So sick codes here is proving the point when you ask the question. Who thinks your
tractor is sexy? This is the man. All right. Good afternoon, everyone. My name is sick codes.
Just had an issue with the slides. The font didn't come across because I was using LibreOffice
for the fans out there. My presentation is called hacking the farm. It's about breaking
into agriculture security devices. So, yeah, prime focus areas today are food security.
And what I mean by that is the food supply chain. One of the biggest parts of that,
one of the biggest parts of the GDP of the entire country is food and agriculture,
which accounts for about 20%. So, one fifth of the U.S.
GDP is literally just agriculture. And I wanted to kind of be like a little bit of a wake up call
because it's kind of a big deal. And the main takeaways, I want you to feel like this is super
easy and be like, oh, wow, that's like one of the easiest things ever. And I want you to feel like
you can also do it. You know, that's one of the big takeaways. You want to be able to do it to
everything, your fridges, your watches, your smart ‑‑ what did I say? Smart fridges. I already said that.
This talk is suitable for anyone who eats food. So, I assume that's most everyone here.
Yeah. So, sit back, relax, and just enjoy the presentation.
Yeah. So, this is the OVH data center. Some of you might remember this. And one of the big
takeaways from this data center fire, something I picked up pretty straightforward was this comment
by the CEO of OVH saying,
I believe this incident will change the standards of the industry in relation to free backups for
future incidents like this. And my take on that is News Flash, OVH, everyone else was already doing
backups. You were the only company that wasn't. So, it kind of sucks for the customers that lost
their data, but things have to happen before you transition into a new, I guess, modus operandum.
And, yeah, consider the risks before you jump onto the information highway, super highway.
Big key here is you wouldn't upload supply chain.
John Deere. Oh, sorry. Yeah, John Deere seems to think otherwise.
Yeah. So, John Deere, we have a check of history, myself and John Deere.
I was the first researcher in their program. That was about last year, August last year,
just before DEF CON last year did a talk on that, a little bit different. And that was supposed to
be a bit of a silver lining in the background. So, they actually generated it. They've got the
program now. And they've got, you know, some reports resolved. We've got 94 reports resolved.
One of the key things that I'm trying to mention to John Deere is that they don't have equipment
in stock. Sorry. In scope. And in stock either because of the chip shortage.
But, yeah, they don't have equipment in scope. So, I kind of took that, like, you don't have
a bounty program that pays money that I know about, by the way. And you don't have a program that pays
for hardware that's in scope. So, who do I tell the vulnerabilities to? And are they actually
vulnerabilities? So, just reminding you, have a good day today. I want you to make it look easy.
And don't think you can drive a tractor after this talk either. But, yeah. And never give up.
So, these are some of the issues that I had. You know, shearing, just mayhem and just annoying
things like that. Breaking screwdrivers and just shearing the only bit that fits in one of the nuts
and bolts. This is another one. This is the previous device that I looked at, the modular
telematics gateway and actually broke that in half, which it's so annoying because then you have
to buy another entire unit just to get that chip which has the software on it. So, that's the only
chip I wanted and I broke it. So, looking back in hindsight, obviously, there's way better ways to
do it, like, you know, low melt solder and things like that. But there was a lot of epoxy underneath.
They tend to use a lot of epoxy on their stuff. So, it's kind of like an extra layer of glue.
But, yeah, once you get that chip off, this is one of the most common chips you'll see in
most USB sticks and things like that. You can just take it off, get one of these open source
Nanlite design boards from a guy in Poland. Sorry, the design is open source to an extent.
Or you can find it on Alibaba and stuff like that for a dollar. And then, yeah, you can
actually basically read and write those chips straight, you know, firmware and things like that.
And the software that it comes with is actually written in Polish, which is kind of tricky to use.
I actually ended up getting another one of those devices, the one that I snapped, and actually
accidentally overwrote the chip instead of reading from it. And I kind of put it to bed for a while.
But, yeah, it kept going. So, yeah, things like this, you know, just shearing out screws and
things. But here's a little thing I just want to mention, just because we're kind of near the
start. But these companies will be in it, you know. Companies have always emailed me after things like
this and gone, oh, you know, we heard we were in the talk and things like that. So, I put them all
in so they don't actually have to look through the slides and have a look for themselves after.
None of the research today is paid for. All the research is in good faith.
Nothing today represents me, et cetera. No gag orders. It's all CC0 and all the
trademarks belong to the real people that own them. And there's all my socials. You can follow
me on Twitter, LinkedIn, GitHub, et cetera. If you want to do some work, hit me up.
And that's a tractor. So, that's a chainsaw looking thing. It is a forage harvester.
One of those autonomous ones are pretty scary. The thing on top is actually the
GPS dome on top which turns it into a remote controlled device. And in the cabin, in the guy's
seat, there's actually a display he's using. And I actually have one of those displays here as well.
