Research exposes alarming cybersecurity vulnerabilities of ELDs

Tyson Fisher

New academic research reveals how vulnerable ELDs are to cyberattacks made by hacking into a truck’s system in seconds while driving alongside it.

Jeremy Daily, associate professor of systems engineering at Colorado State University, is no stranger to truck cybersecurity. He co-founded the CyberTruck Challenge in 2017 and has published numerous research papers related to the topic. However, his latest research exposes an alarming truth: Some electronic logging devices are easy to hack.

Along with research assistants Rik Chatterjee and Jake Jepson, Daily wanted to know how the ELD mandate affects cybersecurity for trucks. The researchers found they not only could access a truck’s accelerator pedal by simply driving by it but also could infect a fleet of trucks with malicious malware by hacking into just one ELD.

For this experiment, Jepson was able to take apart an ELD and do some reverse engineering. He found the default Wi-Fi password right away and from there spent several months developing a malicious version of the ELD’s firmware. Jepson told Land Line Now that this was his first time reverse-engineering a device and admitted a more experienced hacker likely could exploit vulnerabilities much faster.

The researchers’ next task was to infect a truck – which proved remarkably simple.

Equipped only with a laptop and Wi-Fi range extender, they drove alongside a moving 2014 Kenworth T270. In just 30 seconds, they were able to access and infect the truck’s ELD with malicious firmware that allowed them to slow the truck down. Chatterjee, who was driving the Kenworth, said it would not speed up no matter how hard he pressed down on the pedal.

In this scenario, the researchers decided to slow down the truck for safety reasons. However, they just as easily could have forced the truck to speed up. And with access to the truck’s operating system, a hacker could access other functions, as well.

As if hacking one ELD were not bad enough, Daily and his team were able to infect several trucks by initially infecting just one.

The malicious firmware included what the researchers called a truck-to-truck worm. An ELD infected with this firmware can scan for nearby ELDs. Once a vulnerable one is identified, the truck-to-truck worm can spread the virus. The newly infected ELD then can repeat the scanning process, increasing the range of viral spread. This process can allow a hacker to infect an entire fleet of trucks that are close together, making truck stops, rest areas and yards prime targets.

ELD technology and regulations

Although only one brand of ELD was used, the researchers pointed out that manufacturers are using similar technology.

There are hundreds of certified ELDs available, but the research paper reported that there are relatively few distinct models. Essentially, companies are rebranding ELDs, rendering devices “clones of each other with minimal variations,” according to the study. Consequently, vulnerabilities present in one brand of ELD may be present in many others as well.

Another point of concern is the lack of regulation regarding ELD cybersecurity. Devices must meet technical specifications before registering with the Federal Motor Carrier Safety Administration, but manufacturers need only to self-certify.

The National Motor Freight Traffic Association has issued a list of recommended security requirements for ELDs. However, those recommendations appear to be largely ignored.

“I can say very confidently that if that guidance had been followed from the industry, then we wouldn’t have been able to demonstrate these exploits that Rik and Jake developed,” Daily told Land Line Now.

The researchers reached out to the ELD manufacturer before publishing the research. Daily said the manufacturer worked with him and his team to develop a firmware patch addressing the vulnerabilities.

What can truckers do to secure their truck?

There are measures truckers and fleet owners can take to mitigate any cybersecurity vulnerabilities.

First and foremost, truckers need to keep their ELDs updated. Like smartphones, ELDs may require periodic security updates that could include patches for newly discovered vulnerabilities. And if truckers have access to the device’s Wi-Fi password, they should change it to a stronger one.

Daily also believes in the power of the free market. If those in the industry – especially large fleets that buy in bulk – purchase only highly secured ELDs, it will force makers of less-secure ELDs to sink or swim.

The good news is that the industry has responded well to cybersecurity concerns in recent years. The truck used in this experiment was a 2014 Kenworth, a 10-year-old truck. In the past decade, truck manufacturers have improved security measures within their systems. Click on link below to see video.

https://youtu.be/SwtTzk9ys20

The 19 trucking regs expected by year end

With the White House’s release of an updated Unified Agenda of projected timelines for a bevy of new and in-progress regulations across the entire federal government, the trucking industry gained some insight about when to potentially expect numerous regulatory updates.

