Posts Tagged ‘ELDSecurity’
[DefCon32] Compromising Electronic Logger & Creating Truck2Truck Worm
Jake Jepson and Rik Chatterjee, systems engineering master’s students at Colorado State University, present a compelling investigation into the cybersecurity risks of Electronic Logging Devices (ELDs) in the trucking industry. Their session at DEF CON 32 exposes critical vulnerabilities in these mandated devices, demonstrating the potential for remote exploits and a wormable attack that could propagate across truck networks. Jake and Rik’s research underscores the urgent need for standardized security protocols in an industry pivotal to global supply chains.
Uncovering ELD Vulnerabilities
Jake opens by highlighting the role of ELDs in ensuring compliance with Hours of Service regulations, yet notes their susceptibility to cyber-physical attacks due to inadequate security measures. Working at Colorado State University, Jake and Rik reverse-engineered commercially available ELDs, identifying insecure defaults and poor security practices. Their findings reveal how attackers could exploit these weaknesses to gain unauthorized control over truck systems, posing significant risks to safety and logistics.
Developing a Truck2Truck Worm
Rik details their proof-of-concept attack, which leverages wireless communication vulnerabilities in ELDs. Using tools like Ghidra for firmware reverse-engineering and network scanners, they developed a worm capable of spreading via over-the-air updates, exploiting default credentials. Rik explains how trucks’ proximity at rest stops or distribution hubs, combined with always-on diagnostic ports, creates ideal conditions for a worm to propagate, potentially affecting entire fleets within a 120-foot range in dense environments.
Coordinated Disclosure and Industry Impact
Jake shares their responsible disclosure process, including his first CVE, which prompted a swift response from manufacturer IO6, who issued a patch. However, Jake emphasizes that the root issue lies in government-mandated, self-certified devices lacking rigorous security standards. Their work highlights systemic flaws in ELD certification, urging regulators to prioritize cybersecurity to prevent large-scale disruptions in the trucking industry.