Over many years now we’ve covered right-to-repair stories, and among them has been a constant bête noire. The American farm machinery manufacturer John Deere whose instantly recognisable green and yellow tractors have reliably tilled the soil for over a century, have become the poster child for inappropriate use of DRM. It’s enough to make any farmer see red, but there’s a story from CNN which shows another side to manufacturer control. A Deere dealership in Melitopol, Ukraine, was looted by invading Russian forces, who took away an estimated $5m worth of farm machinery. The perfect crime perhaps, save for the Deere computer system being used to remotely disable them leaving the crooks with combine harvesters they can’t even start.
It makes for a good news story showing the Ukranians getting one over on the looters, and since on-farm thefts are a hot topic anywhere in the world it’s not entirely unexpected that Deere would have incorporated a kill-switch in their products. Recently we covered a look at how the relationship between motor vehicle owner and manufacturer is changing from one of product ownership to software licence, and this is evidently an example of the same thing in the world of machinery. It’s reported that the looters are seeking the help of tractor hackers, which may be unfortunate for them since the world’s go-to source for hacked Deere software is Ukraine. Perhaps they would be better remembering that Russia has legendary tractors of its own.
Thanks [Robert Piston] for the tip.
Until the thieves figure out what’s been disabled and they hardwire around it.
Just look at HackADay as an example, people can be incredibly resourceful!
Or you just gut them for parts and sell it.
This isn’t exactly a big win or something. I mean, if John Deere had been able to remotely command the equipment to drive away and back to the Ukraine or something, *that* would’ve been impressive.
uhh pretty sure the big part of the ire agains JD for their lockouts are on parts being locked out.
I’m guessing it’s pretty hard to lock out, say, tires, seats, wheels, etc. These things are stolen, all they need to do is recoup a minimal cost it took to move them. The cost to the Ukrainian dealership is way higher.
Tractor turns on soldiers, the internal AI wants to get revenge for them killing his friend.
Well that not how I thought “Skynet” was gonna go down!
All of those parts, and I mean all of them are registered , John Deer is top notch, let them take a part in for replacement, they will know that part was stolen, being branded a thief, reputation matters.
“Just look at HackADay as an example, people can be incredibly resourceful!”
It was Hackaday that reported on that group of hardware hackers that released replacement firmware to bypass John Deere’s DRM and system lockouts.
I’m sure they will assist the Russians with… oh, that was a Ukrainian hacker group? awkward…
What?
Old Hackaday article
https://hackaday.com/2017/03/24/the-icon-of-american-farming-that-you-now-have-to-hack-to-own/
The first link here, to vice:
https://hackaday.com/2017/03/24/the-icon-of-american-farming-that-you-now-have-to-hack-to-own/
As great as it is to see the brickability of modern electronically-controlled goods be used for a positive reason, I’d still rather it not be a thing at all. That is to say, in my opinion the ends don’t justify the means in this case.
I want back cars that aren’t computers on wheels.
I just want to own the computers I paid for.
If it only takes signed updates, the update signers are the owners.
Wanna buy a pre computer project? I’ve got a few too many. Packrat genes. V8s and air cooled VW only.
Where I’m from, any maintainable car without rust is a _good_ car, live in CA now. ‘Good cars’ constantly test my self control.
I want the people qualified to write car firmware to be signing it. That sure isn’t me. Nor is it most of the idiots who stick spoilers and noisy exhausts on their cars, and would be very likely to install “performance enhancing” firmware which fails emissions and safety rules.
So, much as it pains me, I think I don’t want any idiot writing firmware for cars.
Sure, idiots can do other stupid stuff, but it’s much easier noticed by the garage when they get an MOT, or by the police when they stop them.
It is possible for a firmware update routine to accept TWO different signatures.
One from the official qualified supplier and the other where the private signing key is owned by the owner (you get it when you buy it).
MOTs include an emissions test, so firmware that fails emissions would be picked up
Any idiot can open their bonnet, unscrew a spark plug, and drop a ball bearing down the hole
The existence of third-party firmware doesn’t affect you unless you install it on your own car
And just like it’d be insane for a mechanic to not be able to open your bonnet without going to the manufacturer, it’s insane for a mechanic to not be able to flash a firmware update or change without going to the manufacturer
You can always install a 3rd party ECU.
Put the stock one back in for smog checks, along with the stock exhaust. Problem solved. I’ve done worse.
But you have to drive a popular model, which you should be doing if planning on keeping the car for a long time.
