At long last, a true jailbreak technique for John Deere tractors exists. On Saturday, a hacker known as Sick Codes took the stage at the DefCon hacking conference in Las Vegas and broke into a John Deere tractor console. The first order of business? Running a farmer-themed version of Doom.
Playing Doom on a John Deere tractor display (jailbroken/rooted) at @defcon pic.twitter.com/ih0QUTGNuS
— Sick.Codes (@sickcodes) August 14, 2022
While running Doom is cool in a “for the memes” sort of way, Sick Codes’ hacking of John Deere systems represents a milestone in the “right to repair” race. Right-to-repair is the concept that owners and independent repair professionals should have access to everything needed to fix a piece of equipment, such as a mobile phone, a tractor, or a car. If you’re a car enthusiast, you should be interested in right-to-repair as it’s a principle that offers you the choice of an independent specialist over a dealer, and allows you to fix your own vehicles. Ongoing efforts are being made to turn right to repair into law, and I really hope they succeed.
So that’s right-to-repair in a nutshell, but you may be wondering what tractors have to do with cars. Well, embedded systems are present on just about every new car, and the nature of end-user license agreements means that you don’t actually own the embedded systems in your modern car. Preposterous, right? The same thing that’s happening to John Deere owners could eventually happen to car owners, which seems absolutely insane. If you own a car, you should own 100 percent of it, no matter what BMW thinks. Because John Deere doesn’t believe that its customers own 100 percent of their tractors and that customers license John Deere’s embedded software, the company has previously severely restricted who can repair John Deere products, to the point of costing farmers days of downtime while waiting for authorized repair professionals. So what justification does John Deere have in restricting access to repair tools? Well, John Deere made a statement to the Des Moines Register in March that doesn’t seem to hold up to scrutiny.
But the company added that it “does not support the right to modify embedded software due to risks associated with the safe operation of the equipment, emissions compliance and engine performance.” The company said less than 2% of required repairs involve those components.
That’s an incredibly small number of repairs involving emissions and safety equipment, and it’s important to note that these are genuine repairs. Farmers are looking to fix their tractors and restore factory functionality, but they don’t have full access to repair tools like diagnostic equipment. Sick Codes’ jailbreak attempts to correct that.
There is one caveat to getting into John Deere tractors: Wired reports that Sick Codes’ method requires modifying the touchscreen console’s circuit board. However, a bench procedure might not be the end of the world depending on where customers are located. Tractors used for agricultural purposes in climates that experience four full seasons may see enough idle time in the winter to justify a few days of downtime. In addition, farmers far from John Deere dealerships could justify the modification’s downtime based on how long it would take to simply get a tractor to and from a servicing center.
However, once the exploit is installed, farmers can pull up a terminal and gain access to what Wired reports to be more than 1.5 GB of logs. If you’ve ever had your car tuned remotely or attempted more advanced diagnostics on a modern car, you’ll know how valuable data logs are. Everything from fuel trims to ambient air temperature can be saved and analyzed, perfect for picking up unusual issues and narrowing down culprits from a simple code scan. In addition, this isn’t just some sort of diagnostics mode. Sick Codes’ method allows root access to the console. Speaking with Wired, Sick Codes seems to feel that this exploit is one that could actually last.
He’s unsure how comprehensively the company can patch the flaws without implementing full disk encryption, an addition that would mean a significant system overhaul in new tractor designs and likely wouldn’t be deployed in existing equipment.
Here’s to hoping that this method won’t be patched out soon, especially since it was time-consuming to develop. Sick Codes told Wired that the process took months of trial and error using multiple John Deere consoles. Sick Codes focused on the popular 2630 and 4240 display models, found in a wide variety of John Deere tractors. It’s worth noting that these consoles can be seriously pricey, with used 2630 systems clocking in around the $10,000 mark.
Sick Codes has jailbroken a John Deere, and this is just the beginning. Turns out our entire food system is built on outdated, unpatched Linux and Windows CE hardware with LTE modems. pic.twitter.com/OLDBckluxr
— Kyle Wiens (@kwiens) August 14, 2022
Kyle Wiens, CEO of iFixit, was at DefCon and reports that John Deere’s systems run on a hideous mash of unpatched Linux and Windows CE hardware. Shitty Windows CE implementations aren’t exactly uncommon – the first generation of BMW’s iDrive used Windows CE – but they have all the security of the average Master Lock. Windows CE as an operating system reached end-of-life in 2018, meaning that years have passed without official support on the OS. Without regular updates, end-of-life operating systems rely on the same philosophy of security through obscurity as any cheap padlock, and things can only remain obscure for so long.
Tech journalist, author, and activist Cory Doctorow was also at DefCon and reports that not only does John Deere misuse open source software contrary to license agreements, he’s also claiming some shocking issues with John Deere’s information security.
