Hacked - Tractor Hackin'

Episode Date: May 16, 2022

The story of a truck full of stolen tractors in the Ukraine. If you like the show and want to make sure we can keep making it, please subscribe, and if you can visit https://www.patreon.com/hackedpodcast and show us some love. Thanks to our sponsor Command Line Heroes. Check out the show right over here -> https://link.chtbl.com/commandlineheroes_cyoa?sid=s9.podcast.hacked Learn more about your ad choices. Visit podcastchoices.com/adchoices

A flatbed truck full of soldiers with a big white Zed painted on the roof pulls into an agricultural supply store in the occupied Ukrainian city of Maledipal. They've come to steal some very, very expensive tractors, these big green and yellow John Deer tractors and harvesters and combines. And over the weeks that follow, this truck of Russian troops would go on to steal about $5 million worth of farming equipment from that depot. And this $5 million worth of stolen farm equipment starts on this journey in the back of these trucks, out of Maledipol, on a 700-mile overland route all the way to the village of Zakhanjir in Chechnya, their last known location. Russian troops have been kind of pilfering everything they can out of this city.

But that farm equipment is, we got to talk about that. There's 27 pieces of agricultural tech. Because as the trucks pulled up in Chechnya and all the gear gets unloaded and they went to turn it on, the tractors they'd stolen wouldn't start. They'd been kill switched, remotely disabled by the manufacturer. And here's where it gets kind of weird because this technology has for years been at the heart of this really intense battle between John Deere and a collection of hackers who have built this cottage industry around jailbreaking ag tech. so that a farmer who has spent six figures, sometimes up to a million bucks on a piece of equipment, can fix their tractor or replace parts in their tractor or do whatever they want with their tractor because it is their tractor.

And now, rumors suppose, these Russian troops who have been stealing this bricked Ukrainian agricultural tech, it started trying to figure out how to work with these hackers, trying to find consultants, or at least the software that they use, to unlock this stolen gear. The Russians need help from the tractor hackers. And you want to guess which country has, for years, made a name for itself in the tractor hacking game? Can I guess? Please. I'm assuming it's the Ukraine.

This is Ukrainian tractor hacking. You're unhacked. It is the brink. red basket, you know, if there's people that are going to care about tractors, it's going to be the Ukrainians. 100%. And those Ukrainian farmers end up, as they have in most stories of like kind of being the ultimate victims of this story. The victims because there's stuff that would eventually made its way to them got stolen. And their victims kind of in a larger, longer term sense, too.

So this story kind of went viral-ish last week. And it's a really, it's a really, it's a a weird one. On one hand, it starts out feeling like sort of a good news story, at least sort of Chadenfreudey, right? Like those, they stole tractors and they didn't work, which is true. But it's also a story, and Cory Docterow, who's writing is fantastic, nailed it in a piece that he wrote about this. They got me reading more about Ukrainian tractor hacken. It's the story with this kind of satisfying ending, but that you got to be. a little cautious celebrating. It's good that these tractors

aren't working for the people that stole them. But why they don't work isn't a great thing? This is oddly thematic to the episode about the cell phones being stolen. Yeah. Because we're remotely bricking our cell phones

and here they're remotely bricking tractors. I guess the big difference comes down to who's actually doing the bricking. Like when we brick our cell phones, it's us protecting our information. And when a manufacturer is bricking tractors, you know, it kind of oblivious to who owns them and what they're doing and who has them. Yeah, and it's about that like constant push and pull about who tech really belongs to. Because if you have the ability to brick a piece of your own tech, so does the manufacturer.

And therefore, so does anyone that can compromise the security of either of those parties. So it gets really muddy, really, really quickly. Well, this is a big fight that still goes on with, you know, the app stores. You know, Apple, for the security of their own device, is trying to defend the apps and what you can do on their phones because they're the ones who are going to be held likely liable and responsible for the security and preservation of them, et cetera, et cetera, functionality, warranties.

