and replay it with an increase on the other side... I never actually used it (I don't really care about racing, just do workout) but will be happy to share it if you want to write a followup article.. (it uses python-libusb running on a rpi) Reply + [svg][b306ae9] Sam December 8, 2022 at 7:44 am #22 (not planning to share to anyone else than ray, before someone ask ;)) Reply 8. [svg][default] Luciano December 8, 2022 at 7:41 am #23 that is sooooooo bad.... where is the bug bounty program Eric Min promised to the community 9 months ago? Reply 9. [svg][default] Luciano December 8, 2022 at 7:46 am #24 DC, the mitigation for this is a very easy outdoors verification protocol. On top of any technical solution, there is nothing like IRL for this. This one was highly highly predictable doing basic comparisons with Strava IRL rides. Specially at the level we are talking here. Outdoors protocol and ebiopassport. Reply + [svg][default] MichalW December 8, 2022 at 7:50 am #25 Such protocol has been uses by ZADA and race organizers for years. Reply + [svg][default] Luciano Pollastri December 8, 2022 at 7:52 am #26 the ZADA protocol is a joke, Eddy Hoole completed it... Reply + [svg][default] MichalW December 8, 2022 at 7:55 am #27 Protocol is good. Someone did a bad job analyzing his IRL activities. Of course, even those can be potentially faked. The only solution for this is IRL verification during live event or done by certified bike shop/gym/lab/individual. Reply + [svg][default] Luciano December 8, 2022 at 7:59 am #28 Well, I insist that the protocol is flawed and that there are KPIs you can look at IRL that would definitely solve the issue. I will certainly publish something about it with some other people in the next days. Reply + [svg][default] MichalW December 8, 2022 at 8:12 am #29 Live final events need to make a comeback to discourage 'virtual' riders. Reply + [svg][520bee3] Karl-Axel December 8, 2022 at 11:40 am #30 This. Stopping the slight insanity of attempting hosting prestigious events with people participating from their basements, should effectively discourage those who see an unethical opportunity to make a "career" in the discipline. And probably make the situation in rest of the "unprestigious" events better too with those gone. Would put I think an increased healthy business demand for more indoor-cycling studios facilities that could get "certified" to allow riders to participate from, when the event require it. So riders don't have to do ironically immense travelling across the country to participate in something run over the internet anyway. Reply 10. [svg][default] Paul S. December 8, 2022 at 7:49 am #31 So the cynic's version of the lesson here is to have your multiplier electronics in line and ready to go before you connect to Zwift so that the connection never drops. I'm not sure encryption will solve this problem. If the box in the middle can pretend to be Zwift to the trainer and the trainer to Zwift, wouldn't it have all the keys it needs? Reply + [svg][55926d1] DC Rainmaker December 8, 2022 at 8:08 am #32 It would. But, I don't think that's an issue. There's only a handful of trainer companies, and if they wanted to, they could get their act together pretty easily and coordinate this. It would provide a minor stumbling block for startups, but nothing of meaningful value since it could perhaps only be enforced at these pro level events, so by that point most startups would have had time to get their docs in order. Keith actually goes into this a bit in his video, in terms of things like no second chances, etc... Reply + [svg][b306ae9] Sam December 8, 2022 at 8:40 am #33 at some point the keys will need to be exchanged on the device where the client run and it would be not too difficult to figure out how to intercept or extract them.... except if they go full on cloud gaming, i don't think there is many ways to secure that... Reply + [svg][default] Dr. Jones December 8, 2022 at 10:06 am #34 > So the cynic's version of the lesson here is to have your multiplier electronics in line and ready to go before you connect to Zwift so that the connection never drops. Is that what the nature of the attack was or since Zwift found that the calibrations were out of whack after the race, was the defendant cutting the stream while changing the calibration factor? I don't understand how the MIM attack would result in power meter calibration factors being off. Doesn't this look more like the calibration factor itself was changed so that the reported powers would be higher? Reply + [svg][default] Mr James Eastwood December 8, 2022 at 10:26 am #35 No, you could simply have handshake between the trainer (at firmware level) and Zwift and