I’ve got little tolerance for ‘ricers’ (because they don’t know how to properly supe up a car, just glue on sparkly junk). It was the OEMs that did things like override your throttle inputs until they think your tires are pointed straight enough. Those bozos aren’t qualified to write ECU firmware.
Don’t ever look up what they found inside Toyota ECUs. Like the code was written by 14 year old incompetents. Stack and heap at the same end of memory, just to start. Stack overflowed (unchecked) onto Kernel memory space, right onto the process table. (It did overflow, recursive functions were used, incompetently.) No protected memory. Functions scored unmaintainable by a metric who’s name escapes me (IIRC 1 point for each flow control statement, scores over 20 were called ‘unmaintainable function’. Score was almost 1000, for Toyota’s monolithic main loop function.)
IMHO car computers should comply with appropriate parts of the FAA rules. e.g. no memory allocation/deallocation in ‘flight’.
In reply to HaHa:
“Functions scored unmaintainable by a metric who’s name escapes me (IIRC 1 point for each flow control statement, scores over 20 were called ‘unmaintainable function’. Score was almost 1000, for Toyota’s monolithic main loop function.”
Cyclomatic complexity is the term you’re looking for: https://en.wikipedia.org/wiki/Cyclomatic_complexity
@ales wrote:”MOTs include an emissions test, so firmware that fails emissions would be picked up”
Microwave Oven Transformers include an emissions test???
B^)
A Microwave Oven should emit microwaves (internally). If not, it doesn’t work.
Pretty much, that. The wiring diagram for my 1963 Studebaker fits comfortably on one 8.5 x 11 inch page. My 2003 Honda has a separate 150 page shop manual for the electrics.
Yes indeed let’s have death trap cars again. Let’s go back to double the highway deaths we have now. Get rid of those air bags and just let people die.
Sure would fix texting and driving, one way or another!
Sometimes there is over-application of technology. I had a used Nissan LEAF EV which had a PIC just to read a linear side resistor for the five-way switch for the driver window and to check back-EMF if the window jammed or was trying to bite someone’s arm off. The other three windows quite sensibly used simple mechanical momentary three position switches and the relay equivalent of an H-bridge on the driver side master window panel.
Of course the control board burned out in zero degree January weather, luckily with the window up. A replacement control board which I installed myself set me back $120. Probably 99.5% of people buying LEAFs would never have noticed or cared if Nissan had used the same three-position mechanical switch and relay to control the driver window too.
Forget the airbags, what about overriding driver steering input because the car “thinks” you are drifting out of a lane? What about emergency braking because a dirty sensor makes the car “think” there’s an obstacle? Is it possible that the owner of the vehicle, who has passed a test and is licenced by the proper authorities might actually know better than a cheap sensor wired to a cheap microcontroller?
I agree, and I wouldn’t qualify it as a “victory”, since the thieves still have the hardware.
I like the idea that the thieves didn’t have the ability to just use their stolen goods, $5 million loss is almost a “rounding error” in the overall loss that Ukraine has suffered…like a single apartment building or department store.
I *REALLY* don’t like the idea of the remote-kill-switch on $300,000 products that you’ve bought and paid for.
What other purposes could they use this for?
Could this be used as a cyber-weapon in the wrong hands? (ex: Russia attacks by switching all of Ukraine’s tractors)?
Where are the limits of what John Deere would consider appropriate for this switch?
Kinda makes me wonder if John Deere didn’t disclose this “feature” just to somehow generate support for their building the ability in….years ago….
The really obvious other purpose this could be used for is that it’s really hard for a repo man to tow off a tractor out in a field when the owner can’t make payments because of crop failure, but if the repo company has a contract with Deere…
“I *REALLY* don’t like the idea of the remote-kill-switch on $300,000 products that you’ve bought and paid for.”
Dealership paid for. Just like that TV theft awhile back. People don’t like? Just have them remove it once bought, company expense.
You see this as a positive?
Ditto!
That’s why, if i must buy a tractor, I never buy a John Deer.
I’d buy an older Deere, no problems. Ours was a very good machine.
John Deere has always had superior engineering. That’s why they say “you pay for that green paint for a reason “ but they sort of went off the deepend of the repair issue. Remember Apple is getting nailed on that law suit also.
As a kid who grew up on a farm Deere was always way ahead of the pac. They patented a locking and adjustable axel lug in the 1930s and it was still in place in the 70s (you try adjusting the row width on anything but a Deere and you’d say the paint is worth it) lol
My family goes straight Belarus lol Russian controls and everything (Russian immigrant family)
Very well said.
