Analyzing Smart Farming Automation Systems for Fun and Profit

Analyzing Smart Farming Automation Systems for Fun and Profit

Speakers: Felix and Bernhard (OT security researchers, with co-researcher Sebastian)

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=OxnY_25suS8

Reading Time: ~8 minutes

Type: Briefing

TL;DR

Two OT penetration testers discovered catastrophic vulnerabilities in FJDynamics smart tractor automation systems — sold in Europe under the FJDynamics and SVIAGRO brands — that allowed them to passively track tens of thousands of farming vehicles worldwide, lock any tractor's automation remotely, and ultimately gain full root code execution on the onboard Android tablet via a spoofed firmware update, culminating in a proof-of-concept steering wheel takeover.

Introduction

Agriculture is quietly undergoing a digital revolution. GPS-guided automation systems that can retrofit any tractor and enable self-driving field operations now cost as little as five to ten thousand dollars — a fraction of the quarter-million-dollar price tag of a modern tractor. Farmers across Central Europe, Asia, and beyond have rapidly adopted these aftermarket kits. What no one apparently checked was whether those systems were secure.

Felix and Bernhard, a pair of OT security researchers whose day jobs involve pen testing PLCs, HMIs, and SCADA systems, stumbled into this topic after a friend mentioned a contact who sold tractor automation kits. What followed was a months-long research project that exposed not just individual device vulnerabilities but a broken cloud infrastructure affecting tens of thousands of agricultural machines globally — and the results were presented at Black Hat USA 2025 under the original title "Tracking the Tractors," though the scope quickly expanded far beyond GPS data.

Market Research: Two Brands, One Broken Backend

▶ Watch: Market Research and FJDynamics Overview (04:00)

Targeting the Central European market, the researchers identified two dominant brands of tractor automation systems: FJDynamics and SVIAGRO. When they acquired hardware from both vendors, they discovered the products are identical — SVIAGRO is simply a rebrand of FJDynamics hardware. This was good news for their research: any vulnerability would affect a dominant share of the European aftermarket automation sector, not just a niche product.

The AT2 system they studied consists of three components: an Android-based HMI tablet for the farmer in the cab, an electric motor unit that physically turns the steering wheel, and a GPS antenna mounted on the tractor roof. The tablet communicates with a cloud-hosted MQTT broker to sync field maps, GPS data, and operational commands.

Breaking the Cloud: MQTT Without Borders

▶ Watch: TLS Bypass and MQTT Credential Extraction (06:00)

The first major finding came from intercepting the tablet's TLS-encrypted MQTT traffic. The researchers redirected the connection to test for certificate validation — and found none. The device accepted any TLS certificate without complaint, allowing a straightforward man-in-the-middle to expose MQTT credentials in plaintext. A raw Netcat dump revealed the product name, client ID, username, and password.

There was an additional twist: the system also used a client TLS certificate for authentication. Rather than reverse engineer the obfuscated application, the team used Frida, the dynamic binary instrumentation framework, to write a custom script that dumped TLS secrets at runtime. With the client certificate extracted, they had full access to the cloud MQTT broker.

The broker's topic structure revealed GPS position updates, vehicle parameter changes, and — critically — a "function invoke" topic capable of sending commands to connected devices.

▶ Watch: Accessing the MQTT Broker and Discovering Topics (08:01)

A self-registration flaw compounded the problem dramatically. The broker's authentication required only a username, password, and serial number — and it accepted serial numbers that did not correspond to any real device. More importantly, it accepted an MQTT multi-level wildcard (#) as a topic subscription, returning data from all connected devices simultaneously. The researchers built a tool they called Tractor Kraken to ingest the firehose of approximately 100,000 MQTT messages per second from all regional brokers — including those serving the US, China, Russia, and the European Union.

Over several months of passive observation, the team catalogued approximately 40,000 active systems: a majority in Asia (consistent with the vendor's Chinese origins), roughly 50,000 in the European Union, and around 300 in the United States. The data exposed GPS coordinates, field layouts, home locations, IP addresses, and sometimes email addresses of farmers who shared field access with one another.

Among the more striking observations: a tractor operating 20 kilometers from the front line in Ukraine at 3:00 a.m., tractors near the North Korean border in South Korea, and GPS tracks showing clear signs of jamming — devices suddenly reporting wildly inconsistent positions near conflict zones.

Remote Lock and Notification Spam

▶ Watch: Lock Command and Remote Attack Capabilities (14:01)

The MQTT broker's command set was limited but impactful. Two actionable commands were available: lock and send notification. The lock command disables the automation system entirely — the tractor continues running normally, but the GPS-guided steering is lost. The notification command allows arbitrary messages to be sent to the farmer's tablet.

Critically, these commands could be sent to any device, including all devices simultaneously. A single attacker with broker access could send a lock command to all 40,000+ systems simultaneously, forcing every affected farmer to call the vendor individually to restore service — and an attacker could simply replay the command to lock them again immediately after. The researchers characterized this as a trivially executable, catastrophic denial-of-service scenario with no effective user-side defense.

