Legacy maintenance software at trucking companies can be charming for its vintage qualities. While the enterprise portion of the operation is likely running the latest operating systems with all the expected security layers, the maintenance facility is probably running on software old enough to have been on the shelves when new episodes of Seinfeld were airing.
We really do see truck maintenance facilities still running Windows 7. As implausible as that sounds, it’s for an unsurprising reason. Maintenance software must match the operating systems in the trucks, and it’s not unusual that trucks have been on the road for that long.
It’s easy to tell the maintenance team to upgrade to newer software, but if the newer software isn’t compatible with the systems in the older trucks, the diagnostic systems might not function as they should. So they keep using old systems to diagnose maintenance issues for old trucks.
Unfortunately, that presents some real cybersecurity challenges. Indeed, for most carrier fleets, there is nowhere the truck is more exposed to cyberattack than in the maintenance shop.
That’s because diagnostic software is powerful – both for good and for evil. Software can understand a problem the truck is having and recommend an effective solution. That’s the good. But it can also alter configurable settings on the truck, updating the truck’s component firmware in dangerous and malicious ways.
We're pleased to report that this hasn't occurred often. Yet. But we know hackers can do some pretty damaging things to trucks if they access the diagnostic systems, such as triggering an engine derate; changing the engine’s settings via reverse engineering; cutting off engine cylinders; cycling ABS pressure valves; and tampering with diagnostic adapters.
And because the legacy maintenance software is so old and relatively unsecured, hackers could do much of this without even having to go through authorization to access the system.
Many parts of the system are vulnerable, including the maintenance tools themselves, the supporting libraries and drivers, licenses, user accounts and credentials, and other supporting software tools on the laptops running these old systems.
But the inherent vulnerability of legacy maintenance software doesn’t mean nothing can be done. Users can protect their trucks — and their broader systems — by engaging in threat modeling. This is a process by which users systematically identify potential attacks and develop a strategy to address them.
Many organizational players should be involved in this process, including top executives, end users, the legal department and, of course, the IT team. As part of this process, the team should be looking at the flow of data between maintenance software and the internet, as well as between the maintenance software and other devices on the enterprise system, not to mention how someone might physically access the system via USB ports.
Addressing these vulnerabilities will likely focus on four key areas:
The legacy maintenance software itself, by regularly updating and patching wherever possible, and by making available adjustments — such as running it as a low-privilege user, implementing strong passwords and multifactor authentication. And of course, regularly checking to ensure it hasn’t been tampered with.
The devices running the software, such as laptops and desktop computers, by limiting permissions to only what is absolutely necessary for maintenance functions. If you can update to a newer system that’s more secure, you want to do that. But if that isn’t possible because it would leave older trucks behind, then aggressive patch management is critical.
The company’s network, by limiting its connectivity and isolating legacy maintenance software from other company functionality. There is no reason an older computer running Windows 7 or Windows 8 needs to be connected to your enterprise system, unless it’s necessary to keep the trucks maintained (which it probably isn’t). In addition, use strong Wi-Fi security practices and configure firewalls to default-deny traffic so only the necessary connections can be established. It’s also a good idea to review open network ports to make sure there isn’t a sneaky way of connecting between the legacy maintenance software and the enterprise system.
People and processes, which is often where the real difference is made. Everyone on your team — from the maintenance techs to the back-office staff — should be up to date on security awareness training. They should be watching for suspicious behavior and learning to avoid traps like phishing e-mails and lookalike domains. It’s also important to have protocols in place for when people leave the company, so they don’t continue to have access to your software or your broader network.
Every trucking company should also have an incident response plan, and it’s always wise to seek external security help to make sure you’re planning and executing all this effectively.
For more information on this topic, download our recent whitepaper, authored by Jamie Lightfoot of Lightfoot Labs.
Don’t leave your trucks vulnerable. If legacy maintenance software must be part of your operation, then take the steps necessary to protect it. It’s a little more work but it’s nothing compared to having a truck compromised – or your entire enterprise. And it’s all very doable.
So do it.
