Robert Braswell, TMC executive director and host of Tech Talk with TMC on The Dave Nemo Show on Sirius Satellite Radio, sat down earlier this year with DG Technologies president Mark Zachos to talk about cybersecurity in trucking. Robert Braswell: Mark Zachos is a longtime TMC member. He’s an expert in truck technology, vehicle data adapters and onboard vehicle networks and systems. We’re going to take a look at what drivers need to know about cybersecurity and trucking. He currently chairs our Cybersecurity Task Force, so he knows of what he speaks, and he’s been working on developing a number of recommended practices on the subject. Mark Zachos: Let’s talk a little about artificial intelligence and how that’s changing the whole way you look at cybersecurity. Because now it’s not just that we’re looking out for the bad actors who are using the computers and the software systems, now it’s the software systems themselves that are bad actors that we have to look out for. We use these things to help us do calculations. For example, fleets have tons and tons of data coming in from all over their operations, the old-fashioned way – typing into spreadsheets or importing data files. And then you’ve got to manually write a program. But these AI machine learning agents, as we call them, are very capable of being asked a question and giving answers. The real magic still becomes the human in the loop because you have to ask the question properly. So, they’re still reliant on humans, at least at this point. RB: So, the garbage in, garbage out theory still holds true? You’re only going to get out what you put in? MZ: Right, but you’re going to get it faster. So, that’s the thing, everyone wants to adopt the technology because we want it faster. Going back to the attackers, the cybersecurity bad guys, they, too, use these artificial intelligence programs. When I say bad guys, what I mean is, there are actually two categories – the state actors, those are the ones in China or in Russia trying to attack our infrastructure and do bad things to our country. They’re also generating something called ransomware as a service, spinning out little programs that small time, medium-sized criminal organizations could use here in the United States or anywhere in the world. Criminals pick up on that software that was developed and then use that as a method to spam or send phishing emails out to folks like us or to fleets. RB: That’s interesting. And, it’s getting more and more sophisticated all of the time. With that in mind, what are some of the new projects your S.5 fleet maintenance management study group and S.12 onboard vehicle electronics study group are working on to thwart some of the bad actors out there? MZ: The S.5 group is working toward a new recommended practice (RP) on equipment acquisition to give guidance to those buying trucks, maintenance equipment or computer equipment that will be cybersecure. What those recommended guidelines include is that the vendors you’re buying from need to have secure backing, meaning in their systems – where they do the engineering or the distribution or the pushing out of new software patches to you, the end customer – they make sure they’ve got a secure firewall, encrypted downloads and this sort of thing. You should put those things right there in your purchase order for that equipment. On the S.12 side, the onboard electronics and the connection side, we want to make sure with those vehicles or that equipment, that we’re buying the maintenance equipment as well as what connects to trucks. That when you do the maintenance activity, it’s done in a secure manner. Again, the interface, the communication – the handshake between the maintenance computer and the truck, between the maintenance computer and the backend server, all of that – is secure and updated. RB: It used to be that when you talked about cybersecurity, you usually thought about ransomware. And that was more of a back-office kind of a thing, maybe hitting the finance side of it. So, it would cripple a company’s ability to bill customers or collect payments. But now, the emphasis is expanding to include the onboard side of trucking. The actual vehicle itself and the support services that keep the vehicle up and running, such as the vehicle data adapters, the computer tools that you use to diagnose and reprogram the vehicle, some that still require you to plug in through the OBD port. Some of it can be done wirelessly and that is a great benefit, but it would also give the opportunity for more cyber intrusion, wouldn’t it? MZ: Yeah. Anything that touches the truck, either wirelessly – Bluetooth, wifi, cellular – or plug in, there’s a vulnerability. We have those recommended practices on cybersecurity and I would just put out there the value of something like that. The ideas and protection and guidance that we publish in our cybersecurity recommended practices, they’re going to save a lot of money. You know, these ransomware games are getting smarter and smarter. What we need to do as a community, as an industry, is just raise the bar so they go after the lower hanging fruit. RB: The J1939, of course, is the backbone of the electrical communication