Your Truck's ECU Can Be Hacked: What the Research Actually Shows

Is it actually possible to hack a truck's ECU?

Short answer: yes, and it's been demonstrated more than once by named researchers on real trucks, not just in theory. Academic researchers have shown they can send unauthorized commands to a truck's engine and braking systems through its onboard network. Separately, a real safety-recall patch for a widely used brake controller quietly fixed a flaw that could have let a remote attacker disable anti-lock brakes. Neither of these requires exotic access. Both trace back to the same thing: a truck's internal network was designed to trust any device connected to it, and modern trucks connect a lot of devices to it, some of them wirelessly.

How can an attacker actually get access to a truck's internal network?

Every modern heavy-duty truck in the U.S. uses the SAE J1939 standard for internal communication between its electronic control units, engine, brakes, transmission, and instrument cluster all talk to each other over this shared network. Researchers Yelizaveta Burakova, Bill Hass, Leif Millar, and André Weimerskirch demonstrated in a peer-reviewed 2016 paper that once connected to a truck's J1939 network, they could accelerate a truck already in motion, disable the driver's ability to accelerate, and disable the vehicle's engine brake (source: USENIX WOOT '16). Earlier University of Michigan research demonstrated the same class of attack on a real Class-8 semi-tractor and a school bus, manipulating instrument gauges, engine RPM, and engine braking (source: cited via arXiv survey).

The J1939 network itself has no built-in way to check whether a message came from a legitimate source. Any device wired into it is trusted by default. That's the underlying design issue every attack in this space exploits.

Why does the diagnostic port matter if these attacks need a physical connection?

Because trucks aren't only accessed through a technician's laptop plugged into the dashboard anymore. Federal regulation requires every commercial truck to run an Electronic Logging Device, or ELD, and that device connects directly to the engine's network by design, and in most implementations, connects to the internet as well. The National Motor Freight Traffic Association (NMFTA), a trucking industry trade group, has stated publicly that current ELD rules effectively require both two-way CAN bus connectivity and internet connectivity, which it describes as creating a bridge between the internet and a truck's internal vehicle network (source: NMFTA).

That bridge is exactly what a 2024 study from Colorado State University researchers Jake Jepson, Rik Chatterjee, and Dr. Jeremy Daily tested directly. Working on a real 2014 Kenworth T270 Class 6 truck, they found ELDs could be wirelessly manipulated to send unauthorized CAN messages controlling engine speed and braking, reprogrammed with malicious firmware, and used to spread a self-replicating worm from one truck's ELD to another's, since many ELDs on the market share similar hardware and default security settings (source: Land Line Media, source: CCJ Digital).

Has this actually happened in the real world, or is it only lab research?

Both, and it's worth being precise about which is which. The J1939 and ELD vulnerabilities described above were demonstrated by researchers under controlled conditions, not discovered as active attacks on carriers in production. That said, one specific, real, already-deployed vulnerability is documented outside the lab: NMFTA cybersecurity researcher Ben Gardiner found that a firmware patch quietly included in a safety recall for Bendix EC80 brake controllers, hardware used in tractors and trailers already on the road, fixed a flaw that could have let a remote attacker disable anti-lock braking systems. NMFTA reported that this fix was never associated with a published CVE (the standard public vulnerability disclosure record), which means carriers running the affected hardware had no straightforward way to learn a security fix had shipped (source: CCJ Digital).

So the honest framing is this: the attacks are proven to work by credible researchers on real trucking hardware, and at least one real vulnerability affecting deployed equipment was quietly patched without carriers being clearly informed. That's a meaningfully different, and more urgent, situation than a purely theoretical risk.

What can a carrier actually do about this?

None of this requires becoming a cybersecurity company, but it does require treating truck electronics as IT infrastructure rather than pure mechanical equipment:

• ★Know exactly which ELD and telematics hardware is on your trucks, including the manufacturer and firmware version, so you can actually check for relevant advisories when they're published.
• ★Ask your ELD and telematics vendors directly about their security practices, including whether they publish CVEs for patched vulnerabilities and how firmware updates are authenticated.
• ★Don't assume FMCSA compliance equals security. ELD certification today is self-certified by manufacturers and doesn't include a mandatory cybersecurity review, which is part of why NMFTA has publicly pushed for FMCSA to overhaul ELD certification standards.
• ★Segment what you can. If your telematics or ELD vendor offers any option to limit what the device can access or transmit, use the most restrictive setting that still meets your compliance needs.
• ★Treat unexplained firmware updates or vendor advisories seriously, and ask what the update actually addresses rather than assuming it's routine.