And they don't want people doing anything on them that they don't sanction. But then they also get 30%. of all sales for all things that go on them. And there's this ongoing fight over who, whether you own it or whether you kind of license it. You might pay a full price for it, but are you really just pre-paying a license fee? Especially back when they were degrading them

so that they were like kind of auto battery degrading into the dust in three years. Like you're essentially just paying a licensing fee. Like we may as well just turn them into licenses. So like that, it is the story. of this tech. And it's the story of the hackers kind of going up against these companies. But what's really unique about it is that the company in question manufactures and controls a lot of the equipment used to produce a really big chunk of the world's food. So in one sense,

it's it's so similar to our phones and McDonald's ice cream machines, which we talked about at the end of last year, except this time it's the world's agricultural supply chain. Yeah, no kidding. Let's go back a couple years. You remember key gens, Scott? I do. Like RSA keys? Like encryption keys?

Like that stuff? No, like key gens. Like for, I'm going to show my hand here a little bit. Like a key gen for pirating software. Oh, yeah, yeah, yeah, yeah, yeah. Wow. Going way back. Yeah, I did anything like that.

I mean, I did. As a minor, as a minor, before I could afford record. Before I could afford, no, but my record is sealed. I was a minor. Before I could afford the, you know, photo manipulation software to make my little graphics to post, I don't know, MySpace. I don't know what I was on back then. Anyway, Key Gens. So in October 2017, John Deere issues a new license agreement, an agreement that applies to anybody who wants to use any computerized John Deere equipment, which is all of it at that point. First thing is not the biggest part of it is it stops farmers from being able to sue John Deere for crop loss, lost,

profits, loss of goodwill, loss of use to equipment arising from the performance or nonperformance of their software, which was new at the time, but isn't the big part of this. The second part is it's a contract in which the owner of the tractor agrees not to repair or replace broken parts without paying a John Deere technician to come validate those repairs. Wow, that sounds very ice cream machiny. So say you want to repair the transmission on your tractor. You take it to a local mechanic shop where they've been replacing tractor transmissions

for as long as there have been tractors or transmissions. But as per the terms of this new contract, that tractor will not start. Your tractor will not start until a John Deere technician at a base rate of $230 an hour with an additional $130 an hour hourly surcharge, like the ice cream machines, drives out down whatever dusty road

to wherever you and your tractor and repair shop happen to be, and they plug in a USB, and the USB authorizes the part, and they drive off. Here, in the U.S., a farm in the Ukraine, any John Deere agricultural tech will not work unless John Deere gives it that software thumbs up. If the John Deer guy can't come tomorrow, or next week or next month, it does not matter that you can fix your tractor.

Your tractor will not start until that USB plug shows up. But that USB plug just contains software, which brings us back to Keygens. If you were to make your way to some very niche forums, you would find this ecosystem of people selling that software. Specifically, folks in Eastern Europe, and specifically, in the Ukraine. And what they've done is, you know, they've purchased these American contractors for their own use. Of course.

And in order to get them to work, they've cracked the software and then started selling that software back to mechanics and technicians in America and around the world so they can fix their own property by themselves. And the need was so great that over time, it started to grow and go beyond just the repair part licensing little niche. because if you lock down your product enough that people need to hack it, they're not going to stop there. There are hacks to modify

the speed limits of tractors. There's all the parts and cables that technicians have. By locking it down, they created this very thriving ecosystem of agricultural tech hacking. I feel like this is just all foreboding

where we're going as a society. We've already done this in software. We realize that keeping and maintaining things. You used to pay $200 for a copy of Microsoft. off to office and you bought it and you owned it. But then a new one came out and you bought it again. And you bought it, you owned it. It was your 18 floppy disks.

