Dive Brief:
- The FBI issued a "Private Industry Notification" on Tuesday to warn carriers about the possibility of cyberattacks and hacking, done through ELDs. The FBI warned "cybercriminals" could look for weaknesses in ELD security. ELDs became mandatory for most carriers on Dec.16.
- The concern is that ELDs link vehicle components and wireless data transmission, allowing some components to be accessed remotely through wireless means or Bluetooth. ELDs use cellular connections but can also use satellite, Bluetooth or cables, connected to smartphones or tablets.
- The FBI urged carriers to lower the risk of cyberattacks by contacting the ELD manufacturer or supplier before using a system to ask about its security.
Dive Insight:
The FBI's warning comes as carries experience cyberattacks. How hackers entered the carriers' systems is unclear. A cybersecurity expert recently told CIO Dive hackers and criminals use different types of malware to infect devices and crack passwords.
"Imagine that someone has access to your Gmail, Hotmail or Outlook account, which is your personal account, Alberto Casares, VP of threat research at 4iQ, told Transport Dive sister publication CIO Dive. "You probably have that linked with your bank, so ... getting access to one email account, that could mean that they have access to all your features."
The FBI recommended carriers review the FMCSA's cybersecurity white paper, issued in May 2020. In that paper, the FMCSA had this dour outlook on ELDs: "Security is often overlooked during the software development and hardware design process. In highly competitive markets, engineers often focus their time on implementing new features and shipping products rather than securing them."
One reason is the coding, the FMSCA wrote: "While modern languages have eliminated or reduced some common classes of errors, many embedded systems contain older, more error-prone languages." These languages can be exploited by hackers.
The FBI recommended asking these questions in assessing ELDs:
- Were technical standards or best practices followed in the device's development?
- Does the component protect confidentiality and integrity of communications?
- Has the component had penetration tests performed on it?
- Does the device have secure boot?
- Does the device ship with debug mode enabled?
During a Q3 2019 earnings call, Roadrunner officials spoke of a ransomware attack in September. The attack caused a $7 million expense in that month, with another $3 million in October, according to CEO Curt Stoelting. The ransomware, which asks for a payment before systems are freed from the malware, affected freight visibility.
Also that fall, Petroleos Mexicano got hit with a ransomware attack. Hackers demanded a $5 million ransom. And in June 2019, A. Duie Pyle, a LTL carrier, got attacked by a ransomware attack. The carrier refused to pay the ransom, and managed to get back online within days, but had to rebuild its applications, according to Freightwaves.
