Much like many other industries, trucking faces a unique threat: Cyberattack. Even more troubling, in some cases the threat may come from within. What threats lurk under the surface of the internet and are fleets in any danger?
Let’s take an example of as a cautionary tale. Imagine for a second you are the operations manager for a major fleet. Let’s also say it is around 3pm on a Wednesday. The morning rush has passed and all your truck drivers, customers, dispatchers and other interested parties all seem to be happy and doing their job.
Then, just as you’re getting ready for the deluge of late-afternoon messages from customers letting you know they won’t be able to load until tomorrow (typical, right?). Everything seems normal and ordinary, then you get a call from one of your truck drivers.
He tells you his engine has failed and that he is sitting in the center lane of a major highway. He goes on to report that there were no warning lights or indications the engine was about to fail. Since there was no warning, the truck driver had no time to get to the right side of the road, so now he sits, blocking traffic and creating quite a headache.
Just as you are evaluating this problem, you get another message, this time not from a customer. No, this message is far more ominous. It reads:
“Send us 30,000 in bitcoin and we will give you back your truck.”
This is just one example. There are certainly many more examples of enterprising criminals who will stop at nothing to take advantage of your operation.
It Could Happen
Sure, you might be sitting there chuckling to yourself thinking that could never happen. Well, think again. In fact, it has already happened in a lab. And you know, anything they can create in a lab can be recreated in the real world.
The fact is this: If fleets, regulators, manufacturers, trucking advocacy organizations, and other trucking industry players don’t take concrete steps to shore up vulnerabilities in trucking architecture, the nation’s supply chain will never be entirely safe.
So, what’s the problem? Basically, it all stems from something created by the Society of Automotive Engineers called the J1939 data bus. The J1939 data bus is a common communication architecture used to connect electronic control units (ECUs), thus allowing components from one manufacturer to seamlessly communicate with components built by a different manufacturer.
While the J1939 communication architecture has served its function beautifully by dramatically increasing communication efficiency in trucking equipment, unfortunately it also has a critical vulnerability.
Because J1938 was created to be as open as possible, allowing for trucking manufacturers to have a greater level of flexibility, it could be that this openness is a double-edged sword. At least, that’s according to a new task force put together by the American Trucking Associations’ Technology & Maintenance Council specifically to look at this issue.
The Problem is Bigger Than You Think
Unfortunately, through its work, the task force has uncovered more than just problems with J1939. There are a lot more vulnerabilities within the truck manufacturing chain, ones that can easily be exploited by a nefarious element.
The main issue is the large variety of suppliers that build major systems and components for heavy-duty commercial motor vehicles. There is a vast network of suppliers who both supply to each other and to other partners. Whether it bey the company that builds the body or the telematics provider, everyone has their own electronic backdoor into the truck. All these pathways pose a risk.
According to some theoretical models, even something as benign as a diagnostic tool could be leveraged to plant a Trojan Horse virus or do some other type of network damage or espionage. Even worse, since fleets are so interconnected nowadays, once a truck is infected, there is a real risk of the entire fleet or even the fleet network becoming infected. Companies that don’t have a comprehensive cybersecurity program in place may not even know someone is lurking on their network.
While researchers and trucking manufacturers have known about these vulnerabilities for years, many were slow to act. It wasn’t until the last five years that permeability testing began in earnest, with some tests showing horrifying results.
One such example occurred in 2016, when researchers from the University of Michigan Transportation Research Institute ran a controlled experiment on a closed track designed to see if they could hack into a Jeep Cherokee. Sitting in a sleeper cab down the street and using a laptop plugged into an onboard computer, the research team successfully initiated a controlled takeover of the Jeep and override the driver’s input.
Another example comes from the University of Tulsa in Oklahoma, where a professor utilized the wiring and electronics normally found in a Class 8 heavy-duty commercial motor vehicle to write a basic piece of malware that changed what the onboard software did without anyone knowing.
This is No Joke
Think about that for a second. Imagine an outside actor surreptitiously hacking into a semi-truck and altering its software or operating parameters without anyone realizing it – including the truck driver. They could do everything from crash the truck to falsify log data and more. Essentially, they would have full control.
If there is one lesson to be learned from all of this, it’s that the weaknesses in trucking manufacturing and supply chain control are very real. These glaring vulnerabilities pose a huge threat to trucking operations, and not just from state actors, but from rogue hackers and other opportunistic elements.
Still, ask many an expert and they will tell you: No one is quite sure how much of this threat will materialize, or in what form. As technology evolves at an ever-faster rate, the trucking industry will have to keep up to keep cyber-threats at bay.
Even as many say it is hard to tell how big of a threat this will be, there is no denying that it will be a threat. That attacks of this nature will happen is not a matter of if, but when. Fortunately, OEMs have been taking it very seriously.
The Automotive Cybersecurity Challenge
For evidence on how seriously OEMs are taking this threat, look no further than the annual Battelle Memorial Institute automotive cyber challenge in Detroit. This highly secure event brings together OEMs, their vehicles, and teams of students studying cybersecurity and hacking.
During the challenge, students throw everything they’ve got at the systems built into everything from cars to trucks and big rigs. In many cases, the students are successful in hacking into the vehicles. Fortunately, no one will ever know the details.
For good reason, the challenge does not publish any of the results, hold press conferences or put out press releases. Even more, anyone who participates must go through heavy security and bring only the tools they need and a notebook. At the end of the challenge, everyone must turn their notebook in to be destroyed.
The good news is that while many students are successful in their attempts, these hacks are done in a controlled environment where the hacking tools are hard-wired into the truck’s connections. Completing the same type of cyberattack wirelessly on a truck hauling a load down the highway is a completely different story.
Yet can today’s manufacturers or trucking interests say with 100 percent certainty that today’s connected truck is safe from deliberate cyberattack? No. The system still has plenty of back doors, even if they present a bit of technical challenge.
Why Hack a Truck?
As you read in our earlier example, there is at least one reason to hack a truck: Ransom money. Except that’s not the only reason a bad element would want to hack into a commercial motor vehicle.
Consider the size and weight of a fully-loaded Class 8 big-rig. We are talking up to 80,000 pounds of weight barreling down on what could be people or a packed building. Trucks are vital to our economy, but they also make useful ways to attack large numbers of people should someone want to.
Even worse, the storage capacity in a box truck or tractor towing a trailer can be incredibly dangerous in a bomb maker’s hands. Of course, trucks are not to be blamed for such incidents, but that does not make them any less serious.
Beyond mass casualty or terrorist events, there are other, less fatal, but just as illegal devious reasons for hacking a truck. What if a less-than-savory trucking company hires a hacker to alter emission systems or hours-of-service information?
Whether it be a hacktivist with an axe to grind against a fleet or some complicated crime network extorting tens of thousands of dollars from vulnerable trucking companies, the modern truck represents a point of vulnerability.
The key to staving off or mitigating a potential cyberattack on your valuable trucking assets, ensure you do not overlook the importance of cybersecurity. What network safeguards do you have in place? Is your IT department up to the task of managing your operation’s cybersecurity needs? These are all pertinent questions that will need to be answered if you want to prevent your trucks from getting hacked.