Sick Codes jailbroke John Deere, found outdated Linux/WinCE with LTE modems

ni.hil.ist

90 points·pabs3··11 comments

Relevant from yesterday:

A New Jailbreak for John Deere Tractors Rides the Right-to-Repair Wave: https://news.ycombinator.com/item?id=32457590

Sick Codes has jailbroken a John Deere: https://news.ycombinator.com/item?id=32461238

What's the issue with running outdated software in a closed ecosystem? It's not like you can remote connect to those tractors over the internet...

It’s not an issue, it’s an opportunity for the owners of the tractors.

>It’s not an issue

Not specifically related to the jailbreak, but John Deere bricked tractors Russia stole from Ukraine. If their code is as shoddy as this jailbreak suggest, whose to say they can't be hacked to kill switch ag equipment during harvest season.

LTE suggests that you can actually connect.

Likely over a private APN… still not 100% secure but helps.

Is it really surprising at this point? Most closed systems won't really bother fixing things that ain't broken, especially if its not connected to the internet. If the machinery can be hacked and commandeered remotely, we know the company will take it "very seriously" [0]

[0] https://twitter.com/david_colombo_/status/148063230404533043...

Terrifying... if you can brick a nation's tractors at the right moment you could put a large dent in their agricultural productivity.

read the thing, jeez.

requires physical access AND disassembly.

Though jailbreaking the first one might mean you later find a backdoor or exploit that works on all, maybe even remotely. Getting local access usually unearths other hidden issues.

Being that it's an old, apparently unpatched "Wind River Linux 8", I'm guessing some open vulnerabilities exist.

It already happened : https://www.theregister.com/2022/05/02/ukrainian_tractors_de...

Reply on news.ycombinator.com