So, I'll get into that shortly. But so, there's three parts to a tractor or machine or implement,
et cetera. You've got the actual machine itself, which is the thing that you can actually get parts
which is another thing i'll mention today is right to repair um the parts you can get for like
hardware you know like nuts bolts you know um pieces of metal really but the things that you
can't get are copies of the software from the manufacturer and copies of the unlock codes and
copies of the the special codes um copies of you know the source things like that source code which
you know they might offer um and in particular john deere does offer that uh and just just lastly on
this all three of those three of those components are interconnected they all actually talk to each
other so you can actually control the device the machine from the gateway and also from the display
and you can also update the display from the gateway and the etc etc you can go all right all
the way around over canvas automotive ethernet and a number of other different things to talk to the
things including wireless and this is the last thing i'll mention of the gateway before i jump
into the cool thing which is the display which is what i've been working on for the last month
pardon me one year um this is the
gateway and yeah like i said this is the only part of the tractor that's controlled by the net
the network that's got network controls connectivity um these are the four series
of displays let's get some water we got the 1800 display the 2600 the 2630 and the 4640.
i actually have a 4240 which is the budget version of the 4640 and it's actually the flagship um
model of the uh series series it's actually the flagship device at the moment
this is the previous one this is the brown box now this actually still works and farmers actually
have this tendency to stick with stuff that works and a lot of people might think a farmer is
actually less intelligent for using more you know the older stuff the more traditional devices but
the answer is no they want stuff to work when it's actually required they want stuff to be
extremely reliable on point you know when it's reliable they don't want anything to go wrong
when stuff goes wrong during planning and see and harvesting season
they don't want anything to go wrong during planning and see and harvesting season
and to think that things like software and you know updates think about windows
updates i like windows but think about um thinking about updates during
planting season like you know you can't use your tractor and i'll get into that soon because that
actually happened to me even though i'm not a planner or a farmer um it actually happened to
me and i had an experience that i'll enlighten you on truly so these devices are actually 25
25 years old and they still work right they still work they're actually
still
in use they sell for about 600 bucks still so 25 year old devices 600 bucks
and they have lifetime unlocks and what i mean by unlocks is the devices themselves have certain
codes that let you use the device uh without restrictions in terms of software packages like
an app store right they have an app store that's technically an app store it's the john deere app
store um and we'll get into that shortly as well so the 1800 was one that was rarely used it was
uh a windows c6 device and they sell for about 800 bucks so they're still getting used today
this is like august this year so it's very recent they still go for full price
and then we have the windows uh so the uh this one here i think was vx works the slide's gonna
say windows ce but it was actually vx works and the other copy of the slides had vx works but yeah
it's a um different version of like uh it's an embedded system it's practically linux so um 2600
dollars this is almost you know 10 15 years old now as well still goes for a reasonable price and
then you've got the main one this is the 2630 this is the workhorse of the industry everyone uses
this device and it's running windows ce6 so windows ce6 if you aren't aware is um oh just
quickly they're about eight thousand dollars roughly at the moment for a device that's
end of life okay so windows ce6 is eol um to think that a device that's eol or end of life
does not get any updates running windows embedded um and basically taking the brunt
of the entire food supply chain is quite concerning to me well i hope to you as well
but yeah credit's due um where credit is due and windows ce6 keeps the food supply chain running
still works actually pretty good um and farmers you know i'm going to simplify it here but farmers
actually a pretty straightforward task you know plant seeds wait for them to grow pick them up sell
them and then buy more um and yeah it's actually pretty much like farming simulator but in real
life so if anyone's played that game it's actually very accurate so um yeah it's quite it's quite
interesting uh this is just some of the licensing agreements where you can actually ask john deere
for copies of the source code uh you may come i'm just gonna there was actually a video here but um
you may obtain the complete corresponding source code from us for a period of three years
so i've actually got a copy of that from them
um we'll talk about that later but uh that code is actually obviously allegedly open source but
that's that's another uh issue that uh is currently being disputed by multiple parties
i guess um the 4240 is what the one that i've got today that's the one that i've got there
uh it's sitting there it's all wide up we've got rs232 up the back you know um just a bunch of
little cables around i've just twisted them all up here you probably can't see it but you can come
up after and have a look um and you'll be able to do something else as well but yeah these go for
a little bit cheaper than the other ones because these ones actually have non-lifetime unlocks they
have subscription-based unlocks so the ones that work the ones that i showed you before
they have the same unlocks but they are lifetime unlocks so farmers prefer reliability things that
are proven familiarity and less device restrictions you don't want to be able to
you don't want to go into farming into harvesting season with with
no 100 reliability like you don't want to be relying on something that is like temperamental
temperamental as a end-of-life windows ce6 device on the middle of a barren farm in the heat so
the second reason i'm packing this device and not one of the older ones is because this one's
actually used in the second-hand fleet market and what i mean by that is big fleets that have