Yep. Yep. And I was like, and, you know, then we went to software as a service model and pretty much the entire software spectrum, except for like video games, which are actively going through this transition right now through Xbox Live and, and our, sorry, what's the Xbox Platform, Game Pass? Game Pass, the X-Cloud, yeah. Yeah, yeah. We're seeing this happen pretty much across the entire software space.

There's nothing you get in the software world anymore that you're not paying a subscription fee, a license fee, rather than a fixed capital expense. And I think that once the world figures out how to do it and the companies adapt to it, I think we're going to see that and everything. I know that there was rumors years ago about Mercedes was looking at a way to do essentially that for vehicles. You know, and they were rolling out

Cardigo and, like, things like that. Like, there's, we're slowly as a society migrating to a membership licensing model for most capital purchases. You know, we do it with houses, I guess. You know, rent, you like rent a house instead of buy one. You know, it's like, we're gonna, we're gonna end there for like most big things, I think.

And that's just probably, if we trace it all back, back to income inequality. But that's a different kind of. conversation. So that licensing agreement, the reason John Deere needs to prohibit all this stuff inside of their licensing agreement is because otherwise, unlike most situations that involve cracking software and key gens and this kind of hacking, what these folks are doing is very, very legal.

In 2015, the Library of Congress signed off an exemption to the Digital Millennium Copyright Act that applied exclusively. lead to land vehicles, which includes tractors. And it's this really important exemption that allows you to, quote, modify computer programs that are contained in and control the functioning of a motorized land vehicle. When circumvention is a necessary step undertaken by the authorized owner of the vehicle to allow you to diagnose, repair, or lawfully modify a vehicle's function. So basically, as long as you aren't circumventing the emissions requirements of a vehicle,

legally you're allowed to modify the software of a land vehicle. In the USA. In the U.S. Yeah. Unless you sign that contract with John Deere. Where you waived said rights. In which case you have to use John Deere's equipment, which only they have the right to use,

in which case they can then sue you. But are you allowed to buy one of these vehicles without signing said contract? Or is it kind of like a gun to your head situation where it's like if you'd like to buy farming equipment from us. You also have to agree to these terms. You have to sign the contract if you want to buy a tractor in the same way that you have to agree to the terms of use if you want to use an iPhone. What about a used tractor? I wonder how that applies. Or maybe there's resale conditions in that contract because that would be somewhat common. I would imagine it's like I mean you and I use audio equipment and a lot of it has to be registered to an account. And if you want to

sell it, you have to transfer ownership of the software license at the same time as you transfer physical ownership of the object. So I would guess that it works that way, but I haven't actually read about that. That's a great question. Have you heard of Vinlocking? I haven't heard of it in the sense that you're about to talk about it, but I know, I think, didn't luxury vehicles start doing this like 20 years ago. Exactly. Where they had the ability to lock out vehicles like Mercedes. Like even the keys were essentially RFID bypasses for the VIN locks and stuff.

So they were disabled before they were enabled. So if I recall correctly. You pretty much got it. So VIN stands for vehicle identification number. And it comes from the auto industry, specifically like car parts. And it came about the same. way in cars as it would end up in tractors and agricultural tech. You want to get some little part of your engine replaced. A manufacturer certified technician would have to come out and plug in that same

thumbs up USB stick that says the repair that already occurred is A. Okay. Otherwise, the vehicle just will not start, even if the vehicle would otherwise start. Binlocking kind of came into vogue with the rise of, you know, a lot of vehicles producing a ton of data, data that is increasingly. incredibly valuable and sort of just came from a desire to maintain a wall to garden around the software that integrates with the hardware. Cars, tractors, medical equipment, which we'll discuss, all these machines are now jam-packed full of microcontrollers, torque sensors in the case of tractors, sensors for soil humidity, GPS. These machines are all churning out a ton of data. and interesting part is every time some major piece of right to repair legislation starts making its way around,

they use the existence of this data to argue that their repair monopolies need to be preserved. If question one passes in Massachusetts, anyone could access the most personal data stored in your vehicle. That was audio from an auto industry ad that came out around the time as one of these pieces of legislation was circulating, that made the argument that no one would benefit more from right to repair laws than the stalkers who could now theoretically access this technician-level software and use it to empower their stalking, which I guess is easier than, like, putting an air tag in a... I don't know, it was a very odd argument.