As reported earlier this week, some of the most-anticipated regulations coming from the Federal Motor Carrier Safety Administration — broker transparency, automatic emergency braking, English language proficiency — are slated to be released this month.

Others are a little farther out on the calendar, projected to release as late as November.

The National Highway Traffic Safety Administration’s also working on a number of rules that could impact trucking by greasing the skids for autonomous trucks.

Yet, outside of those more notable regs, there’s 19 others expected to see publication at some point this year, though missed deadlines are not uncommon with regulatory agendas as the dates provided are just projections.

Below, find a brief summary of rules on the docket, sorted by where they are in the regulatory process — final rule stage, supplemental notice of proposed rulemaking (NPRM) stage, or NPRM stage.

Final rule stage

• Independent contractor status under the Fair Labor Standards Act, Family and Medical Leave Act, and Migrant and Seasonal Agricultural Worker Protection Act: The latest in the regulatory whiplash over what constitutes an independent contractor or employee classification, the Department of Labor is planning to publish a final rule by the end of October that potentially reverts the classification standard back to the rules established during the first Trump administration.
• Accident reporting — Modification to the definition of the term “Medical Treatment”: Among the rules FMCSA deemed to be “burdensome” in the Trump administration’s deregulatory efforts is this one to amend the Federal Motor Carrier Safety Regulations regarding medical treatment away from an accident scene. The final rule is expected to be published this month.
• Hazmat and passenger commercial vehicles and railroad crossings: Also expected this month is a final rule to amend the FMCSRs related to driving a CMV at a highway-rail grade crossing.  The rule would eliminate the mandatory stop at grade crossings currently required for drivers of certain CMVs and prohibit drivers of all CMVs from driving onto a grade crossing without exercising due caution (including slowing down, as necessary) upon approaching the crossing to ascertain safe clearance.
• Retroreflective sheeting on trailers: The final rule expected this month would rescind the requirements for retroreflective sheeting on semitrailers and trailers manufactured prior to Dec. 1, 1993, which is the compliance date for NHTSA’s conspicuity rules applicable to trailer manufacturers. The agency said it believes “the vast majority of trailers currently in use on the Nation’s highways were manufactured after 1993 so the retrofitting rule is no longer necessary.”
• Transportation of fuel for agricultural aircraft operations: This rule would amend the FMCSRs in response to the National Agricultural Aviation Association’s (NAAA) petition for rulemaking to allow states to waive the hazardous materials endorsement requirement for CDL holders who transport Jet A fuel in support of seasonal agricultural operations. NAAA requested that states be allowed to waive the hazardous materials endorsement requirement for CDL holders who support agricultural aircraft operations and transport no more than 1,000 gallons of aviation grade kerosene (Jet A), under certain limited conditions. The final rule is expected this month.
• CDL requirements — Increased flexibility for testing and for drivers after passing the skills test: This final rule, expected by the end of November, would finalize CDL testing changes proposed in 2024, allowing State Driver Licensing Agencies (SDLAs) to administer the CDL knowledge test prior to issuing a commercial learner’s permit (CLP), and to administer the CDL skills test to CLP holders who are domiciled in other states.
• Hours-of-service — transport of agricultural commodities: FMCSA plans to issue a final rule by the end of November that clarifies the definition of the terms “any agricultural commodity,” “livestock,” and “non-processed food,” as the terms are used in the definition of “agricultural commodity” for the purposes of hours-of-service regulations. This final rule would fully finalize the “interim final rule” published in 2020.

Supplemental NPRM stage

• Incorporation of 2025 and 2026 North American Standard Out-of-Service Criteria for hazmat safety permits: This rule would incorporate by reference the April 2025 and April 2026 updates to the out-of-service criteria for commercial motor vehicles, published by the Commercial Vehicle Safety Alliance (CVSA), related to transporting transuranics and highway route controlled quantities of radioactive materials. This update is expected in July.

