Could Software Bugs Lead to a Repeat of the 'Killdozer'?
This week, Vice reported that a security researcher who goes by the name Sick Codes found two bugs in the apps of farm equipment manufacturer John Deere.
The breach is in the John Deere Operations Center Mobile app for iOS and Android, and its web version. Sick Codes told Vice, "I could download the data of every owner of every single John Deere tractor in the world." This data included the vehicle owner's name, address, equipment GUID (which is a permanent equipment ID), and a Vehicle Identification Number (VIN) for each vehicle.
The data that could be seen also included whether the John Deere vehicle could be operated autonomously, steered by GPS, and with onboard computers. Autonomous farm vehicles were first pioneered in the 1950s when Ford developed a driverless tractor called "The Sniffer". It was not implemented because it relied on running wires underground throughout a field.
Today's autonomous tractors use GPS positioning and automation software to manage a vehicle's path and control whatever farming implements are being used. These implements range from creating furrows to devices for seeding, fertilizing, weeding, and picking. Tractors also use sensor technologies such as LIDAR to detect obstacles and react to them.
According to NASA, by 2015, 60 – 70 percent of the crop acreage in North America was being farmed using self-guidance systems, as was 30 – 50 percent of the farmland in Europe and South America, and more than 90 percent of Australian farmland.
The vulnerabilities identified by Sick Codes in John Deere's codebase mean that, theoretically, a hacker could take control of one of these huge machines, and if that doesn't impress you, it's time to meet the "Killdozer".
By June 4, 2004, Marvin Heemeyer had been feuding for years with officials of the town of Granby, Colorado. Heemeyer's beefs with the city were over the zoning for the 2-acre parcel where he had his muffler repair business. Heemeyer also had a beef with his next-door neighbor, a concrete business that had recently been granted approval by the City of Granby to expand.
This expansion would eliminate road access to Heemeyer's muffler shop, and make his ability to connect a sewer line almost impossible. Heemeyer had bought a Komatsu D355A bulldozer to build a road to his shop prior to the approval of the concrete business's expansion, and in 2003, with his patience at an end, Heemeyer began modifying the bulldozer.
Heemeyer created composite armor by sandwiching Quikcrete concrete between sheets of tool steel. In places the armor was more than 30 cm (a foot) thick. He installed multiple video cameras, linked to monitors inside the bulldozer's cab, and he protected those cameras behind 76 mm (3-inch) thick sheets of bulletproof lexan. He even added compressed-air nozzles to blow away any dust from the video cameras.
Heemeyer also added gunports and mounted a Barrett M82 anti-materiel rifle to the front, while an FN FNC NATO assault rifle and a Ruger Mini-14 semi-automatic rifle protruded from portholes on the sides. Inside was food, water, a gas mask, a Smith & Wesson .357 revolver, and a Kel-Tec P-11 pistol.
On June 4, 2004, Heemeyer sealed himself inside the cab of the Killdozer, and drove it out through the wall of the garage in his muffler shop. Heemeyer headed first to the concrete business, where he leveled several buildings. When owner Cody Docheff attempted to block the path of the Killdozer with a tractor, Heemeyer fired on him.
As the attack unfolded, police swarmed the area, but the Killdozer was impervious to their weapons and even to those of a SWAT team. Emergency dispatchers alerted the town's residents to the danger through reverse 911 calls. At one point during the attack, undersheriff Glenn Trainor climbed on top of the bulldozer, which was coated with oil, and rode it while attempting to find a way in. Trainor fired shot thirty-seven rounds from his service pistol into the plating, to no effect, before slipping off the vehicle.
Heemeyer next headed to the Town Hall, which he also leveled. Police could be heard on their radios begging for "the biggest armor-piercing ammunition you have." Next to the Town Hall was the town's library, where children were attending a story hour before being evacuated just in time.
As news of the rampage spread, Colorado's governor, Bill Owens, considered asking the National Guard to either drop a Hellfire missile from an Apache attack helicopter, or to use a Javelin anti-tank missile to destroy the Killdozer.
The Killdozer next destroyed the office of the town's newspaper before heading to the home of the town's mayor, who had died previously. The Killdozer destroyed the home of the mayor's 82-year-old widow.
After the Killdozer faced off against a huge earth moving machine in a scene that looked like something out of a Transformers movie, Heemeyer headed to Gambles Hardware Store, which was owned by a man who was on the town council. When the driver of the earth mover boxed Heemeyer into a narrow alley next to the hardware store, Heemeyer attempted to plow through the alley and onto an adjacent street, however, the Killdozer's treads became stuck.
After several minutes, police approaching the vehicle heard a single gunshot, Marvin Heemeyer had shot himself in the head. It took until 2:00 a.m. the next morning before authorities could cut through the bulldozer's hatch with an oxyacetylene cutting torch and extricate his body.
In all, 13 of Granby's buildings were either destroyed or damaged, resulting in total damages estimated at more than $7 million. Natural gas to the Town Hall and the concrete business had been knocked out. Most interestingly, no one in Granby was injured during the rampage, even though Heemeyer fired at both power transformers and propane tanks. Heemeyer had also fired at Cody Docheff, and he also allegedly fired on two state police officers.
In 2019, director Paul Solet released his documentary Tread about Heemeyer's rampage. It appeared on Netflix in February 2020. But this is not the first time a killer truck has featured in film. Director Steven Spielberg's feature-length directorial debut was 1971's Duel, based on a short story of the same name written by Richard Matheson. It tells the story of a driver on a lonely road who finds himself being chased to death by a huge Peterbilt 281 truck. Originally shot as a TV movie-of-the-week, new scenes were added and the film was released theatrically. Today, it is recognized as a cult classic.
The 1974 Jerry London made for TV film, Killdozer, is another cult hit. It is about a construction crew who are terrorized when an evil being takes over a large bulldozer, and goes on a killing rampage. A comic book adaptation appeared the same year, in Marvel Comics' Worlds Unknown #6.
Audio recordings that Heemeyer left behind describing his motivation for the attack are available on the Internet Archive. In the recordings, Heemeyer says that, "God built me for this job" and that the attack was God's plan. In writings, Heemeyer left behind, he wrote that "I was always willing to be reasonable until I had to be unreasonable. Sometimes reasonable men must do unreasonable things."
If hackers are able to exploit software bugs that will allow them to take control of huge autonomous vehicles, our only hope may be that they do not do "unreasonable things."