farming equipment now those devices are actually going to be passed down to the current generation
of farmers via second hand because a lot of farmers you know mum and dad shops etc or family
owned businesses they they're kind of ford brand new
equipment that um a lot of the big farming operations can and that equipment is actually
going to be passed down theoretically through auctions and things like that for second second
generation that's why everyone has the 2630 and that's why i have a 4240 because the previous
generation gave down the 2630 and that's why all the farmers all over america have the lower um
the windows ce6 one agricultural tech tech adoption is very unique in that uh exactly
what i just said is people uptake things very very slowly they're very
meticulous when they come to purchasing things because they want to make sure that it's going
to last a for a long time and b it's not as hard to understand as what they previously previously
been using um and just showing you the compatibility they've got all sorts of
things like can rs232 for serial analog digital etc etc gps um and trip and i'll tell you other
few things shortly but there's another one there the second one there isobus vt
that's a specific type of um application that you can run and it comes up as a pop-up
um app and i'm actually working on some some special stuff with that i haven't actually
completed that but we'll get into that shortly so the actual os is wind river linux and that's a
ex-intel company but now partnered with intel um and they make specific stuff that you'll find in
like things like f-16 it's the linux that you'll find in f-16s 18s 22s 35s
all different types of aircraft stinger missiles tomahawk missiles
and the mars rovers um i thought it was only one but anyway that's the device that i've got uh
today looks really nice like that you know pristine it looks a lot better than the brown
one that i showed you right it's 3d it's you know actually i'll tell you about that 3d thing
shortly but you can actually play with this online so you can go on the display simulator
website by john deere and actually have a go you now need to log in via octa because they
added octa for a lot of different pages after i um had a look into their stuff last year but
now they've got octa
uh covering pretty much everything so you've got to sign up you can sign up as a free developer
i'm not sure if they're giving them away still though but um yeah i was able to sign up as a
developer last year but i'm not gonna get into that because um yeah it's not the point of today's
exercise but yeah that's what the device looks like power it on um and that's my farm there
covered in corn obviously it's actually someone else's farm because it's from some guy in italy
that i got off ebay and uh his farm still hooked into it so i've just been using his data
so he hasn't actually used the demo as well so there's actually demos so could you believe this
right even though it's gpl even though the gpl strictly says certain parts of the gpl even though
the gpl certainly specifically says that things such as subscriptions aren't allowed to stop
working after you stop paying for them any version of the gpl we've still got demos here
that stop working after 15 hours of machine time use so i actually know a couple of guys have
actually built things that stop the clock on these and actually roll it back every day so you can keep
um and there's a couple guys in brazil that do that so um but that's not what i'm talking
about right now so i'm talking about some fun stuff so yeah dollar bills this is how much
those licenses are so i've got a big nice price list here for you um some of the expensive stuff
you know 23 000 for an eol 2630 um that's not cheap right so that's you know 26 the most
important things are rtk activation three and a half grand that's lifetime unlock by the way
three and a half grand for rtk activation that lets you use radio
all right that's already there right that's already on the device it's already programmed
i've seen it on the device right um that program is already there and all you're doing is paying
for the unlock which i understand there's a point for that but um i'm just showing the prices that's
all so yeah more some more prices here the new ones a little bit different as you can see
subscriptions subscriptions subscriptions um yeah if you look at this these are just upgrades
between different versions of the 4600 so gen 4 is the gen 4 that i've got the generation of devices
um this is me having a crack at opening it yeah it's got it's got that you know that glue between
your phone screen and the device it's got that but everywhere it's a pain in the ass to open
it's running at nxp imx6 so pretty old um not necessarily pretty old i think it's 2015 2016.
around about that time imx 6 8's out i think 9's out actually but something someone from nxp is
probably here um yeah you've got ram you know your little ram they're covered in this yellow stuff if
you've been trying to find out for quite some time it's actually really i don't know if it's like
some sort of fiberglass or yeah i get that it's heat sink i was like but i don't know what it's
made of because it's like it's it's like almost caustic it feels like um you've got itchy stuff
after you've after you've touched it but one of the devices they've got they actually cover the
entire thing in that yellow stuff um for heat sink purposes in terms of when you actually took off
the device it would rip off the nand and irreparably um you wouldn't be able to put that
just for opening the device and um yeah it's happened in more than one occasion on the same
device so just having another side pretty bare bare board it's by continental and i thought at
the start of this they just made soups and ties but they make sure they make more products than
that so that's the proprietary thing called hs auto link 2. it's a molex connector that uh you
can't get anywhere because it's like proprietary as hell and that's what they look like it's just
um i think john deere only uses a couple of the pins anyway so they just went from a more
they just made it more abstract and more difficult to um to play with
oh that video is missing but yeah this is the pin out of that 26 pin connector on the back
uh what i'll point out to you here is you just need three wires to turn it on i've got three
wires here i'll just show what it looks like even though you can't see because even though
you can't see because you're probably um in the audience and everything but you can come up and
look after but it's just running off three wires at the moment um and those three wires are connected