While a remote kill switch is a good idea, it should be under the control of the owner not the manufacturer. This is one area where blockchain could be used in a useful way. When ownership changes, it is recorded in a blockchain and the owners crypto key is registered as being the valid kill switch code. This info is used by the machinery.Of course, it doesn’t solve the problem completely as crypto keys can be stolen but that is better than having something you own under someone else’s control.
“Blockchains” are public ledgers — that’s the entire point. You could store a public key on the “blockchain”, but you’d still need the matching “private” key on your local device.
So, rather than storing your public key on a “blockchain” … why not just store it in the tractor?
It would accomplish the same thing, be more secure, be more reliable, and be far less complicated.
That is a good approach. I created a demo of such a system a few years ago. The idea was that you could buy stuff and the purchase transaction would transfer ownership by registering it in the item purchased. The reason for a public register is to allow public knowledge of ownership if that is desired, (not always the case) and to provide some additional protection from theft if the item is physically compromised. It would act a bit like a land registry.
On one hand, I guess it is nice that some Russian looting has been thwarted to some degree. On the other hand, that is an enormous amount of power, and it is only a matter of time before it is abused. I like owning the things I depend on, and the ability for the manufacturer (or anyone else) to remotely convert my property into a pile of junk is incompatible with my notions of ownership.
Matter of time? They abuse their customers with this software bullshit constantly.
It is just a question of time until a Russian Hacker says something on YT like “Jobn Dere registry uses 12c508 here as encryption to memory module, you swap 12c508 with blank, you get free tractor”
This is just awesome!!!!!! Just think about it now if you have wrongthink in the USA they can now brick your tractor as well and HAD will publish a big article on another big win for John Deere!!!
FYI I am not for the war in Ukraine death is a horrible thing and nothing good is coming of this. I was using sarcasm above to prove a point which i believe most will miss so that is why i am explaining.
If they have that ability they probably have the ability to track them too.
Maybe it would have been better to let the tractors run but share the tracking data with the Ukranian military.
The CNN article noted that the tractors and harvesters have GPS, and that some were tracked to a village in Chechnya.
I don’t see any jingoism in this article. The only mention of the war is that the store was looted by invading Russian forces. Material gain from theft for an aggressor in a war of conquest is “a bad thing(tm)”, and whataboutism doesn’t change that. While that is a value judgement on an inherently political topic, Hackaday has also (rightfully) given value judgements on plenty of other inherently political topics (right-to-repair, trade, mineral extraction, foundry subsidies, etc).
As an aside on the use of jingoism, that implies that the author of this article holds an opposite moral judgement on actions by an assumed opponent to Russia. Both the implication and assumption are strawmen.
Yeah cnn isn’t saying who their “source” is.
But it’s totally not the same guy who buys all the John deer advertising time during their news programs.
Brilliant. News at 6 in few days: “John Deere was hacked and all Ukrainian tractors are disabled”.
/s
This sounds more like how a general thinks. It’s not about stealing tractors at all. It’s about winning a war. They are reverse engineering the DRM as we type.
At the very least, the dealer and/or Deere has a good international court lawsuit over theft.
Neat. Can’t wait for farm equipment targeted ransomware.
This is exactly why I would avoid buying anything new from John Deere or any OEM like them that uses DRM as a weapon. This is why for any vehicles I rely on for SHTF moments or business, I try keeping it pre-OBD-II (1995 and under)
Yes, I do own some JD stuff, mostly tubes of JD green grease that I bought at a farm auction while buying other equipment.
I avoid chippers with DRM and custom one off electronics that can only be sourced from the OEM, which is even worse then JD because chipper OEMs go out of business on a regular basis or are bought out and many of the “safety” features are run by electronics and will totally disable the equipment if they fail.
No worries though for Russia, I am sure they will drop a Chinese diesel engine in and replace any fancy joystick equipment with skid steer spool valves. I do not think they will be worrying too much about the EPA rules with the DRM issues or catalytic converters . For an organized gang these would be perfect items to send to China to be reversed engineered and then cloned and sold into Indonesia and that 3rd world area where copyright and trademark protections are not a high priority for governments.
It pretty much does not matter what country you go to, someone always finds a way to give the farmers the pitchfork in the behind because control of the food is the ultimate avenue to power. If they had not stolen the equipment I am sure they would have destroyed them where they sat. If they did not steal the grain, they would have destroyed it by dumping it into the sea.
