Blind Trailer Shouting

Blind Trailer Shouting

Speakers: Ben Gardiner

Conference: DEF CON 33 (Las Vegas, August 9, 2025)

YouTube: Not yet available

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Ben%20Gardiner%20-%20Blind%20Trailer%20Shouting.pdf

Overview

Semi-trailer trucks share public roads with millions of other vehicles. Their braking systems are safety-critical infrastructure — a compromised brake controller on a tanker trailer is not an abstraction; it is a real-world hazard to the vehicle's occupants and everyone around them. The DEF CON 33 talk "Blind Trailer Shouting" by Ben Gardiner of the National Motor Freight Traffic Association (NMFTA) documents the culmination of years of truck cybersecurity research with a genuinely alarming result: a blind, wireless, fully unauthenticated attack against commercial vehicle trailer brake ECUs, demonstrated at physical range without any direct wired connection to the target vehicle.

The attack exploits weak seed-key authentication in the KWP2000 diagnostic protocol, transmitted over the J2497 powerline communications bus. By abusing the dynamic addressing behavior of J2497 to silence the target ECU, predicting the first seed value emitted after a device reset, and injecting precisely timed diagnostic commands over the air via software-defined radio, an attacker can unlock diagnostic access to roll stability trailer brake ECUs from a distance — with no physical connection and no knowledge of the target vehicle's specific firmware.

This research yielded CVE-2024-12054 (CVSS 5.4 Medium) and ICS Advisory ICSA-25-021-03, published January 21, 2025.

Background

Truck Network Architecture

Commercial vehicles operate multiple overlapping communications networks. Understanding their structure is essential to grasping the attack surface:

• J2497 — Physical layer standard using powerline carrier (PLC) technology on the 12VDC tractor-to-trailer power line. Carries J1587 data at 9,600 bps. A single segment, mission-time protocol used for standardized LAMP messages and proprietary diagnostics encapsulated in Data Link Escape (DLE) frames.
• J1708/J1587 — Serial link and data protocol layers above J2497. All devices on a J2497 segment share the same physical medium.
• J1939 / CAN bus — 250 kbps or 500 kbps multi-segment bus; carries standardized J1939 signals, proprietary messages, and supports UDS diagnostics. The primary modern control network.

The diagnostics stack on the J2497/J1587 path uses ISO 14230 (KWP2000) as the application-layer protocol, encapsulated in J1587 DLE frames, transported over J2497 powerline.

Trailer Brake ECU Types

Two types of trailer brake ECUs are relevant to this research:

| Feature | Trailer ABS | Trailer Roll Stability |

|---|---|---|

| Primary function | Prevents wheel lock-up during braking | Prevents trailer rollover |

| System type | Reactive | Proactive/predictive |

| Brake pressure control | Can only release/re-apply from driver's commanded level | Can independently build, hold, and release pressure |

| Diagnostic protocol | J1939 / UDS | KWP2000 over J2497 |

The Roll Stability ECU — the target of this research — uses a 16-bit seed-key exchange for diagnostic authentication over KWP2000, transported on the J2497 powerline bus. This is the older, more proprietary design. Understanding why this is significant requires understanding what diagnostic authentication controls.

Prior J2497 Wireless Vulnerabilities

This talk is not NMFTA's first foray into wireless truck hacking:

• CVE-2020-14514 (ICSA-20-219-01): Demonstrated that J2497 signals can be received wirelessly from approximately 15 feet using active antennas — passive eavesdropping without any physical connection.
• CVE-2022-26131 (ICSA-22-063-01): Demonstrated that J2497 signals can be injected wirelessly from approximately 15 feet using a 50W power amplifier and a 40-foot wire antenna.

"Blind Trailer Shouting" builds on these prior results but advances the attack dramatically: instead of merely injecting arbitrary messages, this work achieves authenticated diagnostic access — which means an attacker can not only transmit messages but can unlock the ECU's diagnostic session and issue commands including brake control reconfigurations and firmware operations.