Sickcodes discovered all kinds of security worst-practices in John Deere’s security – even in the parts of its security that were intended to secure the company’s profits from its own customers’ best interests. For example, at one point Sickcodes put the control unit into maintenance mode by repeatedly rebooting it, so that it refused to allow him to do anything until he brought it to a dealer. He discovered that all it took to convince the computer that he was a dealer was to create an empty text file on its hard-drive whose filename was something like “IAmADealer.txt” (I didn’t write down the exact filename, alas, but that’s not far off!).
Pretty absurd, though unsurprising given that John Deere has been staunchly anti-right-to-repair, parading around what seems like monopolistic greed under a thin paper mask of “security.” Politico reports that John Deere has gone so far as to restrict access to emissions system diagnostics, prompting a suit that claimed John Deere was in violation of the Clean Air Act. Restricting repair access only hurts farmers, which in turn hurts the public, as downtime can affect food supply. John Deere is slowly making some tools available, albeit not in a way that anyone can actually own. According to John Deere, access to technical manuals is on a license basis, which brings up concerning questions of down-the-road support.
I’m glad to see hackers sticking it to the man by offering solutions to make vehicle owners’ lives easier, even if these solutions aren’t necessarily the most law-abiding things out there. Would Sick Codes’ method of getting into a John Deere console violate the end-user license agreement? Most likely, but legality doesn’t always equal morality.
Do you suspect your spouse of cheating, are you being overly paranoid or seeing signs of infidelity…Then he sure is cheating: I was in that exact same position when I met James through my best friend Grace who helped me hack into my boyfriend’s phone, it was like a miracle when he helped me clone my boyfriend’s phone and I got first-hand information from his phone. Now I get all his incoming and outgoing text messages, emails, call logs, web browsing history, photos and videos, instant messengers(facebook, whatsapp, IG etc) , GPS locations, phone taps to get live transmissions on all phone conversations. if you need help contact his gmail on shadownethacker44@ gmail com
I know and can recommend a very efficient and trustworthy hacker. I got his email address on Quora , he is a very nice and he has helped me a couple of times even helped clear some discrepancies in my account at a very affordable price. he offers a top notch service and I am really glad I contacted him. He’s the right person you need to talk to if you want to retrieve your deleted/old texts,call logs,emails,photos and also hack any of your spouse’s social network account facebook,instagram,telegram, tiktok,messenger chat,snapchat and whatsapp, He offers a legit and wide range of hacking services. His charges are affordable and reliable, This is my way of showing appreciation for a job well done. contact him for help via address below..
Email : wisetechacker @gmail com
I’ve been a victim of infidelity and I can tell you vividly that it hurts, and worse if you couldn’t get an evidence to proof your sanity. Even though I have discourage my friends severally about hiring a private investigator to catch their cheating partners, I resorted to hiring one before my divorce. My partner hid her affair too well and I had no evidence to prove her infidelity to the court so I had to go back to my friend who I’m grateful for referring me to the review about a private investigator who he worked with on (wisetechacker @gmail com), I told them the service I’m needing from them and why I need it. Their services were topnotch which made working with them very easy, they got me everything I needed within few hours and it was amazing. I never knew technology has been so advanced that I can see everything wanted at the tip of my fingers (forgive me I’m not a techie and neither am I good at it), with their exceptional service, I was able to convince my lawyer on why I should get a divorce and start a new life.!
It’s good to see some comments from knowledgeable people. This absolutely isnt a one sided issue.A solid percentage of farmers would delete emissions systems and believe they are doing the world a favor.
Not taking JD’s side of course.At the very least they need to make diagnostics open source! And kick them with an anti trust suit for good measure
Have you been around farmer maintenance? These guys will wire up, weld and bolt and clamp anything to get through the season. Then, since it worked this year, fugettaboutit. Admirable, maybe, but not on leased equipment, which it mostly is. Lessors deserve some respect.
IIRC hackers in Ukraine have owned John Deere firmware for at least a couple of years and have supplied it for $ to other countries. I know of examples being used in Alberta, Canada to repair tractors.
I went looking for more current info and came up being flooded with pictures of green and yellow tractors salvaging tanks.
I’m probably missing a larger part for the technology here, but if the problem is the HMI. Can’t someone just make an aftermarket version?
I work in industrial automation and robotics and we have many machines where we are locked out of the PLCs. So we just take a generic Allen Bradley touch screen and adapt it to work.
Granted we are still locked out of some functions, and sometimes we need to jump a few chip pins to bypass the security. But the $2-3000 we spend is much less than the $15-20k the manufacturer would charge us for basically the same thing.