but then there's two secret wires all right and i don't know if it's john deere's secret
wires or there's just two secret wires there but that's rs232 serial so you can pop a shell
with those ones um yeah the blue one and the yellow one correspond to the pin two and pin
three on rs232 and you just hook straight into it so um i actually burnt out i'll tell you about
that in a sec but yeah this is the this is the same connector you'll find in like your old
printers and things like that so you can probably find these around the house and
in cupboards and things like that um
everyone knows what it is anyway well the younger generation yeah you can go digging for them but
they're pretty easy to find like they're usually pretty old and dusty but johnny's got his own pin
out for that like i said two three and five it's just in out and and ground and then um what
happened was i actually connected the connected this up with the 12 volt ground and you're not
supposed to do that um and actually got into this state where this is actually not because of that
error that i told you but this is an error this is an error that happens when you reboot the device
10 times
without actually um letting it boot fully so if it reboots 10 times you get to this error screen
right so it says you must contact the dealer you absolutely must contact the dealer and i thought
okay so we jump in that serial that i was just talking about there you probably can't read that
but it says file system check we're having a look um and i thought well but now's a good time to
desolder the nan flash and have a look and change the boot count that they've got in there from like
10 to like a thousand or ten thousand or something like that
so i desoldered it right and changed this here so it's got max boot count in this boot sector um
so that's in the boot partition it's literally just plain text right so
that's max boot count 10 recovery boot count six i believe it's a running tally so what i did this
is the terminal that pops up i actually desoldered it chucked it into the flash reader that i showed
you earlier you know mounted one of the partitions that i was working with reballed it and this takes
a lot of power and um i think lewis rossman was here earlier and he would think this is
disgusting that's the way i've treated this board um but yeah it looks all right under yeah like
that and then you can rub it on like a piece of paper and get it to um level level the balls out
but um yeah that looks terrible but anyway when it goes back on i'd actually set the max boot count
i think the max boot count to 10 but i changed the current running number to 9999 and obviously it was
not going to boot because it was already past 10 right so then i went into the manuals that i
just got from the disc and there was instructions there about how to actually recover this right you
have to contact the dealer please contact your local john deere dealer and what if i don't have
a dealer what if i'm in thailand um which i do live in thailand right what if i don't have a
dealer what if i don't have a local dealer in thailand and i could oh let's find one right
we're going to the virtual asia showroom so we've got the virtual john deere
asia showroom and let's find a dealer
so this this like spins forever by the way uh there's no dealers and i went found some
this is like a 20-day walk or something like that if you get there so
um so i thought i'll take this into my own hands
yeah i'll become the dealer now so you then you get this thing called the software
manager for john deere it's quite a yes john deere software manager it's pretty always right so
this actually downloads as you can see the running tally it downloads over 235 packages
and what i mean by packages i mean rpms it downloads the john deere rpms so anyone in
understands what an rpm is it's literally just a dot deb for rel debian oh sorry for red hat based
linuxes and would you have would you happen to know that wind river linux is rel based so we
can just install these um on any any um red hat based linux but i'll get into that shortly because
um johnny's gonna love it
so yeah so you get 12 gigs when you download that stuff as well they give you 12 gigs 12 huge gigs
um and you don't actually need all of them so it actually downloads multiple architectures and you
actually get arm v7 adam i7 uh rb7 v2 i think it is and then you've got no arch which works on
everything by the way so i thought to myself um let's have a look through the files that i
downloaded so there's this thing in here this i think this is from the device itself when i
desoldered it or from the from the update stuff but you can see this file here if you can't read it
i'll read it out the reprogramming image check file and if you don't know check file is i assume
that it's a file that would be there that would tell it that it's going to do something and it
says jd jd a bootable usb flag so i thought okay what would that be so oh this might be something
that re lets me pass that bloody black screen that i had before so i've got the john deere
display updates here the 22 gigs that it downloads onto usb stick and that's my serial number and
yeah so uh yeah so we upload that into the uh usb stick um and this other one there that was
another one that i found the four three four three four one so i chucked that in there and then it
comes up with this now when i reboot the device comes up with 1.0 deal of authentication one oh
sorry system recovery version 1.1 1.2 3.1 um and it's actually boot looped at the moment because
i'm actually trying to overload i'm trying to run four different system recovery images at once
and that was actually the genuine problem all i had to do was remove two of them and the ultimate
solution was dealer auth.txt and that would actually get us to this stage which bypasses
that dealer page so yeah farmers can use that to bypass that page in the field
yeah that's it so that's the johnny deal authentication bypass you just put a text file
in there so that's dealer auth.txt you can literally do it with your phone you can otp cable
um otp cable uh you can do it out in the field you just chuck it on there that's literally if you
boot the device 10 times in a row and it doesn't i don't want to do it right now because i don't
want to use this but uh if you reboot it 10 times you'll get stuck at that page and then you then
you get that reboot thing and it's just magic you know just like um yeah so then it starts to
reinstall it starts to fix itself yeah i don't have to go for it
10-day walk to bangkok
then it comes here so we've got the full yeah we've got it back to the euler um and i'll talk