an encrypted stream. Any alteration to the firmware would show. Reply + [svg][default] Douglas December 8, 2022 at 10:33 am #36 Not exactly. There are a number of encryption protocols which do not rely on sharing keys. Banking (and most web traffic) now use HTTPS which is, at least at this level, not crackable. One way to do it is with a set of keys in the stored in silicon (inside a physical chip) in the trainer. At some point someone may "decap" a chip, break the security and get the keys but that would take nation state level tools and experience. Reply + [svg][c520a80] stuart lynne December 8, 2022 at 1:39 pm #37 If, for example, the trainer implements a server and Ethernet /WiFi connection, it can then make its own connection to a 3rd party audit server in the cloud. Zwift locally accesses the data via HTTPS Websocket (or SSH) from the trainer. After the event, the data saved by the Zwift application can be compared to the data saved in the audit server. That could be part of the post-race results processing. Reply 11. [svg][default] NoOne December 8, 2022 at 7:52 am #38 The estimated power reserves look like W'bal, based on Dr Skiba's model. Pretty sure it's a screen gram from Golden Cheetah. Reply + [svg][55926d1] DC Rainmaker December 8, 2022 at 8:01 am #39 Indeed, Zwift just confirmed as well. More info for those that want it: link to em-sportscience.com Reply 12. [svg][default] Kevin December 8, 2022 at 7:57 am #40 "Hoole tool ruled fool on Roule Ma Poule" Reply + [svg][default] Torkil S December 8, 2022 at 8:22 am #41 [?][?][?] Reply + [svg][default] Matthew Fields December 8, 2022 at 8:42 am #42 Bravo! Reply + [svg][default] Thomas December 8, 2022 at 9:02 am #43 Hands down! We have a winner! Reply + [svg][791e4eb] Tom December 8, 2022 at 10:26 am #44 That was unbelievably good. Reply 13. [svg][default] Fastas December 8, 2022 at 8:18 am #45 "And there's no doubt he would have eventually used it in the actual UCI World Championships, likely to outright win" Don't they do the worldchamps in person with supplied kit (bike aside...), how would this cheat work in that situation?? If it wouldn't, what's the point of cheating knowing that you'll be "unmasked" then....? Crazy.... Reply 14. [svg][default] marc steingrand December 8, 2022 at 8:41 am #46 Its amazing to see how much enrgy peaple use to cheat, and what do they get with is? its frustating to see if all this energy would be used for the good ... like improuving Zwift or other software we would be much better intresting that this risk was shoen in 2019 and Zwift did not react, i thin this is the second tinme hapening.... someting where zwift should take more leadership... Reply + [svg][default] Paul S. December 8, 2022 at 8:48 am #47 Why do people cheat on Strava challenges or segments? There's nothing to gain there. Here, at least, there's probably money available, either prizes or potential salaried contracts with actual teams. Reply + [svg][default] Luciano December 8, 2022 at 9:21 am #48 If one day you find an explanation to human being stupidity you will be eligible to Nobel prizes in several disciplines Reply + [svg][default] Pat C December 8, 2022 at 9:28 am #49 Why cheat on Strava segments? Bragging rights in your riding circle and the inflated ego that goes along with being #1. When you're really #2... Reply 15. [svg][a2fe9ad] Laurent Goderre December 8, 2022 at 9:22 am #50 Before even reading the conclusion I came to the same one, a fix for this is simple but very hard to implement because it would mean cooperation of all powermeter companies. I think the simplest way to do this is to have new firmware that would allow to register your power meter outside of the normal transmission of data and when doing so, a secret key would be stored on the Zwift server and powermeter device. Then, there should be a new signing channel using private key encryption to send a combination of the secret power meter key and the power value, encrypted using a Zwift public key so only it can decrypt it. Reply + [svg][default] Steve Vigneau December 8, 2022 at 9:49 am #51 Just need to yoink the key out of a PM and then you can do the same MITMing. Fighting this would be the same kinds of arms race that has effectively allowed ripping of Blu-Ray discs: a losing battle. (Blu-Ray has a similar problem... Encryption keys on players that keep getting grabbed and used for ripping. These keys can be invalidated, but so long as there are crappy manufacturers that don't sufficiently protect the keys in the hardware the window, it's a losing battle. Reply + [svg][a2fe9ad] Laurent Goderre December 8, 2022 at 10:43 am #52 Maybe but trying to extract the key from the hardware is much harder to do