A hacker known by the pseudonym Sick Codes demonstrated a jailbreak for John Deere & Co tractors at the DEF CON conference, wanting to prove to farmers that root access to agricultural equipment is possible.
A few years ago, it turned out that ordinary American farmers were forced to buy custom and semi-legal firmware for their tractors on closed hacker forms, as Deere & Company, as well as other manufacturers, began to increasingly prohibit “unauthorized” repairs to their equipment.Sick Codes has long been interested in the safety of agricultural equipment. For example, last year he reported on the discovery of many vulnerabilities in the systems of John Deere and Case New Holland (two of the largest agricultural equipment manufacturers). At the time, Sick Codes and his colleagues warned that in the hands of attackers, these vulnerabilities could endanger both consumers and the global food supply chain.
You may also be interested in: Researchers spoke about the vulnerabilities of agricultural machinery John Deere and Case New Holland.
Now the researcher presented a new report at DEF CON, where he spoke about new bugs that, despite the potential danger, can be useful to farmers. Sick Codes told the Wired that when his findings went public last year, manufacturing companies (including John Deere) began to fix the problems. However, while communicating with the farmers themselves, he began to receive feedback like “You fucked us all!” and decided that he would invest his money, but in fact prove to farmers that his hacks are useful, and thanks to this, tractor owners will be able to get root access to their equipment.
To create a jailbreak, Sick Codes studied numerous generations of John Deere tractor control consoles with a touch screen. He ended up focusing on several models, including the widely used 2630 and 4240.
The researcher says that over the course of many months, he experimented with various touchscreen circuit boards to find a workaround for John Deere dealer authentication, and was eventually able to trick the reset check into believing the device was being operated by a certified dealer. On Twitter, he writes that, during his research, he found a lot of interesting things, including unpatched Linux and Windows CE hardware that works in conjunction with LTE modems.
So Sick Codes found out that the system, which considers him a dealer, offers him logs of more than 1.5 GB, designed to help authorized diagnosticians. These logs helped pave the way for a timing attack that provides even deeper access to systems. Although Sick Codes ended up having to solder the controllers to the circuit board, he still managed to get his attack completely bypassed the defense.
The hack involved breaking into the internals of the controller and modifying the electronics, but it turned out that after installing custom software, the hardware simply accepts and runs it as if nothing had happened. According to the researcher, “the main mistake is that nothing is encrypted, the checksum is not checked, there is nothing like that.”
Although this method requires physical access to the circuit board and in its current form the attack seems impractical, Sick Codes assures that it is possible to create a simple tool that exploits the vulnerabilities it has found and makes it easier to perform such a jailbreak.
The researcher admits that he is now curious to see how John Deere will react. He is not sure that the company will be able to completely eliminate all the flaws he found without implementing full disk encryption. This would mean a significant overhaul of the system in new tractor models and would probably not be implemented on existing equipment.
At DEF CON, the explorer didn’t deny himself the pleasure of running Doom on a hacked tractor display.
It is worth noting that in recent years, American users are increasingly able to defend their “right to repair”, and under pressure from the community and legislators, in March of this year, John Deere announced that it would provide more repair software to equipment owners. The company also said it will release an “advanced customer solution” next year to allow mechanics to download and install official software updates for Deere equipment themselves. In the past, John Deere unilaterally applied patches remotely or forced farmers to bring produce to authorized dealers.
