Sick Codes jailbroke John Deere, found outdated Linux/WinCE with LTE modems(ni.hil.ist)

90 pointsby pabs3vor 4 Jahren11 comments

ni.hil.ist

Sick Codes jailbroke John Deere, found outdated Linux/WinCE with LTE modems

https://ni.hil.ist/@mu/108824144772569843

13 comments

Semaphorvor 4 Jahren

Relevant from yesterday:

A New Jailbreak for John Deere Tractors Rides the Right-to-Repair Wave: https://news.ycombinator.com/item?id=32457590

Sick Codes has jailbroken a John Deere: https://news.ycombinator.com/item?id=32461238

Double_a_92vor 4 Jahren

What's the issue with running outdated software in a closed ecosystem? It's not like you can remote connect to those tractors over the internet...

moominvor 4 Jahren

It’s not an issue, it’s an opportunity for the owners of the tractors.

dirtyidvor 4 Jahren

>It’s not an issue

Not specifically related to the jailbreak, but John Deere bricked tractors Russia stole from Ukraine. If their code is as shoddy as this jailbreak suggest, whose to say they can't be hacked to kill switch ag equipment during harvest season.

vbezhenarvor 4 Jahren

LTE suggests that you can actually connect.

edf13vor 4 Jahren

Likely over a private APN… still not 100% secure but helps.

Karupanvor 4 Jahren

Is it really surprising at this point? Most closed systems won't really bother fixing things that ain't broken, especially if its not connected to the internet. If the machinery can be hacked and commandeered remotely, we know the company will take it "very seriously" [0]

[0] https://twitter.com/david_colombo_/status/148063230404533043...

arisevor 4 Jahren

Terrifying... if you can brick a nation's tractors at the right moment you could put a large dent in their agricultural productivity.

naikrovekvor 4 Jahren

read the thing, jeez.

requires physical access AND disassembly.

tyingqvor 4 Jahren

Though jailbreaking the first one might mean you later find a backdoor or exploit that works on all, maybe even remotely. Getting local access usually unearths other hidden issues.

Being that it's an old, apparently unpatched "Wind River Linux 8", I'm guessing some open vulnerabilities exist.

arnaudsmvor 4 Jahren

It already happened : https://www.theregister.com/2022/05/02/ukrainian_tractors_de...

[deleted]vor 4 Jahren