Yes indeed read the fine print, next time you head out to steal a tractor in a wat zone.
Shame they couldn’t remote control them to run the combine ‘arvesters into the Russian lines…
Congrats, one story with a slightly positive use for DRM. That definitely justifies all the farmers screwed by it.
“enough to make any farmer see red”
I see what you did there.
[chuckle!]
Sadly, “red” is doing something similar.
Its all a game until the Russians figure out how to brick all of our John Deere equipment and our farms shut down. Do you really think Deere security will hold against a nation-state intelligence agency? We should take it as a warning that all of our farming equipment is vulnerable to a remote shutdown hack.
Depends a bit on who organised the looting..
Low level free enterprise… nothing gonna happen.
Mid level… maybe nothing unless they have the right friends
High level and plugged into the oligarchy or actual government sanctioned, then yah, might prompt serious attack of John Deere’s infrastructure.
Not sure Russia can afford such a thing to be traced back to them right now – tensions are high anyway and messing with the food supply is easy to interpret as an act of war (and there are more than enough politician and people who are wanting any excuse to actually nip this war on freedom and democracy in the bud now – it might just be a good enough one).
Much as they might bluster otherwise they can’t deal with bringing any major military power into the conflict they have created directly, they are already looking like they are on course to loose, and all the rest of the world has done is give Ukraine a few crate of weapons, and not even the really good stuff (for the most part anyway) while continuing to pump billions more than the value of the arms shipments to Russia for their gas and oil.
And even if its proven and no direct military action is taken further economic sanctions are a certainty, really don’t think they can afford those either.
If you are killing civilians in cold blood and leveling cities there is not too much beyond them. Hacking John Deere to get their DRM codes would seem pretty minor assuming they are not already in possession of them in case they need them. There are also other way to achieve the same ends like maybe a Deere employee willing to make some money. Industrial espionage has been a thing for a long time. It may not be an obvious shutdown either, maybe something like a corrupt firmware update that could be blamed on Deere. Possibly an update that “accidentally” locks out Deere’s own access.
If there is one thing we have learned it is that code signing is only as secure as the certificate process that has been compromised many times. Do you believe that the GRU or SVR is incapable of obtaining a private key for a company? I would not bet our nation’s farms on it.
I have no doubt they could do it, they might even want to, but there is only so far they can go before they become 100% certain going to backfire on them so hard their own self interest keeps them from doing it.
Riddle me this if the world reacted to Crimea’s annexation (Or Russia’s actions in Georgia, Finland etc) even close to the way its reacting to this invasion – looking like they really mean it – do you really think the Russians would cripple themselves, knowing the extra sanctions etc that would come their way on this further attempt? I’m sure Putin would want to, but unless he really has lost all reason he is not going to destroy his existing nation trying to force the USSR back into being, better to be god king of Russia a nation with some power and influence than god king of a backwater nation so crippled the North Korean may well laugh at it…
Right now doing something like bricking tractors, even if its done with more subtly than the Russians have shown in a generation or more is almost certain to backfire on them really hard, so I can’t see them being stupid enough to try it. Heck right now they are probably more interested in making sure nothing like that does happen to the Western Powers, as rightly or wrongly they are likely to take the blame…
(Which is not to say I’m in favour of such features existing, as I’m not)
Steven, if this site had mod points, I’d give you a “+1, insightful.”
I’m disappointed – at a minimum I would have expected them to start driving themselves back, or optionally go for a swim thanks to full self-drowning beta features.
I am a huge Deere user for 30 years but am totally against this technology!
Its an interesting event. It just weird that anyone would look at this positively.
If they piss of the russians, great. But I hope the Russians retaliate and fuck their shut up too. Both groups deserve each other.
Oh nice! I’m now waiting for news like ‘Ransom ware attack on John Deere triggered starvation in 80% of the world map caused by tractor lockout around the worlds’. Would be very happy to here this when I eat my last slice of bread.
Ultimately we are talking solenoids and motors though which can be controlled by a GPIO on an ARM or lesser processor.
Yes it is pretty much rewiring and eliminating every computing node if the system is a trust based one but you still have a fully functional machine in need of a new nervous system.
It is laziness only which has prevented me from building this for my own car, as well as smog regulation checks.
