Most passenger cars keep their wiring a secret. Heavy trucks do not, and that difference is why a security group at the University of Waterloo is using one as a rolling laboratory. Professor Sebastian Fischmeister and his team are probing a Peterbilt supplied by Challenger Motor Freight for the weak points an attacker could use, and for the earliest signs that someone is already inside.
The project pulls together Transport Canada, Challenger, Geotab, the Automotive Parts Manufacturers’ Association and the European firm EVList. The truck gives the researchers something a bench cannot: live traffic on SAE J1939, the open standard that carries messages across heavy-vehicle networks. Passenger cars bury their architectures in proprietary designs, which makes traffic hard to decode. J1939 can be read, modeled and tested.
Beneath it sits the Controller Area Network, and with it a flaw engineers have known about for years. The bus has no sender authentication, so a device on the network can broadcast a message pretending to be another part. It does not encrypt, either. Once someone is on the bus, that gap opens the door to impersonating an electronic control unit, which matters when braking and acceleration travel as messages.
So the work looks past keeping intruders out. It weighs whether a truck can tell that a message did not come from the part it claims to represent, and how quickly an intrusion can be caught before it reaches systems a driver depends on.
Commercial fleets are a softer target than many assume. Telematics units, logging apps and dealer add-ons widen the surface, and trucks stay in service far longer than cars. Proving that a working semi can flag a counterfeit message is the first step toward hardware that does it on the road.