than a man-in-the-middle attack. The firmware shouldn't even have an option to read the key. At that point you would have to physically tamper with both devices to read that value from its internal memory. That is a pretty high bar to go over in order to cheat that other forms of cheating may seem more accessible Reply + [svg][default] Steve Vigneau December 8, 2022 at 11:00 am #53 All it takes is one hardware hacker to do it, though, and then write a tool and the cat's out of the bag. After that point that key would need to be invalidated, making all those trainers not work unless their private key was updated. That'd be horrible for users and a black mark on the brand. Reply + [svg][default] Dr. Jones December 8, 2022 at 12:09 pm #54 Why do you need a secret key on the Zwift server? The power meter itself could simply sign its data using PKE, and that would prevent a MIM device from modifying the readings. The only way for this to be defeated by a bad actor is to physically recover the power meter's private key, which if implemented well would require physically exposing the silicon. The problem is power consumption. Reply + [svg][default] Dr. Jones December 8, 2022 at 12:12 pm #55 BluRay had a problem where the "locked" item (the disc) was unable to perform computations so it needed to be pre-shared keys. That problem was compounded by the fact that the BluRay group wanted everyone to be able to sell decryption hardware and so it was inevitable that someone would fail to protect the keys. In this case, we want the power meter to be the locked item, and it can not only perform computations (which means public key encryption can be used) but there is also no expectation that every fly-by-night company is able to use the keys. Reply + [svg][a2fe9ad] Laurent Goderre December 8, 2022 at 12:28 pm #56 You could do a different key for every session that gets negotiated at the beginning so you don't need to store it on the PWM but it should definitely be stored at Zwift for audit purpose otherwise you wouldn't be able to validate the signed data. Reply + [svg][b306ae9] Sam December 8, 2022 at 12:50 pm #57 yeah it's a loose battle.... we just need to have matchign irl results! Reply + [svg][default] Dr. Jones December 8, 2022 at 1:09 pm #58 @Laurent If a power meter signed its data packets with its private key, anyone with the public key could verify the unmolested authenticity of said data packet. No need for a different key every session. No need for key negotiation. No need for Zwift to store a secret. No ability to MIM the data packets unless the private key gets physically recovered from the silicon of the power meter. If implemented correctly it would take the physical removal of the power meter's encryption chip packaging and looking at the chip under a microscope to have a chance at finding the key. You're hung up on private key encryption which isn't the way to do this. Reply + [svg][default] Dr. Jones December 8, 2022 at 1:16 pm #59 Also remember, we're not trying to hide any data from anyone. We're simply trying to prove authorship of data - trying to prove the data came from X power meter and not Y man-in-the-middle device. There's no need to make this a bi-directional conversation (no "negotiating keys") because we don't care who can see the communications. Also remember, unlike the broken BluRay analogy, we're not trying to both share data (a movie) to "trusted" users (authorized BR players) while hiding the exact same data from untrusted users (pirates). BluRay HAD to share the private key to make that system work. What we need here is for the hardware to sign its data, thus the key never needs to leave the hardware. A very different problem. Reply + [svg][default] Steve Vigneau December 8, 2022 at 1:46 pm #60 All you need is to get the key out of one device and turn it into a cheat device. After that point the key used for cheating needs to be revoked and all devices using that key updated to have a new one. There are timing issues around when to revoke and when to reissue, and any device that doesn't get updated won't work after the revocation happens. I just don't see it happening because either every participant in the ecosystem (say, Zwift) needs to cooperate, or no one does. It's a prisoner's dilemma. There's also no central group as there was for Blu-Ray, and personal fitness devices don't exactly have the huge money backing that the movie industry does. Or, a third option for those who take racing really seriously, would be someone (say, Zwift themselves) making a certified trainer that signs things. Then you can have most folks with normal power devices, select people on Certified Power Devices, and those devices required