Key Findings

1. Roll stability trailer brake ECUs use a 16-bit linear seed-key algorithm of the form key = m * seed + b (mod 2^16), where m and b are constants per firmware version. The algorithm is cryptographically trivial — two observed seed-key pairs are sufficient to solve for the constants using a simple linear equation (or Z3 SMT solver for generality).

1. Seeds are not truly random. The "first seed" emitted by a device after a reset is deterministic and constrained to a small predictable range. Across four units tested spanning firmware versions from 2008 to 2023, the first seed after reset was consistent enough that an attacker with >50% success probability for the correct key computation can achieve access within 30 seconds per attempt, and >90% probability within 2.5 minutes.

1. J2497 dynamic addressing can be abused to silence target ECUs — a "grooming" technique that makes the target ECU temporarily stop transmitting, reducing collision probability for the attacker's injected diagnostic frames.

1. The attack is completely blind on the transmit side — the attacker uses a software-defined radio (SDR) to transmit J2497-encoded signals over the powerline medium without having any receive capability. This "blind shouting" approach (hence the talk title) works because once the seed is predicted, the correct key can be computed and transmitted in the expected time window.

1. CVE-2024-12054 / ICSA-25-021-03 was issued January 21, 2025, with a CVSS score of 5.4 Medium (AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H). The network vector is adjacent (within powerline coupling range), attack complexity is high (timing-dependent), but no privileges or credentials are required.

Technical Deep Dive

Seed-Key Algorithm Reconstruction

KWP2000's Security Access service (Service $27) uses a seed-key exchange: the ECU sends a challenge (seed), the client computes a response (key) using a shared algorithm, and sends it back. If correct, the ECU unlocks the diagnostic session.

For the roll stability ECUs studied, the algorithm is a 16-bit linear function:

Where m and b are fixed constants for a given firmware version. To reconstruct the function, two valid seed-key pairs are sufficient. The attacker obtains these by connecting to the ECU via wired OBD diagnostics, observing multiple exchanges, and solving the resulting system of linear equations.

Gardiner used Z3 (Microsoft's SMT solver) with the following Python pattern:

Once m and b are known, the key for any future seed can be computed instantly.

First-Seed Prediction

The timing attack component relies on a critical weakness: after a reset, the ECU emits predictable first seeds. Across the four test units:

• Units built in 2008, 2018, 2021, and 2023 (three firmware versions)
• All showed constrained first seeds out of 65,535 possible 16-bit values
• Success probability >50% within a 30-second window

This predictability means an attacker can precompute the most likely keys, attempt them in order, and expect success within a manageable number of tries.

J2497 Dynamic Addressing Abuse ("Grooming")

J2497 assigns Message IDs (MIDs) dynamically using a collision-avoidance protocol. Gardiner discovered that this mechanism can be abused:

1. Send a MID storm that avoids the target ECU's current MID (e.g., not 0xF7) — the target moves to 0xF7.
2. Send a message from 0xF7 — the target is forced off that MID and moves to 0x89.
3. While the target is at 0x89, it enters a brief predictable silence window (it is "deaf" to incoming messages for a deterministic delay).
4. Send the reset request during this silence window.

This grooming sequence predictably silences the target ECU, reducing the collision probability for the attacker's subsequent diagnostic commands (the UDS Diagnostic Session Control and Security Access requests that must arrive in a narrow timing window after the reset).

Timing and Blind Injection

The attack must get timing "just right" — the diagnostic session control and seed request must arrive in a specific window relative to the reset. Gardiner characterized the relevant timing slots:

• Window A: ~100ms window during which a one-message queue can be filled; ECU confirms receipt but does not change state.
• Window C: Earliest point at which UDS state changes.
• Window D: Reset request confirmation — delays are very low jitter from this point.

The tool uses a sigrok-based logic analyzer and custom decoder to characterize timing on a wired connection first, then replicate the timing profile in the wireless transmit campaign.