Rooting the HMI Tablet and Hijacking the Steering Wheel

▶ Watch: Android HMI Root and Firmware Update Attack (16:01)

The team's ultimate goal was the steering system itself — specifically, whether an attacker could cause a tractor to turn unexpectedly while operating on a public road. The HMI tablet runs a locked-down Android image that launches only the vendor's application. However, the lockdown was poorly implemented: system settings remained accessible, enabling ADB over the network — and the device turned out to be pre-rooted by the vendor using a su binary. Full root access required no exploit whatsoever.

To achieve remote root code execution, the researchers examined the over-the-air update mechanism. The update flow sends a notification to the device with a URL pointing to the firmware binary, protected by nothing more than an MD5 checksum. Because the device does not validate TLS certificates, a man-in-the-middle attacker can substitute any URL and compute a matching MD5 hash. Since the device is already rooted, delivering a malicious binary via this path yields full root code execution. The update dialogue can even display a custom message — the researchers demonstrated it displaying "Totally not a virus. Trust me, I'm a dolphin."

With root access established, the researchers turned to the steering ECU. The ECU is a standalone embedded device that communicates with the Android tablet over a serial protocol, takes inputs from the IMU (orientation sensor), and drives the Motor Control Unit (MCU) to physically turn the steering wheel. Working with 200 kilobytes of raw ARM assembly with no symbols, no strings, and unknown processor specifications, Bernhard reverse engineered the serial protocol and discovered that waypoint commands specify latitude/longitude pairs (two floats each) — there is no direct "turn left/right" instruction. To force a hard right turn, an attacker must calculate a 90-degree waypoint offset from the vehicle's current GPS position.

The proof-of-concept demonstrated that a pre-rooted tractor could be allowed to operate normally until the attacker flips the switch — at which point the steering motor, described as "quite strong," takes over. The farmer's only options are to fight the wheel manually or cut power quickly. As the researchers noted, either scenario can result in the tractor driving into a ditch or tipping over in a matter of seconds.

Bonus Findings: Lawnmowers and Building Robots

Beyond tractors, the researchers discovered that the same broken MQTT infrastructure connects FJDynamics lawnmowers and indoor delivery robots. Lawnmowers upload camera snapshots to unauthenticated cloud storage buckets and transmit the URLs through the same broker — giving the researchers access to live video feeds from customers' properties. Building automation robots, which take elevators and traverse floors in hotels and bars, exposed commands for opening doors and calling elevators over the same broker. The researchers refrained from sending those commands to live hardware they did not own, but expressed high confidence that replay attacks would have succeeded.

Disclosure and Current Status

Responsible disclosure began in August 2024 and proved difficult. The vendor's first contact — an employee named Eva — was responsive but the reports apparently stalled internally. Two weeks before Black Hat, the company's CEO became aware of the situation and re-engaged. As of the talk, mitigations were partially in place but the remediation process was still ongoing.

Notable Quotes

"Two characters did the trick. This is an MQTT multi-level wildcard, which basically just tells the broker, 'I want to have all the topics and all the messages now.' And the broker was fine with that."

— Bernhard, ▶ 10:01

"We knew from our friend that there are different serial numbers for different tractors. We tried them, and the broker also said, 'Okay, you can log in and just impersonate another tractor.' But then we thought, 'Damn, if we can impersonate one tractor, why not impersonate all of them?'"

— Bernhard, ▶ 10:01

"The steering motor is quite strong, so you have now two options. Either you start fighting with the steering wheel over control, or you're quick enough to turn the system off. But this basically takes a split second to drive the tractor in a ditch or lead to a tilt over."

— Felix, ▶ 26:02

"Agriculture is at large scale also critical infrastructure, so this technology should live up to a higher standard."

— Felix, ▶ 30:02

Key Takeaways

• The MQTT broker accepted wildcard subscriptions from any authenticated client, allowing a single device's credentials to expose telemetry from all 40,000+ connected systems globally — including real-time GPS positions, field boundaries, and farmer identity data.
• The self-registration flaw eliminated serial number validation, enabling an attacker to register as any device (real or fictional) on any regional broker — US, EU, China, Russia — using a single set of extracted credentials.
• The HMI tablet was pre-rooted by the vendor, meaning the unsophisticated MD5-only firmware update mechanism directly yields root code execution on any device reachable via a man-in-the-middle network position.
• The remote lock command is an unmitigated denial-of-service vector: an attacker can broadcast a single MQTT message to disable automation on every connected tractor simultaneously, with no user-side countermeasure.
• Digitalization in agriculture is accelerating without proportional security investment — the same vendor's insecure cloud infrastructure also connects lawnmowers (exposing camera feeds) and building delivery robots (exposing door and elevator controls).

Slides: No slide PDF was available for this talk.