for certain races. It'd be kinda like the virtual power and power meter tiering there is now, but one more. Reply + [svg][a2fe9ad] Laurent Goderre December 8, 2022 at 3:45 pm #61 Yeah, that's why the key can't be tied to the device because it can be compromised. A session-based handshake would mitigate this problem. As far as how to do this as a business problem, if only one company was on board, they could market their PWM as "secure" or "cheat-proof" and individual team could even market themselves as using this PWM. It wouldn't even need to me required for a while but just used as a transparency good faith token from teams like hey, we are committed to racing clean Reply + [svg][default] Dr. Jones December 8, 2022 at 4:04 pm #62 @ Steve > All you need is to get the key out of one device and turn it into a cheat device. After that point the key used for cheating needs to be revoked and all devices using that key updated to have a new one. Not if you require people to register on Zwift with their specific power meter(s). This isn't encryption with 1 end goal, it's signing with a unique key. Every device would have a unique key. > I just don't see it happening because either every participant in the ecosystem (say, Zwift) needs to cooperate, or no one does. It's a prisoner's dilemma. There's also no central group as there was for Blu-Ray, and personal fitness devices don't exactly have the huge money backing that the movie industry does. There is no threshold problem with a solution like this. Zwift need not care what JoneRacing.com does. A central body isn't needed. The attack (physical inspection of the chip under a microscope) is incredibly hard and can't scale. There's no reason, at this time, to suspect there would be widespread cheating. > Or, a third option for those who take racing really seriously, would be someone (say, Zwift themselves) making a certified trainer that signs things. Then you can have most folks with normal power devices, select people on Certified Power Devices, and those devices required for certain races. It'd be kinda like the virtual power and power meter tiering there is now, but one more. Or Zwift can just work with 1 power meter company to make a signing power meter and then open the standard and tell people that starting next year only signed meters will be allowed. No need for them to make hardware or to make it exclusive. Reply + [svg][default] Dr. Jones December 8, 2022 at 4:07 pm #63 @Laurent > Yeah, that's why the key can't be tied to the device because it can be compromised. Handshakes are subject to more trivial attacks than pulling a private key off of silicon. Handshake attacks scale better as well. Reply 16. [svg][default] Nathan Lipke December 8, 2022 at 9:41 am #64 I wonder how much the race format exposed the cheat. The UCI and ZGP races both place a lot of emphasis on repeated big finishes. Reply 17. [svg][default] Steve Vigneau December 8, 2022 at 9:46 am #65 I wonder if this would be even easier to do with the network-connected trainers because then you can skip the RF layers. Kinda wish I had one; it'd be a fun winter project. (Just need to introduce some noise and variability with the offset and it'd be really, really hard to detect.) Reply 18. [svg][default] Robert December 8, 2022 at 9:47 am #66 Maybe Zwift, one day, will set it up where Zwift can connect to multiple sources, of the same data, for comparison purposes. Even if it only for this type of event. Personally, I don't have a need for such an option, but it sure does like Zwift needs it. And for things like channel disconnects, that is up to the rider to ensure is working prior to the event. Maybe another screen/ prompt to let them know it is missing. If they can't meet the requirements, then can't race. Simple as that. It is no different if the team didn't bring enough tires to a race or didn't bring the tools to change a tube. Reply + [svg][55926d1] DC Rainmaker December 8, 2022 at 9:59 am #67 Yup, I'd agree. In fact, I think it's actually super useful for helping both prove cheats, and help accidental calibration issues. Every trainer/power meter has relatively unique ID's that are broadcast to Zwift. Sure, ANT+ ID's are re-used to a degree, but when combined with other model/FW details transmitted from the sensor + your actual account, it developed a pretty unique fingerprint of that unit. Having dual-recorded built-into Zwift so that every time you ride you're building up a 'database' of that data would be super helpful. Heck, it'd even be helpful in helping people know when something is amiss - a system that automatically points out super high (or low) values due to miscalibration or whatever. And this is something that