New hack for John Deere tractors is latest tool in right-to-repair movement, but underscores security vulnerabilities

Hacker Sick Codes ran a farm-themed version of the game
 Doom on the jailbroken tractors. (Photo by The Register)

A new hacking tool for John Deere tractors, revealed at a recent cybersecurity conference, is the latest salvo in the battle between major farming equipment manufacturers and farmers who want to be able to repair their own gear more quickly and affordably, Lily Hay Newman reports for Wired. However, security gaps that farmers and hackers exploit to carry out these "jailbreaks" underscore the machines' vulnerability to malicious actors.

The new jailbreak allowed Australian hacker Sick Codes to gain root access to the popular John Deere 2630 and 4240 model tractors from their touchscreens. He presented the hack this month at DefCon in Las Vegas as sort of an apology: After he presented research on tractor software security bugs at last year's conference, John Deere fixed the flaws that allowed him and other hackers access. But farmers were outraged that he had tipped off the company, and complained that he had ruined their ability to jailbreak their equipment, "So I figured I would put my money where my mouth is and actually prove to farmers that they can root the devices," he told Newman.

Codes said he's worried about global food security and doesn't want farmers to be vulnerable to bad actors. But at the same time, he wants farmers to be able to fully control and repair their own machinery, Newman reports. President Biden issued an executive order last summer directing the Federal Trade Commission to limit farm-equipment companies' ability to prevent tractor owners from repairing their own equipment or using independent repair shops. Bills to enshrine the right-to-repair in law have been introduced in the Senate and in several states, but New York is the only state to pass one.

"Facing mounting pressure, John Deere announced in March that it would make more of its repair software available to equipment owners," Newman reports. "The company also said at the time that it will release an 'enhanced customer solution' next year so customers and mechanics can download and apply official software updates for Deere equipment themselves, rather than having John Deere unilaterally apply the patches remotely or force farmers to bring products to authorized dealerships."