Las Vegas recently hosted the 30th edition of DEF CON, one of the world's most important cybersecurity conferences. Thousands of professionals and enthusiasts shared all kinds of news, but one item stood out for obvious reasons. An Australian identified as Sick Codes gained access to the navigation display of a John Deere tractor and did what we all expected: played Doom.
We've previously talked about John Deere tractors, and the difficulty their owners have repairing them without relying on the manufacturer. With increasingly deep integration of software and hardware, these vehicles have become rolling computers, and as expected, they're catching the attention of cybersecurity specialists.
That brings us to DEF CON 30, where an Australian known as Sick Codes presented a very special demo: the jailbreak of a John Deere 4240 navigation display. This system is based on an NXP i.MX 6 SoC and runs version 8 of Wind River Linux as its operating system. What did Sick Codes do in the demo? Let the Doomguy loose in a cornfield to blow up demons, of course.
Playing Doom on John Deere Hardware
Sick Codes explained on his Twitter account that this demo took several months of work, while the mod is the creation of New Zealand modder named Skelegant. An interesting detail is that Sick Codes speaks of a 'jailbreak' rather than a 'hack'. Why? Because of the device's condition: once he opened it to run his code, he found no resistance. There's no encryption, no checksums, and all the firmware code runs as root. In other words, the bug is that there is no security at all, and he considers patching it 'not practical'.
Sick Codes started his adventure with John Deere at DEF CON 29, because he noticed that no one was exploring agricultural equipment. The 'problem' was that after sharing the first vulnerabilities, John Deere published the necessary patches, and some people complained that Sick Codes' work reduced the chances of escaping the company's DRM. With a slight change in strategy, Sick Codes now focuses on hardware and its fragility in the food chain.
Another person who closely followed the Doom session on John Deere hardware is Kyle Wiens, founder of iFixit. His warning on Twitter is worrying: food production depends on outdated and unpatched versions of Linux and Windows CE (no joke) connected to LTE modems, and as if that weren't enough, John Deere might be violating GPL. To be continued…?
Source: The Register
