Colorado State University researchers have found that ELDs are “potential cybersecurity threat vectors” and there is an urgent need to make them more secure.
Researchers Jake Jepson, Rik Chatterjee and Jeremy Daily uncovered ELD vulnerabilities that could lead to unauthorized control of vehicle systems and data, as well as widespread fleet disruptions. Product designers, programmers, engineers and consumers should raise awareness of these vulnerabilities and encourage development of safer ELDs, their February paper says.
The United States has 14 million medium- and heavy-duty trucks on the road, many of which are required to use ELDs to track truckers’ driving time and ensure compliance with hours-of-service regulations. The devices acquire data by communicating with the vehicle’s engine control module through the vehicle network.
This technology is vulnerable to “truck-to-truck worms,” self-replicating malware that autonomously propagates across a network. Traditionally, these “worms” have targeted computer network systems, but in an age of increased connectivity of systems, technology like ELDs carries a risk of being hacked, the researchers discovered.
“Each system by itself may not have cybersecurity concerns; the truck without an ELD does not have a wireless connection, and the ELD by itself cannot command a truck. The heavy truck acts as a dynamic operational platform, encompassing various mechanical and electronic components, while the ELD serves as a mandated interface for data logging, regulatory compliance, and potentially, vehicle control,” the paper said.
An attacker could connect to a device — and only one device needs to be compromised to begin a larger attack — through a drive-by attack or by waiting at a location frequented by truck drivers, such as truck stops, distribution centers or ports. Then, the malicious firmware can spread to similar devices. Attacks can occur via Wi-Fi or Bluetooth or even through cellular networks, the paper said.
“Our findings revealed that, even in a full parking lot, a connection could be established up to approximately 12 parking spots away, equivalent to about 120 feet,” researchers said.
The researchers recommend the following to strengthen ELDs against attacks:
- Enhancing default security settings.
- Implementing high-entropy passwords.
- Utilizing a secure firmware signing mechanism.
- Eliminating unnecessary API features.
Brokerage Compliance Symposium
The day before F3. Every compliance issue you face - fraud exposure, carrier liability, FMCSA rules, cargo theft, insurance gaps - navigated by attorneys and operators defining best practices in a changing industry.
F3 Awards Dinner
The night before F3. FreightTech100 companies honored. FreightTech 25 and Shipper of Choice winners revealed live. Cocktail reception into dinner and live music - 300 industry leaders in one purpose-built room.
F3: Future of Freight Festival
Industry-defining keynotes, rapid-fire technology demos, and industry leaders networking in experiences across Chattanooga - plus the inaugural F3 Awards Dinner featuring the FreightTech and Shipper of Choice reveals.
The day before F3. Every compliance issue you face - fraud exposure, carrier liability, FMCSA rules, cargo theft, insurance gaps - navigated by attorneys and operators defining best practices in a changing industry.
The Signal at Chattanooga Choo Choo • Chattanooga, TN Register NowThe night before F3. FreightTech100 companies honored. FreightTech 25 and Shipper of Choice winners revealed live. Cocktail reception into dinner and live music - 300 industry leaders in one purpose-built room.
The Signal at Chattanooga Choo Choo • Chattanooga, TN Register NowIndustry-defining keynotes, rapid-fire technology demos, and industry leaders networking in experiences across Chattanooga - plus the inaugural F3 Awards Dinner featuring the FreightTech and Shipper of Choice reveals.
The Signal at Chattanooga Choo Choo • Chattanooga, TN Register Now