people have been asking for, for years, and it's all that complex. Reply + [svg][default] Mr James Eastwood December 8, 2022 at 10:30 am #68 Don't you think Dual Recording has contributed to many of these issues? It gives a cloud of authenticity even though it is completely meaningless, as the secondary power meter in almost all cases can be easily configured to match the power of the primary source, whether that primary source is accurate or not. Reply 19. [svg][474cc86] jordan fowler December 8, 2022 at 10:00 am #69 Aka "why Zwift is a game and not a sport unless it's done in person live on competition-supplied trainers, etc." What other eSport has this easy of ability for participants to change outcomes? Surely not Madden, or COD, etc. right? I mean at the less than PRO level it's as easy as dropping your weight or height. Even and the PRO level we now see this type of thing occurring. Reply 20. [svg][default] Average Andy December 8, 2022 at 10:07 am #70 The names Hoole, Ass Hoole... Reply 21. [svg][default] Toyota CryingGen December 8, 2022 at 10:14 am #71 Good article Ray! One question I do have on this though. The "independent test" was this actually a lab test or a case of the rider got asked to ride outside and provide a 4min effort with data to validate against? Was GPS/VAM used from outdoor to show the PWM was over reading or was this a separate lab test where an independent person/company tested him on their equipment with his own PWM to establish was over reading? That then leads onto a slight issue with the theory in that the PWM was found to be over reading independent of the at-home MITM device setup. Your theory is that the device was boosting the watt data output from both the trainer (to game) and PWM (to head unit)..... but if the PWM was over reading by the near 25% ZADA claim when it was not present in the MITM device situation then I can't understand how said device was boosting both sources like your theory claims. More like the primary source was being boosted by the device to closer match the already sloped/offset/ boosted PWM which is reading high all the time regardless of the MITM device. Love to hear your thoughts or discuss. Feel free to email me :)_ Reply 22. [svg][default] Mike December 8, 2022 at 11:04 am #72 Six month ban is a joke. This was a lengthy, deliberately planned cheat over many races leading up to and including this event. A lifetime ban is the only acceptable penalty IMO. Reply + [svg][default] Vader December 8, 2022 at 11:06 am #73 100% agree. The guy has been confirmed to have been cheating in almost every race he's done in last what, 2 years? At very least, ban him for length he's been cheating. Reply + [svg][default] Claus Jacobsen December 8, 2022 at 5:36 pm #74 well there's big bucks available on the mywhoosh races apparently - he would just go there i guess Reply 23. [svg][default] Vader December 8, 2022 at 11:04 am #75 It's wild that a reputable team in Zwift, at the highest level of e-sport, has obviously done ZERO due diligence into the riders on their team. Hoole has no outdoor results to speak of yet the team blindly accepted that Hoole could compete at the highest level? Shame on them too. As usual, Zwift not doing near enough to address cheating. Reply + [svg][default] Mr James Eastwood December 8, 2022 at 12:38 pm #76 Yeah it's easy to release a statement after the fact, but to go so long (taking money in to the club directly from Zwift too) with the attitude 'it's not a problem until it's a problem' is a major issue. Reply 24. [svg][default] Nick December 8, 2022 at 11:24 am #77 A 6 month ban seems light for intentional and provable cheating. I understand that type of ban for outdoor riding if someone took ped's since it is a bit harder to prove. Imo this is similar to catching someone red handed trying to mechanical dope outdoors. Obviously for this rider, there were ramification outside of the ban like getting dropped from his team but for situations such as this, in arguably one of the bigger Zwift events, the punishment should have been harsher. Reply 25. [svg][1bc4ed3] Chris Schwenker December 8, 2022 at 11:35 am #78 [svg][4205752-40] Great article! Thank you. Reply 26. [svg][default] Freman "Fritz" Hartman December 8, 2022 at 12:16 pm #79 It could be just me ... but doesn't the penalty seem a bit light? Why not 2-3 years and the something lighter for the team? I state that acknowledging that getting these things right can be tricky. On one hand, you have the decision to strip Cameron Jeffers of his title, which I found to be a rather strange. [Why does it matter if the guy obtained a bike, available to everyone through nefarious means? So he didn't spend enough time