I’m in favor of this sort of thing, but I’m not sure how much it actually helps farmers. Surely John Deere will revoke any warranties or service agreements that might otherwise apply to the equipment, if they find out you’ve done this. The legality of that may be somewhat dubious, but JD seems fine with doing dubious things and then making farmers fight them over it in court.
What a fucking mess. The name John Deere used to mean something.
Not sure what, but it was something.
Unbelievable but Truth!! Before my wife and I were able to reconcile, Fighting to reunite our marriage almost led me to frustration and unhappy life experience. All thanks to Supremacy Love Spell on Facebook for his spiritual support and reconciliation prayers. WhatsApp +27638690967.
One could reasonably ask why does John Deere lock down its equipment when competitors do not? I’m sure Case, New Holland and Fendt are equally concerned about safety and emissions yet nobody feels the need to jail break them.
Serious question, as this has been a story for years, even decades I’m pretty sure, about JD. Why haven’t farmers jumped brand to something else? Is their stuff that much better than another tractor company that the repair hassle is worth the gamble it won’t break? Or are other companies doing the same thing, we just hear about JD because they are so common?
when i say “some stupid flat brimmed vape addict cut me off in traffic”, you likely think subaru wrx.
same deal here. john deere to the general public IS farming.
My understanding from the last deep dive on this I read is that they just have a much better portfolio of the kind of equipment North American farmers want to use. Most of the other major brands have historically been more focused on the European market, and their machinery is optimized for the somewhat different methods that tend to be used over there. That, plus the fact that if you’re deep in the John Deere ecosystem there are significant costs to switching, means that a lot of farmers are somewhat locked in.
Nothing runs from your right to repair your own property like a Deere.
Just as a small aside, I had a chuckle when they proclaimed this fix faster than waiting for the tractor to go in to the dealer for service.
At least in the midwest, outside of repairs involving shop equipment too large to be mobile, it’s all done in the field. If memory serves we’ve had exactly 1 repair in the last decade that involved the tractor going in, because the 4WD blew up its rear axle.
I’m chalking it up to non-farm reporters covering farming. The rest was just fine, and a fun read.
In my experience as an Ag mechanic in Australia, we had plenty of farmers who’d drive their machines in, in the months before the harvest we’d regularly have 5 or 6 headers in, anything from regular services to more thorough overhauls.
one bloke drove his recent model case magnum 250, with the dual tires on, something like 60km to the workshop to get a rear linkage and some safety equipment installed (that did require some fabrication, though not with anything that couldn’t have been carted out on the truck).
That difference may just be the fact that I worked at a small independent place, or that farmers here don’t work on such a massive scale.
I’m pretty sure that Grand Am is Ethan Tufts’ – who has an enjoyable youtube channel: https://www.youtube.com/watch?v=D-ItatlUVHQ
Remember when companies existed to fill a market need and serve their customers?
Good times.
Aaaand I commented on the wrong article. Nevermind
I don’t. Remind me again when that was? Some Sunday in 1759 between 4am and 5am? 🙂
There is some truth to the John Deere defense, in that people absolutely would remove emissions and safety equipment if they could do it easily, modify the emissions and safety equipment. A pro “emissions delete” stance is almost required for entry in farm country. That being said, these are work tools and the majority of people who invest in these machines need reliability, and so rolling coal to own the libs probably isn’t their top priority.
Locking out consumers from diagnosing and repairing issues isn’t modding and in that instance, there is NO reason an owner should be prevented from at least knowing what the problem is if the computer system can tell them. Locking out diagnostic information is 100% revenue protection and has nothing to do with safety or compliance and there is ZERO excuses for it.
If they were willing to meet a least a little in the middle and say “yeah, you need authorized parts for certain repairs, but we will allow you to see and read the diagnostic codes” that would be one thing, but hiding the diagnostic and data logs? That protects no one but Deere and they know it.
And the thing is that it’s already been proven to work in the car industry. My understanding is that the emissions software on modern trucks is encrypted to prevent delete mods, but you can still plug an OBDII in to pull codes, or if you have the right scan tool you can get all the super secret manufacturer-specific stuff (that should probably also be in OBDII, but that’s a whole other argument).
Rolling coal while sowing your fields, Murica’!
Emissions equipment costs money, though. Deleting it can (somewhat ironically) improve fuel economy, as well as eliminating the need to buy DEF or worry about that pesky particulate filter. I’m 100% in favor of emissions equipment, but I can definitely see farmers wanting to ditch it if they can. Mind you, the way to prevent that is not to lock them out of their own tractors.
Oh, I agree there are legit compelling reasons to do emissions deletes. removing them can increase longevity, increase fuel economy or bypass failures. Farmers aren’t dumb with their money and they will do what makes financial sense…but they also need to be prevented from letting their business interests wreck up the place. Good for one isn’t good for all, which is why emissions and safety equipment is mandatory. Im 100% okay with forcing people to comply with emissions, even if it hurts their wallet a little, but this isn’t really about that in the end. This is “company store” 2.0.
