Analyzing Smart Farming Automation Systems for Fun and Profit

Overview: Felix and Bernhard, operational technology (OT) penetration testers, present an in-depth hardware and cloud security evaluation of aftermarket smart farming automation systems. The researchers investigate the rapid digitization of agriculture, focusing on retrofit autonomous guidance kits that equip conventional tractors with motorized steering and GPS-guided navigation. Focusing on dominant market systems from FJDynamics (AT2) and its OEM rebrand FAMO, the talk details critical vulnerabilities across cloud MQTT brokers, Android-based cockpit HMIs, and over-the-air firmware updates.

Key Topics: - Smart agriculture modernization and aftermarket tractor guidance architectures - Broken TLS certificate verification and hardcoded credentials in FJDynamics AT2 - Dynamic client certificate extraction using Frida memory instrumentation - Cloud MQTT broker multi-level wildcard abuse and global fleet telemetry leakage - Pre-rooted Android cockpit tablets and unsigned OTA drive-by firmware injection

Technical Details: The researchers evaluated the FJDynamics AT2 and FAMO aftermarket tractor kits, which cost $5,000 to $10,000 and include a cockpit Human-Machine Interface (HMI) Android tablet, a motorized steering wheel unit, a roof-mounted RTK GPS antenna, and a wireless remote. The tablet connects over 4G/LTE to a centralized cloud MQTT broker situated in China, transmitting real-time GPS coordinates, vehicle speed, and operational telemetry while receiving remote commands.

To intercept device traffic without physically dismantling rental hardware, the researchers redirected network flows to a raw Netcat socket. They discovered that the tablet completely omitted TLS server certificate validation, accepting any presented certificate. Furthermore, the client transmitted static, shared credentials (using the generic product ID "AT2" and a static password) rather than per-device credentials. While the broker enforced mutual TLS (mTLS) requiring a client certificate, the client binary was heavily obfuscated. The researchers deployed Frida for dynamic binary instrumentation, hooking native cryptographic functions in memory to extract the embedded client TLS certificate and private key.

Armed with the extracted certificate, the researchers connected to the cloud broker and injected an MQTT multi-level wildcard (`#`). The broker lacked proper topic access controls, instantly leaking real-time telemetry from over 40,000 connected systems across Asia, Europe (~15,000 systems), and North America (~300 systems). To ingest the resulting flood of ~100,000 messages per second, the team built a custom tool called "TTOR." The exposed data revealed farmers' home addresses, live field boundaries, tractor movements on public roads, and personal contact info. Furthermore, the broker allowed arbitrary clients to publish unauthorized `lock` commands, remotely bricking automation features across the entire global fleet. On the hardware side, the Android HMI was pre-rooted by the vendor (using an insecure `su` binary), and the over-the-air (OTA) update mechanism transmitted unencrypted APKs verified only by an MD5 hash, allowing network MitM attackers to push malicious payloads and obtain root shell access via Meterpreter.

Key Takeaways: AgTech and IoT hardware manufacturers must implement strict TLS server certificate validation and isolate device credentials using per-device asymmetric keys or hardware security elements. Cloud MQTT brokers must enforce strict per-tenant topic authorization and rate limiting, prohibiting multi-level wildcard subscriptions across shared infrastructure. Over-the-air firmware update mechanisms must mandate cryptographic digital signature verification (e.g., RSA or ECDSA) over encrypted transport rather than relying on weak MD5 checksums, and production embedded operating systems must never ship with pre-rooted debug binaries.

(AI summary — Gemini Flash)