system. It’s the data bus of the vehicle and it’s probably one of the points of the truck that could be the most vulnerable when it comes to cybersecurity, isn’t it? MZ: What we have is a wide-open bus. All the messages, the network, everything’s been defined and given to the community to use for recommended practices for engineering new vehicles for hooking up diagnostic tools to the OBD port. But those documents are also available to AI bots. They actually can scan. That’s how they get their intelligence. They go out and look at what’s been posted on the internet. It’s just amazing what’s out there, and they learn from that. And they’re able to create attack scenarios, plugging into the OBD bus and downloading them – a bad calibration that when your vehicle hits 50 miles an hour shuts it down or goes into a D rate or something like that. You can actually have the AI agent create software to do that in attacks and they are doing that. We teach that, actually, a little bit in our SuperTech competition. That’s going to be new this year. We’re going to add a little AI to our SuperTech Cybersecurity Station coming up in the fall. So, there’ll be an adventure there. The J1939 network is built to be open and easy to work with so that all the different vendors can communicate seamlessly so the commercial vehicle operates like we expect it to operate. The problem is that it leaves you vulnerable for certain cybersecurity exposure. But there is a new cybersecurity standard at the Society of Automotive Engineers (SAE) that’s there to help protect the network and maybe close some of those opportunities. There are actually two of them. One is called J1939-91A, and that’s more of a document for new equipment – putting firewalls on the trucks and networks, separation, you know, technical things like that when you build new vehicles. Then there’s another called J1939-91C and that one is very interesting because it does not depend on passwords directly. It’s more using something that the cybersecurity researchers know well from the banking industry or from other industries called PKI. It uses something called public key infrastructure. Basically, you’ve got to have security built in from the ground up for the communication so you can verify all these messages, you trust each other and this is brand new stuff for the trucking industry but it’s common technology for us. When you use your credit card, you don’t worry about it and that’s because the technology has been very good and stable, and we’re just bringing that into the vehicle now. RB: What are some of the things that a driver can do to prevent cybersecurity attacks? We understand that electronic logging devices (ELDs) have been in the news recently. What can a driver do when it comes to ELDs to protect themselves? MZ: Part of the story is the same old, same old, right? The connection to wireless devices, either through Bluetooth connection from your phone or Wi-Fi connection. That data on the ELD has to go somewhere. First, it’s collected from the truck, but then it’s accumulated and transmitted somewhere. Somebody has to get that data. The security of the connections is paramount. Somebody can actually be in a truck stop and remotely connect to your vehicle, that’s not science fiction anymore. So having strong passwords, two-factor authentication, something physical that verifies that you have a good connection, that you trust the other side you’re talking to. I’m telling you, just a little bit of extra effort will go a long, long way to make you a lot more secure. And that includes that technology, where you’re picking out trains or buses, the little pictures and squares, Captcha, I think it’s called. RB: So, you’re not talking to a bot. MZ: Yeah, little things are really important and just knowing that, make sure you’re really careful about that USB port that can be the gateway to all sorts of cyber evils. It’s really important to make sure that you be aware and stay on top of the things that you hear about in the news so your vehicle isn’t compromised. Because especially, over the years and with the growing sophistication of the vehicle itself, the opportunities for cyber mischief onboard the vehicle, not just in the back office, are growing more and more all of the time. RB: Mark, thank you for joining us. I’m looking forward to the new recommended practices that are going to be coming out of TMC, particularly on new equipment purchases because I think that baking in the cybersecurity protection when you’re spec’ing the vehicle is going to be a real advantage for a lot of fleet managers and equipment purchasers so they can increase their cybersecurity going forward. For further information: Dearborn Group, Inc. General Contact: Mr. John McNelis Visit our website: www.dgtech.com Follow us!
Mark Zachos Talks Cybersecurity on TMC Tech Talk
33604 West Eight Mile Road
Farmington Hills, MI 48335
1 (248) 888-2000
sales@dgtech.com
Sales and Marketing Manager
jmcnelis@dgtech.com
Our Services Portal: https://www.truck-connect.com/
X: x.com/DGTechnologies
Facebook: facebook.com/vehiclenetworksolutions
Instagram: Instagram.com/dg_technologies/
YouTube: www.youtube.com/@DGTechnologies
