Hungry, Hungry Hackers: A Hacker’s Eye-view of the Food Supply

Casey Ellis presented this session in place of Sick Codes, who could not travel to the event. The talk follows how security research into agricultural equipment shifted how an industry thinks about safety-critical systems. It starts with a flaw in a John Deere customer system that exposed account details to anyone holding a free developer account, and with the vendor's first response, which downplayed the problem.

The middle section covers the follow-on work: a jailbreak of a tractor head unit, a dispute over a private bounty that offered no real disclosure path, and a backdoor found in TCL televisions that later drew attention from federal agencies. The discussion also looks at incidents such as the Colonial Pipeline ransomware attack and the JBS breach, and how they pushed critical infrastructure and agricultural connectivity up the agenda. John Deere eventually ran its own challenges and opened a disclosure program.

In the question round, the speaker argues that any organization needs a way to receive outside vulnerability reports, that private-only programs built around NDAs are not true disclosure, and that researchers should start with private outreach while considering how the vendor will react. The takeaway is that research into physical and safety-relevant systems carries real consequences, so it needs a deliberate path to the people who can fix it.