about my euler in a little bit as well so um yeah the that fully worked and then we've got logs it
sent back logs back to the usb stick that i plugged in in fact it sent back 1.6 gigabytes of
logs so it was actually logs like full you know they would just go to like cd slash and go find
and get like massive lists of all the files are in there um you know connected devices all the system
all
of the system d logs lol um just literally everything and then i had the shell back i
had the shell i could come back come back in and rs232 straight in so what we're looking at here
is the fs tab uh i thought to myself okay so why would i want to edit the fs tab okay i want to be
able to edit this stuff now so i want to modify the device that i've got this is my device i
own it it's my tractor allegedly and i want to edit it you know so what i want to do i want
to change everything to read right so obviously you can't read you know read only this you can't
muck around with them but um so i took the disk off again and i want to root the device now you
know i want to root it so um these are just connected stuff on a white listed devices eprom
which i've actually got a little bit information about shortly um that actually contains a serial
number and i'll tell you a little trick about that soon but yeah we've got a couple of things
here you know we've got real-time clock your i squared c we've got the video and two frame
buffers he's got two different types of you can have extended displays excuse me
then you've got this one here read right so the sqc
sh keys must be generated while the unit is in read write mode so an easy way to do this is
start and stop the ssh demon so this is in the john deere proprietary code allegedly um and the
ssh keys have to be done in read write so how do we get to read write mode i'm thinking okay so
i have to generate fs tab but no the only way you do it is just do mount dash over remount
rewrite slash and that's it you're in reader read write mode um so i thought to myself well every
time you do that you're gonna have to do these transactions in a different way and i was like
well you know i'm gonna use this counter and i'm gonna use that to write code but like well
all you've got to do is do all the different things and i can't do anything else but so
i know why you're going to use it right now but i really like it because it gives you that
constant kind of control um because you can see like what it does is if you when you dig into
your system like you can call in with your machine and you can see that you've got a block that says
what it's doing yeah it's doing stuff for you so that's how you use it but if you don't you can use
other things like that so if you're using a secried disk right now memory you can use a disney and it's
just going to be able to do the same thing so this is just going to be able to do this and when the
So yeah, the boot count failed. That 9999 boot count failed, obviously, but we bypassed that when we rebooted. We reflashed the device through that dealer, blah, blah, blah, and we got to the stage where we've got this little thing now where I can actually modify it, and what I did, I'll show you in a sec, this is, there's actually a command in there that I found when I was looking at the OS called reboot clear boot count.
Boot count. So I can actually reset that 10 every time now, so I've set it up now, so every time that it reboots, it clears the counter, so I don't have to worry about the reboot counter anymore, so that's quite significant.
And this is what happens when you don't solder it on properly. You can actually get these secondhand from Alibaba, because these chips are end of life as well, but you can actually get these chips from, yeah, just chopped straight out of a real board.
They're actually end of life, so you literally can't buy them anywhere else except for these places or secondhand.
And usually the secondhand ones have data on them, so.
And sometimes you've got to improvise.
This is actually a hot plate, a PCB hot plate that you can make from an iron.
It's actually quite dangerous, but it gets the job done.
This isn't mine, it's a guy that I was working with out in Eastern Europe, so he's got this one.
So this is what happens when you muck around with libSDL, and that might be a giveaway for what's happening soon, but, yeah, that's what happens.
When you muck around with libSDL, and that might be a giveaway for what's happening soon, but, yeah, that's what happens.
When you muck around with some of the graphics stuff, and I'll get into the graphics stuff shortly and why that happens.
But what I did was I added some specific thing to the cron jobs when I was playing with it, so that when it was rebooted, it would actually do this.
And we get a terminal every two minutes.
So we put a cron job, and we get a root terminal every two minutes.
It's actually root, so.
In addition, there was actually a lot of binaries missing, so I'm thinking, okay, so, you know, when you tab, tab, and it's like,
display 1,000-something more combinations, I'm like, okay, there's extra ones.
So I built a script that just gets all the extra parts, and lo and behold, there's an extra 40 binaries.
So what would be in those binaries?
Some really cool ones like chroot and reset boot count was in there as well, just the extra binaries.
All the good ones, you know, all the good ones.
So what I thought is now that I've got this SDL problem, I didn't know what the problem was at the time.
I thought, okay, let's reflash the device back to the semi-factory state.
Change the root password, add login over SSH, rewrite the disk, add a terminal like I just did, fix some UDEV rules.
And this sounds like a lot of work, and it actually was, and it didn't work, but I'll tell you about that shortly.
This is what happens when you try and change the root password.
There's actually checksums there in the bottom right.
You won't be able to read it, so I was too font, but it says checksums.
And they just checksum all of the different passwords, and I'm like, okay, well, I don't want to backtrack on someone else's brain fart
and try and figure out all these checksum mechanisms.
I'd rather just change the root password.
And you can just remove the password from the, I think it's Etsy shadow, Etsy password, and just remove it,
and then it just logs in automatically, but John Deere had something in there that defeated that.
Then we've got the FS tab.
So I actually edited the FS tab, and would you believe it, it didn't work because it was checksummed.
And this was the jailbreak that I used.
It was just out of root terminal every two minutes.
I changed it.