If John Deere were serious about ‘security’ they would hire Sick Codes, or someone like them, to properly secure their platform against all attempts at modification and intrusion. They will never do this though because it would cut into profits, and the profits are the real motivation behind these actions.
Stories like this are of definite interest to me. Although I live in the city and have absolutely nothing to do with farming besides buying the product, I know that I have family in the middle of Canada who are farmers, and this would definitely affect some of them.
I also find it odd that John Deere, an American company and one that many farmers and workers support would have such an anti-do it your self approach. I wonder who dreamed up this “solution” in the first place?
Also of note. It seems like 2010ish was when Deere implemented this strategy.
My understanding is that during/after the Great Recession they started pulling dealership licenses for anybody who wasn’t churning $50M gross a year, and part of the way that they convinced a bunch of dealerships to consolidate was by guaranteeing them more service calls. Small dealership/repair places across the country got axed by Deere pulling their franchise licenses so that the big boys could eat.
That’s hardly a surprise. Many of the most staunchly American, pro-capitalist entities are the same ones who beg or bribe for protectionist rules and laws to be put on the books, to insulate their own industries and businesses from natural consequence and competitive patterns.
Rules for thee, but not for me…and all that.
Let’s not forget every union out there requiring an union electrician to take 4 days to change a light bulb. Or UAW and the new ev credit requirements. Everybody is greedy.
The UAW is absolutely awful; agreed. I’m pro-union, but that particular organization needs to be burned to the ground, and the earth beneath it salted.
Economic rents and monopolistic power are as American as apple pie
JD is a publicly traded company and constantly has to come up with ways to make more money to satisfy shareholders and pay executives large sums of money. Customer loyalty….who needs it.
Making Farmer Bob pay an official JD technician to come out and do basic service instead of doing it himself is just another income stream.
“constantly has to come up with ways to make more money to satisfy shareholders and pay executives large sums of money. Customer loyalty….who needs it.”
That’s what happened to Boeing who used to be operated by the engineers and executives who worked closely with engineers and quality control inspectors until the merger with McDonnell Douglas in 1997. After the MDD takeover of executive board, the Boeing’s “new” mission was exactly what you described. Consequently, the problematic battery and quality control issues in 787 that grounded the plane too often and culture of secrecy with MCAS and 737 MAX that killed 346 people and led to the massive fraud charge.
“Downfall: The Case Against Boeing” is an excellent documentary film.
i live south of chicago. one of the few benefits of the area, i know a lot of farmers.
when most people think ‘farmer’, they think of ma ‘n papa farmers. independent families working 100 acres with 1 tractor and a pickup truck.
the reality is that there are a lot of independent farmers. but none of them are buying new john deere equipment. they’re the ones at auctions, buying the 1980’s equipment that still bolts together.
the true new-tractor customer of john deere is the commercial farmers. the corporations that own thousands to millions of acres, running dozens of their own privately owned semi trucks during harvest season.
these customers drive luxury cars that are never more than 2 years old. they DON’T want manual transmissions. they don’t care about ease of repairability. they don’t repair their own gear. they sign a service contract, and make it someone else’s problem, preferably with a loss of profit cost adjustment so it’s someone else’s problem, and they still make money when it breaks.
it’s a critical distinction no one really seems to be making.
no one complains that a $90k lincoln navigator doesn’t come with an option for manual locks, windows, and a 3-speed column shifter. john deere sells to that kind of market, so it’s really time to stop complaining about their market categorization
That is certainly not how it works where I grew up (Central KS). There is very little commercial farming there, and the family owned farms are typically ran by two generations at most, and they buy this high-dollar equipment so they’ve got tax write-offs and to show why they need to be subsidized. Some of these families are LOADED. Many of them applied for and received 5-6 digit Covid relief checks as well, and some had multiple members of the same family filing for Covid relief for the same farm (father, mother, sons, son’s wives, etc. (it’s all public info).
Awesome..
I’d say that John Deere should go before congress to explain all this but the congressmen would probably just gush about how much their kids/grandkids “love that Farmville game” and then forget why they hauled them in to begin with.
Someone once told me that John Deere is the Harley Davidson of Tractors.
From a corporate goon stand point right? Because I don’t think the tech needed to fix a Harley has changed in 130 years..
Yeah, and the culture/merchandising aspect is remarkably similar. Just like with H-D, you can buy all sorts of random J-D branded crap. I had a cousin who had actual green and yellow Christmas ornaments that he got from a dealership. Pocket knives, can coozies, golf balls, beach towels – all sorts of stuff with the logo on it.
Everything but the an actual tractor? John Deere. Cosplay for want to be farmers. Just like every Harley Davidson ever sold after 2005.