The Federal Trade Commission warns your address could be paired with your garage codes to give easy access to your home. Five investigators found that claim is very out of context. The FTC has warned car owners about the personal information in their car, but they were urging owners to delete personal information before selling their vehicle. Vote no on one. Keep your data safe. We're calling that statement spin.

I think that's one of those cases of like we need to make this bad. Yeah. And it doesn't matter how far-fetched it is, we just need it to be really bad. It's got to be really scary. Yeah. Oh, you're in favor of right to repair. You must be in favor of stalkers. Hey, man.

That's just the way the world's going these days. Part of the reason you want to lock this ecosystem down if you're a manufacturer is that that data that we're talking about that's produced by all these devices is incredibly valuable. We'll talk about John Deere a little bit. John Deere has found ways to extract heaps of value from this very locked down. data being produced by their tractors. First off, they sell it, specifically in the case of John Deere to Monsanto, who they

partnered with on this whole thing. They could do that even if they didn't vinlock their machines. They could do that even if they didn't build in kill switches. But they do it. Thing is, that data is also really valuable to farmers. It's kind of the basic ingredient for smarter future-looking farms that can produce more crops and make more money for the farmers that run them. If you have data about when you should plant something

or how your soil is doing, that's very valuable to them. And it's being produced by their tractor. And if you want access to it, it is not yours. So that farmer basically has two moves. You would have to use the hacked Ukrainian software to get access to your own data, or you have to buy your own data back from John Deere. It's part of a bundled combo pack that includes,

I shit you not, Monsanto seeds. So if you want to know how moisture soil is, you've got to buy some seeds from us. Yeah, yeah, yeah. We'll send you the right seeds, though, because we have all the data. John Deere has litigated furiously for the right to do this. And this is not an ad-supported tractor where, like, we sell your data, but the tractor's cheaper. This is a full-price, top-of-the-line tractor or combine or harvester. This is just like a fun little bit.

bonus for John Deere. And at this point, it's kind of just a game of like how far they can go before someone tries to regulate them back. So we've got super lockdown tractors. We've got the hackers trying to crack them back open, releasing all this software, and then a small fortune of repair fees and selling folks their own data back to them hanging in the balance. But then there's the kill switch. The John Deere used to brick those stolen machines, which we're going to talk about next right after the break. Think about the last time you heard a breach story on this show. It always starts the same way.

Someone, somewhere, saw something too late, an alert buried, a signal missed, an SOC that just couldn't keep up. Arctic Wolf set out to solve that problem by rebuilding security operations from the ground up for a world where attackers are already using AI. They created the Aurora Super Intelligence Platform, a fully agentic system powered by the swarm of experts. Instead of single-purpose bots or lucky-guess LLMs, this swarm is full of deterministic agents that handle whole entire workflows. Humans stay in the loop and on the loop to validate the critical decisions and keep everything trustworthy.

And all of this is just off running on their secure operations graph. A constantly updating intelligence engine fueled by more than 9 trillion telemetry events every week and over a decade of real-world incident response. The system reasons on real signals and real context not synthetic training data. And the result is the new Aurora Agent SOC. It's the first SOC that is agent led by design. You get agents that coordinate, agents that investigate, agents that respond at machine speed, and hundreds more that automate the repetitive work that normally buries human analysts. Arctic Wolf didn't try and bolt AI onto an old model.