I put flock in front of it later.
If you know what flock does, it puts a file lock on it so you can have one instead of having like,
because this would produce 50 terminals in a row, and they just kept coming up.
And then you have to go and exit them all.
And it's touchscreen, actually, as well, so it's not fun after a while, but yeah.
So I added that onto just one of the cron jobs that were already there because I knew it was going to execute.
You've got to go with the tools you've got.
Worked out that they've actually blacklisted a couple of things, like not the Wi-Fi,
but the...
But Ethernet cables that are not Wi-Fi related, because I wanted to use an Ethernet cable without Wi-Fi,
you know, plug it in and like actually hook up to it and connect it to my computer.
Because I don't want John...
I don't want to connect to the Wi-Fi and have John Deere actually see that I'm connecting, by the way, so...
From Thailand, because it wouldn't be hard to work it out, so...
Didn't actually need to change the UDEV rules in the end.
There was a couple of little administrative control pins, 1111 was one of them, so...
This was in a DB that was in there, and this is actually the code that unlocks the stolen device.
So that's one of the negatives of having access to the unencrypted disk, which is not encrypted, by the way.
You can just read the pin.
I thought, why don't I want to... I want to emulate this now. I want to emulate this device.
I want to have a crack at emulating it. You know, John Deere's going to love that.
So this is me pulling the... adding the John Deere packages to my own Fedora.
So I added...
I just added Fedora, Raspberry Pi, same architecture, same... close enough.
And added John Deere's repo. They'll probably see my IP, but it's behind a VPN anyway, guys, so it's all good.
Thought, okay, well, let's try and emulate it, you know, QEMU and get it started, you know, IMX6.
Saw this package, had a crack at it myself, couldn't get it to work.
So I found this actually random project, got... it would get you to boot... it would actually boot a IMX6...
And with the same sort of boot... boot output, and that's the beauty of GitHub.
It's just random projects with, like, 24 stars or just, you know, three forks.
It's a tiny project. Exactly what I needed.
Shout out to Ryzen lover. I also love Ryzens.
But, yeah, this actually didn't work.
And I started to mix and match the... like, I was like, oh, maybe it works with QEMU old or QEMU 32-bit versus 64-bit.
And ended up getting kernel pan X.
So...
It actually led to getting a CVE out of it.
So I was like, oh, yeah, sweet.
But I sent that through to the QEMU project.
And they were like, we don't consider this a CVE because it's in the TCG component.
I go, okay, this is... it was...
Because I said... the email was from Red Hat, right?
I said, I don't think you understand that QEMU is not a Red Hat project.
It might be covered by Red Hat engineers, but it's not actually owned by Red Hat.
And I think NIST or MITRE would have a different opinion about the... what you classify as a CVE versus MITRE, et cetera.
So...
Well, the general...
The general community does.
So, yeah.
So that actually went through.
But...
Yeah.
The secure password hash, that didn't work either.
Yeah.
This is just farting around in the system.
Just some random code that they have there.
And I thought, okay, well, if I can't emulate it, it's just crashing the PC, why don't I just try and get a dev board and do it?
So dev boards are really helpful as well.
You can, like, get most dev boards for most architectures.
It's, like, usually, like, 50 to 100 bucks.
This is, like, 99 or something like that.
And low key, it didn't work.
So, yeah.
The reason why it didn't work is because these devices...
You know, it's IOCD right now.
I'll get stuck on this one.
But it's IOCD.
It's got all these different connectors.
You can do all these different extra stuff that you can't do with a real IMX6.
But the reason that it wasn't working was because it doesn't support graphics on the small version that I got.
But I want to talk about now is the...
Stuff that...
I don't know if anyone's dealt with NXP before.
But they have this strange tendency to extrapolate.
That's just me hooking up serial to it.
But...
And it worked as well, by the way.
It booted up perfectly naturally.
And there's this weird thing.
And this will come into what I'm just about to say.
The universal update utility.
You, you, you.
And this is where NXP is on the abstraction computer graph.
Right at the end.
Because everything they do does not make much sense, actually, from what I've tried to understand.
And...
Like...
For example...
This is a universal utility.
It only works on Linux and Windows.
And it...
Yeah.
It just doesn't work properly.
Yeah.
So you need Windows 7.
And you need to use the WinUSB.
And Windows 10 will install the drivers automatically.
And no information about Linux.
But this is apparently universal.
So...
That's just what I found with the NXP system.
Or I would say the word would be...
Atmosphere...
What's the word for it?
Environment.
It worked.
Yeah.
No graphics on the IMX6 ultralight.
And I'll tell you why.
This is the QT mailing list.
Welcome to the hell that is 3D and QT.
And...
The reason...
One of the reasons why in 2017 QT Co. went into a non-GPL style model, which I'm sure most people are aware of, is apparently because they could make more money in the short term by locking in John Deere and others into subscription models.
So I'm not sure if anyone's blood is boiling at the moment.
But...
I was quite surprised to read that.
Because I thought QT just naturally went into a subscription based model.
