FBI issues warning about ELDs

FBI issues warning about ELDs

This week, the Federal Bureau of Investigation (FBI) issued a warning to the trucking industry about the vulnerability of Electronic Logging Devices (ELDs) to threats from hackers.

In a Private Industry Notification issued by the FBI on July 21, authorities warn that “cyber criminals could exploit vulnerabilities in electronic logging devices.”

In the notification, the FBI also issues tips to minimize the risk of an ELD device hack.

Check out the text of the FBI’s notification in full below.

———————————————————————————————————

Cyber criminals could exploit vulnerabilities in electronic logging devices (ELDs), which became required equipment in most commercial trucking operations as of 16 December 2019 due to a federal regulatory mandate. Although the mandate seeks to provide safety and efficiency benefits, it does not contain cybersecurity requirements for manufacturers or suppliers of ELDs, and there is no requirement for third-party validation or testing prior to the ELD self-certification process. This poses a risk to businesses because ELDs create a bridge between previously unconnected systems critical to trucking operations. Companies choosing an ELD can mitigate their cyber risk by following best practices tailored to ELDs. This includes asking the ELD’s supplier specific questions, some of which are identified in this PIN.

ELD Connectivity and Security

ELDs are devices that electronically send inspection reports to the Federal Motor Carrier Safety Administration (FMCSA). ELDs are required to connect to a vehicle’s electronic control module (ECM) in order to track date, time, location information, engine hours, vehicle miles, user identification data, vehicle identification data, and motor carrier identification data. ELDs must also permit wireless connectivity. As a result, ELDs create a bridge between critical vehicle components and wireless data transmission, such that the vehicle components themselves can be accessed remotely through Wi-Fi or Bluetooth. The most common implementations of ELDs use built-in cellular modules, but satellite, Bluetooth, or cabled tethering to cellular enabled smart phones and tablets are also options.

The ELD mandate does not contain any cybersecurity or quality assurance requirements for suppliers of ELDs. As a result, no third-party validation or testing is required before vendors can self-certify their ELDs. Businesses choosing an ELD to use on their networks must therefore conduct due diligence themselves to mitigate their cyber risk and potential costs in the event of a cyber incident.

The Department of Transportation (DOT) FMCSA ELD mandate entered the third and final phase on 16 December 2019, requiring the use of self-certified ELDs registered with FMSCA by all drivers and carriers subject to the rule.

ELDs and Cyber Threats

Industry and academic research into a selection of self-certified ELDs found the sample of devices did little to nothing to follow cybersecurity best practices and were vulnerable to compromise. The sample included ELDs that could be purchased off the shelf at superstores and ELDs supplied by well-known companies. Researchers demonstrated the potential for malicious activity to remotely compromise the ELDs and send instructions to vehicle components to cause the vehicle to behave in unexpected and unwanted ways. Although the ELDs are only intended to allow the logging of data from the engine, in practice some self- certified ELDs allow commands to be sent to the truck engine via their connection to the ECM. Commands passed into the vehicle network through an ELD could affect functions such as vehicle controls and the accuracy of the console display. Potential indicators of this occurring include an increase in nonreproducible equipment performance or maintenance issues, an increase in traffic on the vehicle’s internal network, or networking logs for the ELD showing unexpected incoming remote connections. The limited indicators and warning signs for this type of activity increase the importance of selecting a secure device with settings that restrict traffic during normal operations.

ELDs with more advanced telematics functions and a connection to functions such as shipment tracking or dispatching can allow a cyber actor who gains access to an insecure ELD to move laterally into the larger company business network. Cyber criminals interested in stealing data such as personal information, business and financial records, location history and vehicle tracking, or other proprietary data such as lists of customers and cargo can use vulnerabilities in ELDs as a way in to access trucking companies’ enterprise networks and databases. With that access, financially motivated cyber criminals would also be positioned to install malware such as ransomware, preventing the ELD, the vehicle, or connected telematics services such as dispatching or shipment tracking from operating until the ransom is paid. Potential indicators for this kind of malicious activity include unusual traffic or unusual file sharing on the network, which could best be detected by establishing a network baseline and monitoring network loads and traffic, as well as restricting user and device access privileges to only what is needed for their job.

How to Mitigate the Risk: Questions to Ask ELD Makers and Suppliers

Before deploying an ELD, it is recommended to contact the manufacturer or supplier of the ELD and ask about its cybersecurity. When contacting suppliers, seek specific and detailed information regarding the security of the entire ELD solution. Because ELDs can include a combination of in-vehicle, communications link, user interface, and cloud back-end systems, the supplier should be asked for details that address the cybersecurity of all functions and components.

In May 2020, DOT FMCSA released a set of cybersecurity best practices for ELD solutions in “Cybersecurity Best Practices for Integration/Retrofit of Telematics and Aftermarket Electronic Systems” [FMCSA-RRT-19-013]. The best practices provide guidance regarding considerations for trucking companies when acquiring new devices and what suppliers can expect from customer acceptance testing of these requirements.


Specifically, the FBI points to the fact that the FMCSA requires ELDs but that the ELD Mandate “does not contain cybersecurity requirements for manufacturers or suppliers of ELDs, and there is no requirement for third-party validation or testing prior to the ELD self-certification process.”

FBI issues warning about ELDs