They rebuilt the model entirely. What makes it even more effective is how it works with Arctic Wolf's concierge experience. The team brings customer-specific context directly into the platform so every AI driven decision reflects your environment instead of generic assumptions. The automation frees your concierge security team to focus on higher value strategy and proactive risk reductions while the agents handle the grind. If you want to see what trustworthy, production-ready AI and security operations actually looks like, go to arcticwolf.com slash hacked. Never feel like cyber threats are evolving faster than anyone can keep up? Last year, 2025 was nothing short of a record-breaking year for

major breaches, from sophisticated ransomware operators to AI-enabled attacks that turn defenses on their head. Organizations around the world saw headlines they never expected and cybersecurity teams were tested like never before. But here's the thing. These incidents aren't just news headlines. They're learning opportunities. And that's why Arctic Wolf is hosting a live webinar on February 5th diving the most impactful breaches of 2025. Their field CTO and security leaders are going to unpack not just what happened, but why these attacks succeeded. And most importantly, what businesses can do to fortify their defenses for it's too late. You're going to walk away with real insights into how threat actors are evolving,

how defenders are responding, and what strategies can help you stay ahead of the next big breach. It's not fear-mongering. It's practical, actionable, intelligence from experts in the trenches. Register now at arcticwolf.com slash hacked. The big argument that John Deere uses to justify the amount of control they have over these machines they're selling is security. If we let other people repair these computers, it opens them up to hacking.

Sounds familiar. And aren't the world's food supplies worth keeping secure? Just like my cell phone. Which is ignoring the fact that locking these computers down to the degree they have is the reason we have such an atypically thriving ecosystem for tractor hackers. But what it does do is it kind of reveals the very real risk all of this presents. If John Deere can kill switch a tractor in Chechnya, they can kill switch a tractor in Arkansas, which means they hold in their hand not just the IP and profits and data rights

of all these machines. They hold a kill switch that can turn off this very, very important equipment. Which means that as we learn time and time again when we talk about this stuff, that anyone that can compromise John Deere's security can potentially get access to that kill switch and potentially compromise the tech underpinning a really big chunk of the world's food supply. Which raises the question, how secure is John Deere? John Deere, as Corey Doctora pointed out in this article, again, worth

read, has never once submitted a single bug to the U.S. government's common vulnerabilities and exposure database. To quote Corey, as far as John Deere knows, its security is literally perfect. Oh, wow, good for them. And it is not. This was a couple years ago. There was a security research site called Sick.

Doc codes at interesting site. Cool articles worth checking out. And a few years ago, one of the researchers there started looking into this. The right to repair argument was starting to get louder, and it got him digging around John Deere trying to vet some of these security concerns that people were starting to flag. And he goes on this sort of white hat journey into John Deere's stuff. Again, a company who, according to them, has basically perfect infosec. Almost immediately, he starts asking, well, why can I do limitless username lookups when I try and log in? Why can I do this? If it's perfect, what about this?

And he starts pulling on all these different threads. And he starts getting form responses back to them as he starts submitting these bugs. He says, hey, do you have a formal bug bounty program? It seems like you should have something like that. Do you have a formal disclosure program? Because I'm just emailing a random person right now. Is there any way I can formally run a complaint out the line for all of the little things I'm finding that if someone wanted to exploit, these would constitute a great foothold into doing? And the answer was no, no, no, no, no.

So in pretty quick time, Sitcoats was able to, you know, find out information on the private owners of individual pieces of hardware John Deere is sold. He was able to, not, I'm not going to say fully get into their system, but he was able to get way further in than he should have been able to. When he ran this up the line, filing a complaint with Homeland Security, John Deere finally buckles and says, okay, we're going to, we'll start a reporting program. A program that at time of his publishing had no bounties. No, I'm looking right now, actually. There's no bounties. There is a reporting program, but no bounties will be paid.

