A New Jailbreak for John Deere Tractors Rides the Right-to-Repair Wave

Farmers around the world are using tractor hacking to get around the digital locks on their cars. Farmers can modify and repair expensive equipment that is vital to their work, the way they could with analog tractors, thanks to this technology. At the DefCon security conference in Las Vegas on Saturday, the hacker known as Sick Codes is giving a presentation that will allow him to take control of multiple John Deere & Co tractor models through their touchscreens.

The security implications of right to repair are underscored by the finding. The tractor exploitation that Sick Codes uncovered isn't a remote attack, it's a fundamental vulnerability in the devices that could be exploited by malicious actors or potentially chained with other vulnerabilities. The agriculture industry and food supply chain need to be secured in order to survive. There are vulnerabilities that help farmers do what they need to do with their own equipment.

John Deere didn't comment on the research.

Sick Codes, an Australian who lives in Asia, presented at DefCon in 2021. Some of the flaws were fixed after he made his research public. He says the right-to-repair side was against what he was trying to do. One guy sent me an email and said, 'You're fuck up all of our stuff!'. I wanted to prove to farmers that they can root the devices.

Sick Codes is concerned about world food security and the exposure that comes from vulnerable farming equipment, but he also sees value in letting farmers control their own equipment. He wants to liberate the tractor.

The movement has reached a turning point after years of controversy over the right to repair equipment. The Federal Trade Commission was directed by the White House to increase enforcement over practices like voiding warranties. With New York state passing its own right-to-repair law, the movement has gained unprecedented traction. John Deere said in March that it would give more of its repair software to equipment owners. The enhanced customer solution will allow customers and mechanics to download and apply official software updates for Deere equipment themselves, rather than having John Deere apply the patches remotely or force farmers to bring products to authorized dealerships.

Sick Codes says that farmers prefer the older equipment because they don't want things to go wrong at the most important time of the year. We should all want that as well. Being able to repair or make decisions about the software in their tractor is something we want farmers to be able to do.