in Zwift prior to the race to get the superbike. So what? Why wouldn't you open up all the bikes to all the competitors equally prior to the race anyway?] Reply + [svg][default] Chad McNeese December 8, 2022 at 12:32 pm #80 Not just you. Others have already mentioned the shortness of the penalty in comments above (literally one reply ahead of you in one case ). I agree that 6mo is laughable considering all that is known in this case. Reply + [svg][default] Roady December 8, 2022 at 1:19 pm #81 Totally agree with Fritz here, the ban when put alongside the punishment of other 'e-dopers' seems very light. I'm not even that aware of many others outside of Cam's but the two side by side are arguably totally different and should be totally different in scale. Yet they're not. Both 6 month bans, a light fine and stripping of titles/wins. One was knowingly manipulating power data over several years to unfairly gain an advantage across the board in 'every' competitive race. The other working 'around the rules' to gain access to a bike frame others where riding in the same event - to effectively level his playing field with them. Yes they made an example of Cam for being 'the first', but a larger example should have been made here. Just ask many of the community racers/admins. Hoole is well known for being a cheat and totally unbelievable performances. He just hadn't been caught until now. Reply 27. [svg][1458a46] Jeffrey Werner December 8, 2022 at 1:04 pm #82 "Zwift then gives the rider the opportunity to have an independent lab conduct a VO2Max test, which, the rider accepted." Is that confirmed a lab conducted the test? From Zwifts somewhat vague wording it sounds like the actual power the cheater put out (~400W) was maybe calculated based on a ride they did for verification? Reply 28. [svg][default] Ronald December 8, 2022 at 1:12 pm #83 It is getting harder and harder to win Zwift races. First they make it impossible to change weight during the race. Can't sandbag anymore due to autocat. And now it is forbidden to alter our signal? What's next? Does anybody know if this still possible on whoosh? (Asking for a friend) Reply 29. [svg][c520a80] stuart lynne December 8, 2022 at 1:31 pm #84 PerfPro CT SmartBridge is a commercial product that demonstrates this type of bridge. It bridges a Computrainer to ANT+ in precisely the same manner, allows for control of the CT and power data etc is sent back via ANT+. This provides a more robust way to use your CT with Zwift. The only (slightly) tricky part of this hack is ensuring you modify both sets of power data to make them look similar enough to pass muster but still be dissimilar sufficient to look unmodified. This is also not limited to ANT+, BLE data streams would be as easy to manipulate. And if fact BLE data could be modified and streamed out of ANT+ or vice versa. The data could be protected cryptographically. Trainers are not power-limited (like power meters). Just having the equivalent of a Raspberry Pi with Ethernet/WiFi embedded in the Trainer would allow an SSH or TLS connection to collect the data and control the connection. Reply 30. [svg][default] Colin December 8, 2022 at 1:52 pm #85 I've got a hack that turns me from a 8w/kg to 3W/kg type person, happy to share, note that the training does involve copious amounts of beer. Colin. Reply 31. [svg][default] Vader December 8, 2022 at 2:35 pm #86 It's obvious that ZADA, ebiopassport, etc... are all easy to fake and get approved while still being a cheat. The one constant I've seen with riders who are good racers on Zwift is that they have good AND transparent results IRL. Publicly posted IRL results, whether on Strava or even athlinks.com or similar is a must. Any team worth it's salt should be confirming their riders are backing up indoor results with outdoor results. Reply * TwitterFacebookStravaYouTubeInstagramRSS * * I'm DC RAINMAKER... about-rayabout-ray I swim, bike and run. Then, I come here and write about my adventures. It's as simple as that. Most of the time. If you're new around these parts, here's the long version of my story. * Wanna support DCR?Wanna support DCR? You'll support the site, and get ad-free DCR! Plus, you'll be more awesome. Click above for all the details. Oh, and you can sign-up for the newsletter here! * Here's how to save! Wanna save some cash and support the site? Use Backcountry.com or Competitive Cyclist with either the coupon code DCRAINMAKER for first time users saving 15% on applicable products. [svg][Lockup-Secondary-Midnight] And both Backcountry & Competitive Cyclist offer free 2-day shipping! [svg][CC_17_grey] In the UK/EU/Australia/New Zealand? Then hit up Wiggle at the link below! [svg][Wiggle-Logo] Alternatively, for