Cyberjacked! — Trucks vulnerable to cyber threats

[kscarbel2]

Today's Trucking  /  January 16, 2018

It’s Tuesday afternoon, a little after 2 pm. You’re the operations manager of a major truckload carrier. The morning rush is over, all the drivers and customers are happy, and now you’re gearing up for the onslaught of late-afternoon messages from customers wondering where their trucks are and drivers alerting you that they can’t load ’til tomorrow. Typical day. Then a driver calls on his mobile phone.

“My engine has just shut down and I’m sitting deader than a doornail in the center lane of Highway 401 between Dufferin and Keele Street,” he says. “No warnings, no red or yellow lights. It’s just quit. Traffic was too heavy for me to get over to the shoulder. I’m blocking traffic. What a mess.”

Then your phone chirps with a text message: “Send 20,000 in bitcoin and you can have your truck back.”

Most of you are now chuckling, saying, “that could never happen.” Well, it has happened, on a test rig, and it’s likely to happen someday in real life if manufacturers, regulators and fleets do not take appropriate actions to protect certain vulnerabilities in the basic electronic architecture of nearly every truck built in the past 20 years or so.

What began as a class project at the University of Michigan Transportation Research Institute (UMTRI) in the spring of 2016 made it to the pages of Wired magazine as a sort of follow up to the widely reported controlled hacking of Jeep Cherokee while it drove around public highways in St. Louis, Missouri. The exercise was also controlled, conducted on a closed test track, and the hacker was sitting in the sleeper with a laptop plugged into the OBD port of a 2006-vintage Class 8 tractor.

Last year, the University of Tulsa in Oklahoma began research on a truck-in-a-box. It was a typical Class 8, electronically speaking, but just the wiring and electronics. Researchers there were able to dig pretty deep into that system as well with very little difficulty.

Those two projects were just demonstrations, accomplished with hard-wired connections to the truck. But nobody today can guarantee that today’s connected truck is completely and absolutely safe from some kind of deliberate intervention.

“What concerns me, as a fleet equipment manager, is increased opportunity for cyber attacks because of the inter-connectivity of our vehicles and all of the components now,” said Gary Hunt, vice-president of equipment and maintenance at ABF Freight System. “When you talk about how these different components are going to talk to the truck, across the J-1939, through our telematics system, to us, those are all opportunities that somebody else can talk to those components and get into the truck. That’s a real concern for me.”

Hunt was speaking at the at the inaugural meeting of a new Taskforce on Cybersecurity at the American Trucking Associations’ Technology and Maintenance council’s annual meeting earlier this year. He was part of a panel that was trying to raise awareness among member fleets and suppliers of the cybersecurity challenges the industry faces.

Last fall, a similar meeting took place at the Society of Automotive Engineer’s Commercial Vehicle Engineering Congress in Rosemont, Illinois. A panel discussion there laid bare the threat faced by industry. It’s real. Very real.

A large part of the potential threat comes from the J-1939 data bus. It’s an open standard and provides a great deal of efficiency to the industry, but its open design makes it vulnerable.

“We worked, as an industry, to develop that open architecture, so that we could have this great flexibility, as fleets, as OEMs, to work collaboratively. Is J-1931 now going to be our Achilles heel?” asked Hunt.

The open-architecture CANBUS is just one of the challenges. To really look at the whole attack surface, we need to look all the way up and down the supply chain, noted Keith Doorenbos, a system engineer with Paccar who attended the taskforce session.

“So the OEs buy major systems and components from a lot of large suppliers, who, in turn, buy from other suppliers. And when we complete our part of a truck, we hand it off to bodybuilders, to telematics providers, and to the fleets. Even drivers are installing or connecting their own electronics to the truck. So every piece that gets connected provides another path into the system and another risk to the system,” he said.