And of course John Deere was apparently allegedly involved with some of that.
And the reason was that he could get tractor animations in 3D.
It's literally...
Yeah.
The reason why...
One of the reasons why QT went private per se.
So another guy I was speaking to...
Well, I couldn't get onto him actually.
But...
He runs IMX6 Rex project.
Robert Ferenac.
Ferenac.
Yeah.
He's a cool guy.
I think he does.
He's a Altium hero.
But yeah.
He's an awesome YouTuber.
And he covers all sorts of like stuff that I fancy.
But I didn't actually know.
But he actually started a project called IMX6Rex.com or something like that.
And he actually had one there.
But I thought, hang on.
Let's just pump the brakes here.
Because...
Going a bit off topic.
Why don't I just put the freaking thing back on the board and try and root it.
Because all this emulation and dev board stuff.
I was barking up the wrong tree.
Nothing was working.
And I've got a perfectly good device here.
Why don't I play with that?
So if you have a look right there.
See the little eight-legged thing next to the chip that's supposed to be there?
That's the EEPROM.
And it's actually an STMicroelectronics EEPROM.
And that's what it looks like when you hook it up to a little dev board.
Don't worry about those labels.
This is just me like...
I guess the word is like just yoloing it.
When you run out of things to like...
You just hook it up to whatever you've got.
And that's kind of what hardware hacking is all about.
It's just like picking up stuff that you've got.
And just like using staples sometimes.
And like, you know, cutting wires out of remotes.
Instead of, you know, just chopping up shit in the house.
This is what the pinout looked like.
And they use all these weird characters.
But anyway, I found this really cool project by this guy.
Really tiny project.
But it actually lets you read from that EEPROM.
Don't worry about that.
That's just...
That was me working on that thing.
But yeah.
So, I manually read out each line of memory.
And worked out that it actually reads out the serial number.
But I actually just realized that if you put the device in just a cat dev EEPROM,
it actually gives you that as well.
So, I just did this for no reason.
So, time to chuck it back on the board.
You get root terminal.
This is the home stretch, by the way.
We're almost done.
Am I going overtime or under time?
Yeah, that's right.
So, yeah.
The root terminal is sufficient.
And now it's time to read trivially, remount the OS, boot the partition, get rid of the
file, FS tab stuff, make sure it's not checksum change, all this crap that they've put in
there to make it difficult to fuck with.
We just want a root terminal.
So, that's what it looks like when it's nice and just rooted.
And it should be rooted right now.
Yeah, there's a rooted John Deere right there.
It's jailbroken.
You can edit files.
You can remount.
You can delete stuff.
You can accidentally delete everything.
You can add stuff from USB.
You can like add, you can plug Wi-Fi in as well.
You can put it like a, you can do anything with it.
It's a full blown Linux computer.
It's a beauty.
John Deere doesn't like it though.
So, yeah.
Your root as well, by the way.
So, everything's running as root, which is even better.
Yeah.
WinRiver 8.
Kernel 4.4.
4.1.
4.2.
Probably one of the long-term ones.
Hasn't been updated for a while.
I think that's local time, 2022 UTC.
But I actually noticed actually John Deere was using, I don't know if this is common
or something, but they were using whatever time it was, the central standard time for
all the things.
So, everything in the office would actually be the same time as what was in the field.
So, yeah.
This is actually, that's a rooted John Deere.
That's the flagship display, by the way.
Look here.
Just showing John Deere for what I remember.
Yeah.
So, how do we exploit this?
How do we get this done without taking off the board?
Like, how do I get this done repeatably?
Well, you can just build a little clip that just goes in the back and touches those pins
that I showed you earlier and it'll just like jailbreak it for you.
You can actually just jailbreak it without even using USB.
Because USB, when you think about it, is just plus, negative, or, you know, VCC and ground,
which is the same thing in some cases.
And then you've got D plus and D minus.
That's all you've got in a USB stick.
You've still got the four little things in there, right?
Well, this is five.
Five pins.
We're not coming in over a port.
We're going in over the back of the chips.
You just have to take it off the board.
Same thing as touching it on the board.
But, you know, is there a difference between coming in with a USB exploit versus just
clipping it on with a pogo pin connecting thing on the back of the board?
And that's what those little things look like.
So, you can get these little PCBs that you can print out and just get them like, you
know, toggled onto the board.
And that's what it looks like hooked up to one of the terminals they've got on the board.
There's JTAG there, but I think it was off.
I didn't actually go too hard into it because I've had bad experiences with that many pins
and that many pads.
When you hook that up there, you get actually this weird boot loaded terminal.
It's not U-Boot or anything.
It's just some weird diagnostic thing, but there's not much exciting stuff in there.
But it lets you know that the device is alive.
So, these are cool little devices you can get.
They're not devices.
They're like expansion packs, I guess.
So, that's it.
So, that chip that I showed you earlier, we're not going to go back to it, but it's
100 balls.
I think the one that's flipped over actually is 100 balls.
But the third one across, EMMC 153, that's actually found in most mobile phones and literally
like every device in the current brand of devices.
