As a follow up to my CAN bus research on this bike, I decided to do a detailed exploration of the TCU/telematics and cloud app (Livewire S2 app).

The goal of this research was to see if I could tamper with the data being reported to the Livewire S2 app - and the conclusion is YES, despite some data integrity checks.

I developed an attack that abuses the bus's own integrity check system (AUTOSAR E2E) to steal the microphone reliably without spamming the bus, which allowed me to manipulate the reported state of charge and reported odometer on the Livewire S2 app.

I tested some more potentially dangerous/evil attacks on the modules as well - and all of the super dangerous theoretical attacks were disproven, which is good.

Overall, the security posture of the S2's telematics and secondary CAN bus is acceptable, but there are some improvements that could be made.

If you are curious about what I learned and my experiments, as well as a description of the AUTOSAR E2E integrity race condition - here is a link to my research:

Tampering with a LiveWire S2's telematics unit — a focused study

This was published without prior disclosure to LiveWire as they do not have a bug bounty program and I do not consider any finding here to be severe enough to bother coordinated disclosure*.*

However, if you work for LiveWire, and would prefer me to reach out to Livewire before similar posts in the future, send me a message.

I noticed that the S2 Del Mar appears to have a heartbeat at idle. When I researched it, some people said they felt it also, some said they don't. LiveWire does not officially advertise whether this bike has it, but the LiveWire One has it and its configurable on that bike.

The heartbeat is so subtle that I couldn't really tell if it was my heartbeat or the bike itself.

However, if you have read my other post about CAN bus reverse engineering - this is a small follow up using the same data.

Using the CAN bus data, I charted the CAN frame 0x161 which contains "torque_delivered" field and discovered a perfect 75bpm idle heartbeat.

• Same 75 bpm falls out three independent ways: counting the pulses, autocorrelation (0.80 s), and the frequency spectrum (178× the noise floor).
• It shows up in the torque command, not just the actual output — a pump, a sensor glitch, or control hunting couldn’t do that. The controller is asking for it.
• Present only when the bike is ready and stopped; gone while charging, gone the instant you move.
• It matches Livewire’s documented “Haptic Heartbeat” on the One point-for-point: a torque pulse felt at a ready stop that quits when you ride off.
• ~75 bpm is a resting heart rate — and this measured number is something Livewire never published.

Notes: unlike the One, the S2 gives the rider no setting for it (no soft/hard/off) — it just runs. And this is a torque pulse drawn as a chart, not a cardiac ECG — same rhythm, different signal.

Interestingly, the chart looks EXACTLY like a real heartbeat ECG, much to my surprise, because I wouldn't have expected Livewire's engineers to expect anybody to ever chart this data.

You can view my chart here: S2 Del Mar — idle heartbeat (raw telemetry)

Such a neat attention to detail from LiveWire haha.

I've been passively tapping the CAN bus on my 2024 LiveWire S2 Del Mar - an ESP32 logger listening to the broadcast traffic plus read-only diagnostic reads, never writing anything to the bike. Decoded across dozens of real rides, here's the stuff that isn't in any spec sheet:

• Full power & torque curves — and you can actually see the field-weakening transition: flat torque to ~48 mph, then constant power (~66–69 kW) to redline.
• All 7 ride modes, down to the live tuning values the inverter reports — Power / Regen / Throttle. The throttle maps are perfectly linear; the modes just change the slope (Sport pulls ~2× the torque-per-twist of the softest custom).
• Battery internals that were never public: 96 cells in series, NMC, ~355 V nominal / 4.20 V full, air-cooled, all 96 cell voltages + 48 temperature channels live, ~97% SoH — and the pack's build date read straight off the BMS (July 2023).
• Neat trick: every module stamps its own manufacture date, so the bus quietly narrates the bike's repair history. I spotted my own dealer-replaced left control pod because its build date was newer than the whole bike.
• The AC charging CC→CV taper + charger heatsink temp (honest caveat: I only caught the top ~80–100%, so no peak-rate claims).

Every figure is tagged by how I know it - measured / counted / inferred - so you can tell hard data from reasoning. Not affiliated with LiveWire or Harley-Davidson; just my own bike.

Here is a link to my write up with visual charts: LiveWire S2 Del Mar · Performance, read off the bus

Happy to pull specific things for other S2 / LiveWire owners, drop requests below.

As a bonus, I replicated effectively every read diagnostic feature of the Harley Davidson Digital Technician-II, including full DTC decoding & ability to clear codes.

Just a warning to the community, last night, Windows Update staged a broken Gigabyte UEFI capsule update to my Gigabyte TRX50 AERO D, bricking my system. Kept failing and retrying in a loop, presenting as device immediately restarting on POST.

During diagnosis, I wiped the CMOS, wiping my TPM keys - effectively wiping out my BitLocker encrypted drives (Luckily, I had a recovery key).

That did not fix the issue, to fix it, I had to pull the drive, Q-FLASH the BIOS, then with the device in another machine, clear the update capsule off the EFI System partition.

In any case, I recovered successfully, but that was a waste of 4 hours of my day. Thanks Gigabyte.

🚀 STARBROKEN — a persistent space MMO, built inside Minecraft

Server: play.starbroken.net · Vanilla Java Edition (newer clients welcome) · Currently in active pre-alpha

>The rim is fractured. Old powers hold the inner systems while the outer sectors run on the work of independent pilots — haulers, miners, salvagers, mercenaries, and the occasional pirate.

STARBROKEN turns Minecraft into a living galaxy where every ship is a place you can walk around, fly, and fight from. Step off the helm and you're standing inside your own vessel. Dock at a station and walk its corridors. Then undock and burn for the next belt.

✨ What you can do out there

• ⛏️ Mine asteroid belts for ore — the good stuff is deeper in hostile space.
• 🛠️ Craft & fit out your ship — modules for weapons, mining, cargo, stealth, and warp.
• 💰 Trade & run cargo between markets; build a name, or a fortune.
• ⚔️ Fight with cannons, missiles, and shields — including multi-crew ships where friends man the guns.
• 🪐 Explore — landable planets, wormholes, and warp travel between systems.
• 🏴 Factions & territory — sign on with a power or carve out your own claim, and build & defend player-owned stations.
• 📈 Progress from a starter frigate all the way up to capital ships.

Risk scales with reward: the deeper you push toward the Wild Drift, the richer — and deadlier — it gets.

🧭 Pre-Alpha

This is pre-alpha. Expect rough edges, frequent updates, and a roadmap that's still being shaped. I'm looking for early pilots who want to actually influence where it goes — bug reports and ideas in Discord genuinely move the needle.

🔗 How to join

• Server: play.starbroken.net (Java; newer client versions work via ViaVersion)
• Discord: https://discord.gg/RUt6rmbU — community, updates, and bug reports happen here
• Wiki: https://wiki.starbroken.net
• Site: https://starbroken.net

See you out there. Make a name — or enemies. Or a fortune.