I would be surprised if there were not already
John Deere is a long term evil empire leading the ultra-corporate seed-t-supermarket state subsidized farming movement, Russia cant last. Russia feeling the burn is entertaining but I have hired plenty of Russian engineers, they already know what I have typed. Thanks to janky corrupt logistics Russian techs and engineers are used to having to make DIY/HAD type fixes even in industrial settings. Look at the Russian drone with the Velcroed in Nikon and water bottle fuel tank, industrial DIY at its finest. Bur they cant make modern weapons or radar without German and Taiwanese electronics and components, even in the Soviet era all of the generations behind chip fabs were in the DDR the USSR had vacuum tube fabs and even fighter jets were nearly all analog or mechanical.
it’s not just rewiring, you’d have to reverse engineer how it actually works, keep in mind many of those control circuits aren’t just on/off, some are proportional and depend on interaction with others
Also remember that you do not have to brick a tractor forever. Disrupting all the John Deere and maybe Case IH equipment for maybe a month during planting or harvest season would be a national disaster. There are not enough arduinos or people qualified to install them to save your season. We imposed a ton of economic sanctions on them, to think they would not retaliate is naive. If we threaten to respond they would hide behind the same nuclear threat they are using right now. I suspect that we are more scared of escalation than they are.
Lets for argument sake say that Russia bricked all of our John Deere equipment. Do you actually believe that we and by extension NATO would enter the war under the threat of nuclear response? I don’t think we would. Seeing Russia’s military failures makes a lot of people happy but in my view it is incredibly scary to see that if their tool box contains a non-capable conventional force and a capable (maybe) nuclear force, any conflict is likely to get out of control quickly. I hope they lose and am worried about how that ends. I am a former armed force veteran of the cold war and having a nuclear capable enemy backing into a no win position of weakness is very bad.
Even more frightening when the leader of that enemy could be very ill or terminally ill and not have much to lose.
Be cautious about saying there is no way that could happen, every world war started with that thought.
Following the apparently unending Takata airbag failures, we might be better off sans airbag. Less murderous, mutilating shrapnel in the face is a fundamental good.
Yep you can disable machine on the other side of the planet,but you cannot provide me with my Buc10907 leaf bagger I purchased a year ago.
Would be nice if John Deere would brick some of the tractors in Russia right now sure they would find a way around it but just the fact it was done and the loss of use till till they have a work around would be great message.
These DRMs have just become a matter of national security. No nation can have it’s farms compromised because some corporation has control over it’s machines. Now that we can assume Russia has already hacked and obtained John Deere DRM keys and can at any moment turn off farm equipment. Congress must move to order John Deere to push an update that disables all DRM control or issue recalls immediately.
I refuse to credit John Deere for “appropriate use of DRM.” Drm is bad practice, and is harmful to end users. If it can be used on rusdian invaders it can be used on the small farmer you never hear from.
“bad things are good when they hurt the people I don’t like!”
In no way is this good news. Just because it has a desired outcome as far as supporting the current thing. In the bigger picture it just shows how ominous corporate overreach is over things we “own”.
What next? Sorry Mr farmer, we don’t like the thing you supported on social media so we’re disabling your tractor until you delete it. Or sorry Mr farmer, by government order were disabling your tractor until you buy Monsanto seed.
Think this is crazy? Ask a Canadian who supported the Freedom Convoy how fast their bank account got locked down.
How is this a positive?? It’s the excuse JD needed to keep control over things they don’t even own anymore.
Talking to farmer friend of mine, they have been able to do this for years. When they realize a farmer is working on his own tractoer because they are too expensive, jd shuts the tractor off remotely.
On another note this technology is in all the new. Cars we everyone drives.
This is not really a great thing.
So what happens when we get into the tribulation a little further and ALL John deer equipment is remotely disabled 🤔. In the above statement, we are told they are the tractors that till the soil of our American land 🤔
It is a good thing that under the actor called Obama, that the Census acquired the GPS coordinates, literally not just the rural route mail box, to the front door of every farm house/business. No worries though, I am sure an adversary would not target the top 50 traveling businesses with cruise missiles that harvest the majority of the crops, with missiles using stolen data. Because if these top 50 businesses are ever taken down one way or another in September, the USA and world will literally starve 6-12 months later.
The G20 leaders all work for the rain man, so, the only thing you can do is make sure your own tractor is not hobbled with the likes of DRM from John Deere, your are better off imho with a Ford 1910 without ROP instead.
There’s nothing positive about this situation. It doesn’t matter if the tractors are useful to the thieves. The farmers have crops they are unable to harvest. That’s perhaps the whole point of stealing their equipment. They’re attacking Ukraine’s resources and supply lines. Deere would spin it into a positive about DRM because of course they would.