everything else on the planet, simply buy your goods from Amazon via the link below and I get a tiny bit back as an Amazon Associate. No cost to you, easy as pie! [svg][Amazon-Logo-Sidebar] You can use the above link for any Amazon country and it (should) automatically redirect to your local Amazon site. * Product Comparison CalculatorProduct Comparison Calculator Want to compare the features of each product, down to the nitty-gritty? No problem, the product comparison data is constantly updated with new products and new features added to old products! * * The DCR AnalyzerThe DCR Analyzer Wanna create comparison chart graphs just like I do for GPS, heart rate, power meters and more? No problem, here's the platform I use - you can too! * [svg][DCR-YouTube-Widget-1] Think my written reviews are deep? You should check out my videos. I take things to a whole new level of interactive depth! * Winter 2020-2021 Smart Trainers GuideWinter 2020-2021 Smart Trainers Guide Smart Trainers Buyers Guide: Looking at a smart trainer this winter? I cover all the units to buy (and avoid) for indoor training. The good, the bad, and the ugly. * [svg][FIT-File-Logo-Working-e1554638692537] Check out my weekly podcast - with GPLAMA, which is packed with both gadget and non-gadget goodness! * [svg][DCR-Kit-Merch-1] Get all your awesome DC Rainmaker gear here! * FAQ's I have built an extensive list of my most frequently asked questions. Below are the most popular. + Do you have a privacy policy posted? + Why haven't you yet released a review for XYZ product you mentioned months ago? + Will you test our product before release? + Are you willing to review or test beta products? + Which trainer should I buy? + Which GPS watch should I buy? + I'm headed to Paris - what do you recommend for training or sightseeing? + I'm headed to Washington DC - what do you recommend for training? + I'm from out of the country and will be visiting the US, what's the best triathlon shop in city XYZ? + What kind of camera do you use? View Them All Here - * 5 Easy Steps To The Site 1 [svg][Product-Review-Front-Page-Tumbnail-300x20] In Depth Product Reviews You probably stumbled upon here looking for a review of a sports gadget. If you're trying to decide which unit to buy - check out my in-depth reviews section. Some reviews are over 60 pages long when printed out, with hundreds of photos! I aim to leave no stone unturned. 2 [svg][2020-RecommendationsGuide_thumb-300x200] Read My Sports Gadget Recommendations. Here's my most recent GPS watch guide here, and cycling GPS computers here. Plus there are smart trainers here, all in these guides cover almost every category of sports gadgets out there. Looking for the equipment I use day-to-day? I also just put together my complete 'Gear I Use' equipment list, from swim to bike to run and everything in between (plus a few extra things). And to compliment that, here's The Girl's (my wife's) list. Enjoy, and thanks for stopping by! 3 [svg][New-Travel-Photo-Front-Page-300x200] Have some fun in the travel section. I travel a fair bit, both for work and for fun. Here's a bunch of random trip reports and daily trip-logs that I've put together and posted. I've sorted it all by world geography, in an attempt to make it easy to figure out where I've been. 4 [svg][Photography-Stuffs-300x200] My Photography Gear: The Cameras and Equipment I Use Daily The most common question I receive outside of the "what's the best GPS watch for me" variant, are photography-esq based. So in efforts to combat the amount of emails I need to sort through on a daily basis, I've complied this "My Photography Gear" post for your curious minds! It's a nice break from the day to day sports-tech talk, and I hope you get something out of it! 5 [svg][GearIUse2021_thumb-300x200] The Swim/Bike/Run Gear I Use List Many readers stumble into my website in search of information on the latest and greatest sports tech products. But at the end of the day, you might just be wondering "What does Ray use when not testing new products?". So here is the most up to date list of products I like and fit the bill for me and my training needs best! DC Rainmaker 2021 swim, bike, run, and general gear list. But wait, are you a female and feel like these things might not apply to you? If that's the case (but certainly not saying my choices aren't good for women), and you just want to see a different gear junkies "picks", check out The Girl's Gear Guide too. * * * * Quantcast * All rights reserved (c) 2022 DC Rainmaker Designed by: Heather Sanders -- Privacy Settings DCRainMakerDCRainMaker [ ] [ ] [*]Remember me [Login!] [1] Lost your password? Log into the DCR Analyzer free hit counter