Hungry, Hungry Hackers

The talk starts with a researcher's look at a farm-equipment vendor's developer portal, where a form for registering a machine by its identification number returned full customer account records in its response. The vendor had no bug bounty at the time, so the researcher published the finding instead of signing a non-disclosure agreement. Press coverage followed, and the company later launched a bounty and a formal cyber program.

From there the talk widens to the wider agriculture sector. It covers a jailbroken tractor running custom software, a report that equipment seized in Ukraine was disabled remotely, and recent ransomware attacks on a meat processor, grain co-ops, a fuel pipeline and a food producer. It also looks at the split between food and agriculture information-sharing groups, a manufacturer-run cyber tractor challenge, a proposed US farm security bill, and cross-sector dependencies on rail, water, rural healthcare and finance.

The closing takeaways are that vendors should be ready to receive reports even without a bounty, that competitors gain by sharing threat knowledge, and that equipment needs signed firmware updates and unique keys rather than a shared key. In the Q&A, the answers suggested that non-technical people can help by favouring secure products when they buy and by explaining risk in plain terms.