NPRM stage

• MAP-21 enhancements and updates to the Unified Registration System: This proposal, expected this month, would implement several provisions of the 2012 highway bill that relate to the FMCSA’s Unified Registration System (URS), as well as update and codify the agency’s procedures for granting, suspending, and revoking registration. These procedures would apply to all entities required to register under the agency’s jurisdiction. Many of the proposed provisions codify existing agency practices, while others improve on existing processes and procedures.
• Clarification to the applicability of emergency exemptions: In response to several petitions for reconsideration, FMCSA this month plans to propose amending the time limit for the automatic emergency relief exception for regional declarations of emergency, revert back to the 30-day limit which existed prior to the issuance of the October 2023 final rule.
• CDL standards — Incorporation by reference of a new State Procedures Manual: This NPRM planned for publication this month would incorporate by reference the updates to manuals published by the American Association of Motor Vehicle Administrators (AAMVA). FMCSA would amend its rules to update the current incorporation by reference, including the State Procedures Manual (SPM) for the CDL Information System (CDLIS) as referenced in 49 CFR 384.107.
• Fees for use of the CDLIS: This proposal would modify the fee system requirements to specify that the DOT or an authorized operator can collect user fees for accessing the CDLIS; and to use the collected fees to operate, maintain, develop, modernize, or enhance the CDLIS, including for related personnel and administration costs. The proposal is slated to publish this month.
• Fees for the UCR Plan and Agreement: The agency’s adjustment of annual registration fees for the Unified Carrier Registration system is expected to be proposed this month. The adjusted fees would be in effect for registration years beginning with 2027, until a new fee is established by a later rulemaking.
• ELD revisions: Since the implementation of the electronic logging device mandate, FMCSA noted that it has learned “many lessons” that “can be used to streamline and improve the clarity of the regulatory text and ELD specifications and answer recurring questions.” This NPRM, expected by the end of November, would propose technical modifications to the ELD rules.
• Drug and Alcohol Clearinghouse revisions — controlled substances and alcohol use: By the end of November, FMCSA plans to propose changes to its drug and alcohol use and testing rules by increasing the availability of driver violation information in the Drug and Alcohol Clearinghouse to keep unsafe drivers off the road. FMCSA will also propose changes to improve the efficiency of certain Clearinghouse processes to provide increased flexibility for drivers and employers, and further align Clearinghouse rules with underlying drug and alcohol use and testing regulations to improve compliance with, and enforcement of, these requirements.
• National registry of medical examiners — administrative removal of medical examiners: This proposal will provide an administrative removal process for medical examiners who are not in compliance with certain administrative requirements for continued listing on the National Registry of Certified Medical Examiners. It’s expected to publish by the end of November.
• Driver qualifications — seizure standard: FMCSA plans to propose an update to the physical qualification standards for individuals with an established medical history or clinical diagnosis of epilepsy or any other condition that could cause seizures. FMCSA plans by the end of November to propose to reduce the burden on individuals who have experienced a seizure, or who have been prescribed anti-seizure medication provided certain criteria are satisfied. The criteria would mirror those used for the agency’s Seizure Exemption Program, including a requirement for the drivers to obtain documentation from the treating neurologist that the individual has been seizure-free for a period of several years.
• Methods to demonstrate qualifications and knowledge of federal regs for household goods (HHG) motor carriers: This proposal would change the registration requirements for HHG carriers to only allow registration for a carrier that “demonstrates, before being registered, through successful completion of a proficiency examination established by the Secretary, knowledge and intent to comply with applicable Federal laws relating to consumer protection, estimating, consumers’ rights and responsibilities, and options for limitations of liability for loss and damage.” The NPRM is expected by the end of November.
• Preservation of records: This rulemaking, scheduled to publish by the end of November, would propose changes to the record retention requirements contained in appendix A to part 379 to remove overlapping and burdensome requirements, FMCSA said.