SDR Transmission

The transmit side uses an FL2K-based SDR with a custom J2497 powerline modulation implementation (AM modulation on the J1708 carrier). The attack script is written in Python using numpy for signal construction:

The attack does not scale to arbitrary fleets: each unit's firmware constants must be pre-characterized, and the first-seed behavior varies by firmware version and build date. However, within a known fleet of trailers running the same firmware version, the attack is repeatable.

Demo / PoC

Gardiner demonstrated the wireless seed-key unlock on live hardware at NMFTA onsite truck tests. The PoC:

• Connected to tanker trailer brake ECUs via wired OBD to characterize the seed-key algorithm per firmware version
• Used sigrok Pulseview with custom J1587 and UDS decoders to capture and analyze diagnostic traffic
• Applied the Z3-based solver to reconstruct m and b constants per firmware
• Ran blind wireless injection campaigns using SDR hardware, characterizing timing through sweep-based campaigns
• Successfully completed diagnostic session unlock wirelessly

The NMFTA published a whitepaper: Blind Wireless Seed-Key Unlock

Defensive Implications

Gardiner offered specific mitigations at both the device and ecosystem level:

For Brake ECU Manufacturers:

• Replace 16-bit linear seed-key algorithms with cryptographically secure alternatives. UDS Service $29 (Authentication) provides a standardized mechanism using asymmetric cryptography that is resistant to offline key computation attacks.
• Avoid centralizing diagnostic authorization — implement delegation of authority so that equipment owners can provision diagnostic access independently, without requiring manufacturer intervention.

For Trailer Telematics Devices:

• Satisfy comprehensive telematics security requirements. NMFTA has published requirements at: NMFTA Cybersecurity Requirements for Telematics Systems v1.5

For Tractor Manufacturers:

• New tractors should protect trailers from wireless injection attacks on the J2497 bus. Options include filtering or monitoring for anomalous PLC traffic on the 12V line. NMFTA has published actionable options: Actionable Mitigation Options for J2497 Attacks

For Standards Bodies:

• Gardiner and NMFTA have petitioned the SAE Truck and Bus committee to re-open J2497 and incorporate wireless attack mitigations into the revised standard. Draft J2497 changes have been submitted for consideration.

Key Takeaways

• Trailer brake ECUs — safety-critical components on commercial vehicles — can be wirelessly accessed for unauthorized diagnostic sessions without any physical connection, using off-the-shelf SDR hardware.
• The root cause is a combination of: cryptographically weak (16-bit linear) seed-key authentication; predictable post-reset seed values; and exploitable J2497 dynamic addressing that enables ECU silencing for collision-free injection.
• The attack is classified as CVE-2024-12054 (CVSS 5.4 Medium) — the relatively moderate score reflects high attack complexity and limited impact scope (the disclosure was intentionally conservative), but the physical safety implications of unauthorized brake ECU access deserve attention beyond the CVSS number.
• This represents the third generation of NMFTA wireless truck hacking research, progressing from passive reception (2020) to active injection (2022) to authenticated diagnostic access (2025).
• Migration to cryptographically secure seed-key protocols (UDS Service $29) and J2497 wireless injection mitigations at the tractor level are the actionable paths forward.

About the Speaker

Ben Gardiner is a cybersecurity researcher at the National Motor Freight Traffic Association (NMFTA), an industry organization representing less-than-truckload (LTL) motor freight carriers. His research focuses on heavy vehicle cybersecurity, with a particular emphasis on the J2497 powerline communications bus and its security implications for commercial trucking. He co-authored the "Trailer Shouting" talk at DEF CON 30 (with Chris Poore) and has presented and published extensively on truck hacking since 2019. His work combines protocol reverse engineering, SDR-based wireless attack research, and coordinated vulnerability disclosure with OEM manufacturers and standards bodies. He collaborates closely with his NMFTA colleague Anne Zachos on on-site truck security testing engagements.