Farm equipment security at DEF CON 29 • Hacker News Board

Re: Farm equipment security at DEF CON 29

#31

Post by voakbasda » Tue, Oct 12, 2021, 2:57 PM UTC

fho wrote: post #20

sandworm101 wrote: post #15

Earlier quoted context omitted.

They are not innately bad, but they are implemented in a bad way. A system of hydraulic control lines cannot be locked behind copyright. They can be physically fixed. A cracked manifold can be welded or replaced. But when fixing a modern electronic system you must have the permission of the manufacturer before replacing a part, or even opening some boxes. Any mechanic can see leaking hydraulic fluid. But modern elect…

Next up: John Deere invents a hydraulic rights managment (HRM) system that implements a communication protocol between hydraulic components using high frequency pressure changes in the hydraulic lines. These signals are interpreted by mechanical/hydraulic processing units to p̵r̵e̵v̵e̵n̵t̵ ̵t̵a̵m̵p̵e̵r̵i̵n̵g̵ ̵w̵i̵t̵h̵ ensure the quality of the product.

Don’t give them ideas. They have proven themselves willing to screw their customers. Don’t give them another way to extort us.

Re: Farm equipment security at DEF CON 29

#32

Post by travellingprog » Tue, Oct 12, 2021, 4:17 PM UTC

This link doesn't work for me in Canada, because of some faulty re-routing that Kaspersky's backend is doing (keep getting redirected to https://www.kaspersky.ca/fr). This one does: https://usa.kaspersky.com/blog/hacking-agriculture-defcon29/...

Re: Farm equipment security at DEF CON 29

#33

Post by JamisonM » Wed, Oct 13, 2021, 1:45 AM UTC

jet_32951 wrote: post #27

JamisonM wrote: post #14

Earlier quoted context omitted.

Isn't using J1939 just an example of them embracing an industry standard? That stuff is everywhere now, right?

It is how you embrace J1939 that makes the difference. In a J1939 dataframe two data words are defined: one open, the other proprietary. The proprietary word can be, and is with JD's implementation, encrypted. Therefore, anything actuated by the proprietary word is operable iff you have the key.

Thanks!

Re: Farm equipment security at DEF CON 29

#34

Post by 0des » Thu, Oct 14, 2021, 2:42 AM UTC

bierjunge wrote: post #23

chicob wrote: post #22

Farmer here. I've been saying for years to my fellow farmers that equipment security shouldn't be dismissed. I did not focus much on tractors, though, but automatized irrigation systems that allow remote access and configuration. When choosing my own options, and since I never had the information I needed, I always chose the simplest solution, i.e., local manual configuration without remote access. Around here the pu…

> "Why would anyone want to interfere with my equipment?" Because it's interesting and "because we can". It's a challenge without any other motivation besides curiosity. But lets say some ransomware outfit discovers farmers as their niche, because the security barrier is relatively low and it's a time sensitive business. Your crops are ready to harvest, but your equipment is not starting until you pay the ransom? Wha…

Knowing how most farmers live on a razor's edge between subsistence and famine, this is fucking terrifying.