The short answer is “yes.” A recent article at Forbes’ website shares the story of Federico Maggi and Marco Balduzzi, two researchers who work for Trend Micro, a leading cybersecurity company. Maggi and Balduzzi traveled to various construction sites in the Lombardi region of Italy in early 2018 with the goal of convincing site managers to give them a chance at taking control of their cranes. After numerous rejections, one site manager named Matteo played along, turned off his transmitter and stopped the crane. The hackers went into action with a laptop computer and simple radio frequency (RF) equipment. Within seconds they had, to Matteo’s bewilderment, taken control of the crane.
Over the next few weeks these “crane spotters” managed to convince other construction site managers at 15 locations to allow them to hack into their cranes and other large machinery. The hacking process took a little time, in that commands coming from the RF controller had to be reverse engineered, duplicated, and sometimes decoded due to their own idiosyncrasies. This was often executed with little or no airwave security. Ultimately the computer scripts they had deciphered worked successfully every time.
Maggi and Balduzzi’s hacking scripts could be categorized into five different types:
Replay - Records commands for later use.
Command injection – The hack intercepts outgoing commands, modifies, then sends them to the crane.
E-stop abuse – Shuts the power down to the crane. Can be used to hold an entire construction site hostage, requiring a company to pay a ransom before hackers release the machinery.
Malicious repairing - Hackers take over the crane by cloning the controller.
Malicious reprogramming - Makes the controller permanently vulnerable.
Armed with this compilation of information, the researchers published a paper highlighting the vulnerability of cranes to a range of nefarious activity “from theft and extortion to sabotage and injury.” The cranes by themselves posed no threat, but the security of communication between controller and crane was questioned. Researchers found that car door locks and garage door openers were more secure than RF transmitters for cranes and heavy equipment.
In response to these security threats, vendors of remote transmitters have released updated firmware, some of them for the first time.
More can be read at “Hackers Take Control Of Giant Construction Cranes” by clicking here. Image above courtesy of pixabay.com.