Theoretical models have been developed that suggest even diagnostic tools could be used to move a virus-like attack from one truck to the next, but so far, Doorenbos says that’s entirely theoretical. “I don’t believe it’s even been demonstrated by any of our white hats [hackers working for good], but there’s a lot of exposures in different elements. Basically everything that’s ‘smart’ out there creates another opening.”

Directed threats

By now you might be prepared to concede that the potential for a cyber attack on a truck is real, but you’re having a hard time imagining why someone would bother. Well, a truck could become a pretty effective weapon in some sort of terrorist attack. There have already been examples of terrorists using trucks as a weapon in other areas of the world. Or it could be used by someone with an axe to grind, maybe even a kid who wants to prove something to his girlfriend. Doorenbos told those at the taskforce session that the threat could come from several quarters.

“You’ve got the tuners, the age-old nemesis of OEMs; the people to go in and find ways to modify trucks to get more power, better fuel efficiency, and bypass emission systems without the approval of the OEMs,” he says. “Then you’ve got your prankster category — people who are just out to demonstrate that maybe they’re smarter than somebody else. And you’ve got your hacktivists, people who are either socially or politically driven with specific agendas. Hacktivists have an enormous amount of dedication to put into making their particular political or social point at anybody’s expense.”

He says trucking hasn’t yet had a lot of exposure to what he called the classic cyber criminals who are after access to traditional servers for data-mining, identity theft, and financial theft.

“At the top end of the system, you’ve got your nation states or pseudo-nation states, the types of organizations that have very large resources and are willing to mount large-scale, very sophisticated attacks in order to support political goals,” he warns. “They can be very difficult, if not impossible, to completely block if they come after a system.”

More likely, Doorenbos believes, the biggest threat lays in the for-profit sector: cargo theft. “Right now that’s pretty much done using old-school methods,” he says. “What we’re trying to do is prevent giving them new techniques that might make that simpler, more efficient or more accessible.”

Ongoing efforts

There’s a huge amount of work in the background to better understand the scale of the problem, and a few solutions are emerging that will help slow the black hats down, even if we can’t shut them out completely.

A key pillar of cybersecurity efforts is encrypting data and software so it can’t easily be reverse-engineered or accessed by outsiders. Another strategy is partitioning truck electronic architectures so that, rather than having a single-vehicle network on J-1939, there are a number of sub-networks separating the most critical systems from the less critical systems. Engineers are also inserting firewalls or gateways between the different networks so they can control the data and commands that can move from one network to another.

“Even if somebody can compromise your telematics system that does not automatically give them immediately the ability to send commands directly to an engine or a brake,” says Doorenbos.

On a sobering note, the U.S. National Motor Freight Traffic Association recently completed a survey to gather registration data for all vehicles launched since Model Year 2000. The results suggest that four out of every five trucks built in the last 15 years are still registered. That’s a lot of systems to reverse-engineer, partition, encrypt and protect.

It’s a fairly new problem, but there are several U.S. universities now actively engaged in research on the subject, such as UMTRI and the University of Tulsa, among others. The U.S. Department of Transportation, the U.S. Department of Defense, the U.S. Department of Homeland Security, the FBI, and other U.S, government agencies are looking at it. And there are several industry groups very actively engaged in discussion and research on the subject, including SAE, Technology and Maintenance Council, National Motor Freight Traffic Association, and the Automotive Information Sharing And Analysis Center (Auto-ISAC).

Auto-ISAC is an industry-operated environment created to enhance cybersecurity awareness and collaborate across the global automotive industry. Participants include including light- medium- and heavy-duty vehicle OEMs and their suppliers.

Still largely absent from the table are carriers. Much of the message ABF’s Gary Hunt delivered at the Technology and Maintenance Counicl session was on the need for fleets to become involved.

“I, as a fleet, have a definite dog in this fight and so does every [fleet] in here,” he said. Look at what’s at stake: safety of employees, safety of customers, safety of the industry and the safety of the general public. What can happen to my trucks can also happen to yours.”