You know, some older Androids have the top left one.
And as you can see, the buses on the, where is it?
If you go to the second one and see the bottom, it's got D0, ground clock, VCC, and command.
So, you only need those one, two, three, four, five pins to connect to the device.
And that's where that would come into play if I was doing that to export it.
I'm actually working on that low-key, so I don't tell John Deere, though.
Yeah, it accepts this Wi-Fi stick.
We've got just like the stock standard WN, whatever it is, 7025N.
It's like literally everywhere.
You've probably got one in your pocket.
I think I do as well.
But yeah, that actually starts wireless.
People were telling me while I was making it.
There's no wireless.
There's no wireless.
All the wireless is off.
And I'm like, until you actually try it and like put a wireless thing in there and like look at the wireless settings, it actually does have wireless.
So, believe it or not, don't believe what people tell you as well sometimes.
Maybe sometimes, maybe I've told you something is wrong.
But just go with your gut.
So, that was a fail because it wouldn't help.
But what I did found out as well, by the way, is over the automotive Ethernet bus, which I haven't gone into,
it actually starts a server.
It's a server on there.
But that's just the same as if you were doing it via Wi-Fi.
So, I'll think about it a few minutes here.
But these are some of the cool commands.
We've got reset boot count, reprogram config.
By the way, this is $7,000 display when there's like 20 grand worth of licenses when you get it running.
But you can just reprogram it now yourself.
So, we've got can dump.
We can play with some of the CAN bus addresses.
You know, you can edit the config.
You can dump all the CAN coming in.
You can send CAN messages.
You can sequence CAN messages and some grand finale stuff.
So, I want to show you a little bit of a demo.
So, this is what happens.
You remount, reroute.
Let me just make sure.
Hold on a sec.
Yeah, sorry.
I don't think I'm all right.
So, mount, remount, whatever.
And then bang, you've got read write.
Actually, what I found out as well is if you unplug the display, it comes up with the black screen.
But there's actually X is still running.
So, the terminal still pops up that I had there earlier.
But it comes up without the beautiful green and yellow Windows manager by John Deere.
And that's the jailbreak.
It's literally just added terminal to pop up every two minutes.
And then set it to remount.
And the only way you know that, though, is if you pulled the disk off and had a look at it and edited it.
There's a demo video there.
And I'm about to show you the demo video.
So, give me a tick.
What have we got?
I may have just spoiled it.
Oh, yeah.
Here we go.
How do you do?
F11.
What the fuck?
Windows shit.
Double click, right?
Oh, there we go.
Yeah, this is a little demo.
I don't think there's sound.
There's like party music in the background because I just, you know, a bit of suspense.
So, chroot was one of those commands.
It was beautifully in there.
I don't think there's any extra parts.
And you'll see what happens in a moment.
So, that's actually Tractor Edition Doom.
So, you can actually mow corn.
It's a bit of overkill.
I thought we'd have a crack at it.
But there was actually a lady in New Zealand that helped me design this mod because we,
yeah, you can actually mow corn.
It counts as a health bonus.
And this one I think is an armor bonus, corn.
So, yeah.
The other one was wheat, whatever.
But, yeah, you can hunt down the pinkies, the demons, little piglets.
But they're demon piglets.
So, don't worry about it.
But, yeah, we spent a bit of time on this one.
Her name is Skelligant.
And she's a mad Doom modder.
But, yeah, that's Doom on the phone.
She's on the farm.
So, yeah, it's actually epic.
So, that's on a John Deere.
That's John Deere Doom on a John Deere Tractor display.
So, yeah.
And I think that was it.
Yeah, that was the original mod that we were going to use.
And let me just see if I can full screen this.
I'm not even going to try.
Oh, there we go.
Yeah, that was the original one that we were going to use.
But it didn't, it wouldn't run on non-GPU accelerators.
Because that's GZ Doom.
And for any Doom people out there, they'll know the difference between GZ Doom, Chocolate
Doom, LZ Doom, QZ Doom, whatever it is.
And there's just so many different types of Dooms.
But the one that actually worked on this one, you can come and play it, by the way, as
well, if you want to come play it after, yeah, Chocolate Doom worked.
And this one edited it.
But I actually hadn't asked you if I could edit it.
And then, you know, Doom's a bit, you know, like you want to keep the spirit of the mod,
the WOD file they're called.
But it wouldn't run without GZ Doom.
And then, yeah, I reached out to Skelligant and Amy.
She's a cool chick from New Zealand.
And she, yeah, helped me make that awesome demo that I just showed you.
So, yeah, big thanks to her.
Gusutech Brazil, last person, Alex the Kangaroo, I'm not going to comment who he is.
Kevin Kenny, Johannes from AgriGPS, Vlad, Alex, Mauro Dudas, Alex, Alex, Joe Grand,
what's his name, Paul Robertson, Paul Roberts from Security Ledger, and I think there's
one other boy, Carl Weans.
Carl Weans.
Big Ops.
Special Ops.
Thanks.
.