That does not allow public disclosures and of which he, at the time, was the only member. If the ice cream episode that we did, I feel bad for anyone that hasn't heard it, we've referenced it like 10 times. If that episode was kind of mostly about right to repair, this kind of becomes a lot about those kill switches. The severity of it is defined by the fact that Homeland Security were the people to step in and make it a big deal, where it's like food security and food insecurity are like, you know, things that are a nationwide security problem. And it's like if we don't have agriculture, like we've tilted so far away from small farming to like a large, massive enterprise grade farming. That is pretty much the only farming that really exists anymore. So it's like if all of that heavy-duty equipment goes away, that's the only way that that large-scale farming executes. So all of a sudden we just don't have any food.

And if we don't have any food, then we've got a huge national security problem. In Infosec when it comes to info has the potential to like ruin a person's life. Infosec when it comes to agricultural tech has the potential to end lives. Like it's it is a different scale. Volumes. Volumes of lives. Yeah. That we need hackers to make the tech we buy work is not a good thing.

But when they build in kill switches, the fact that it can be hacked, like we said, kind of becomes dangerous. It is dangerous for cars. It is dangerous for tractors. It's dangerous for medical technology. As a brief aside, there's this company called Medtronic. A few years back, some security researchers started digging into the communications protocols Medtronic used to communicate with implanted medical devices. And they started to get kind of scared about the potential of what they found.

And they kept filing complaints upline and not getting anywhere. And in one of the most extreme acts of White Hat whistleblowing, I think I've ever seen, in order to get Medtronic to do something about this vulnerability, they exploited it. They created a literal kill switch, what they call, quote, a universal remote for killing people. To get Medtronic to do a voluntary recall of just one of their products.

To show that someone, that the existence of the potential of these kill switches is dangerous, they made one. Sounds like a DefCon that you didn't want to miss. It's such a weird. cycle. Like, people create rules and regulations so that other people can

spend, like, it takes like, as a utilitarian at heart, you know, it takes utility to make these restrictions, and then it takes utility to police the restrictions, and then it takes utility to bypass the restrictions. And it's like, at the

end of the day, you know, really the restrictions are probably, like, you can, you know, you can root a phone, you can probably root a tractor. It's maybe not the easiest thing in the world, but it's probably definitely doable. It sounds like the Ukrainians, you can do it all the time. That's what these folks are doing.

So it's like, how much utility have we lost as a society? You know, like the, maybe I'm, maybe I'm so old that I'm still in the open source mindset, but the, we just waste time and money and effort that could be better spent on on furthering and advancing the systems rather than trying to control them better and then failing to do so. Yeah. We waste time and we waste resources,

but the question of whether or not we waste money depends on who you're talking about. True, true, true. And I wonder too, at the end of the day, when we do transition to our future life of owning nothing and enjoying it. You know, will that be better for everybody? Whereas, like, literally the capital assets are collectively held,

and we just license them and use them. Kill switches can be dangerous. And I guess it's kind of cool that the Russian troops who stole them don't get to use them. It is, like we said, it's Shadenfreude. But the thing it got me thinking about is, like, what about when some hackers, Russian hackers, any hackers, decide that rather than stealing some tractors,

they'd rather just hack one group of people so that they can turn everybody else's off. If we can't have your smart tractors, then no one can't. What does that do? Bad things, question mark? Yeah, how much does a loaf of bread cost then? Thanks for listening, everybody. If you are interested in this ISIS coverage

on the hacking community specifically, and I know we mentioned it a few times, but Corey Dock-Rose article on this that kind of sparked us talking about it. Both fantastic. Both highly recommend you check those out. Big old thank you to our new patrons since the last episode, Christian Grubbs.

Thanks for joining. Happy to have you here. Austin Starling, thank you. Really do appreciate it a lot. And Brody, thanks for joining the team. Thanks for jumping on in. If you like the show, patreon.com slash hacked podcast. best way to support us unless you own a drop shipping mattress company and then reach out because boy

will we hawk that. Thank you for listening. Thank you for tuned in to another one and make it all the way to the end. We'll catch you in the next one.