As modern commercial vehicles become increasingly interconnected, the tank truck industry is fighting a continuous battle to secure the digital networks that keep liquid freight moving.

To help fleet professionals proactively build their defensive skills, the National Motor Freight Traffic Association (NMFTA) recently launched an interactive cybersecurity challenge. And what serves as a virtual training ground for the sector’s cyber defenders arrives alongside an urgent, real-world warning for bulk haulers: a critical vulnerability in tractor-trailer braking systems continues to leave tank truck operators uniquely exposed to wireless hackers.

The organization’s inaugural Fleet Cyber Challenge provides a complimentary, online capture-the-flag (CTF) open lab where participants can investigate weaknesses in commercial vehicle technologies. This innovative educational push intersects with a fresh discovery by NMFTA researchers that recent Bendix EC80 safety recalls also remediate critical security flaws—a revelation that builds on the group’s ongoing investigations into tanker vulnerabilities.

“I’m excited about it because I’m a CTF addict, and it’s the way a lot of people get into cybersecurity,” Ben Gardiner, NMFTA’s senior cybersecurity research engineer, told Bulk Transporter.

“There’s a certain energy to it that really captures cybersecurity nerds.”

The fleet cyber challenge

The new platform features seven challenge tracks and 32 individual exercises covering threats to electronic logging devices, GPS spoofing, telematics, and vehicle communications. Designed for fleet IT teams, maintenance technicians, and security researchers, the online environment runs emulated versions of electronic control units rather than simple data simulations.

“Shortly after that demo, we caught wind of the Bendix EC80 safety recall, and the recall language submitted by the OEMs and suppliers indicates the brake controllers were listening for commands and doing extensive processing.

“So we reverse engineered that vulnerability and discovered exactly what they were doing before the update.”

A security recall in disguise

The National Highway Traffic Safety Administration’s recall affects numerous heavy-duty truck manufacturers, including Peterbilt, Volvo, and International, covering EC80 ABS ECUs with Power Line Carrier trailer communication. NMFTA research confirms that these safety updates also address critical cybersecurity vulnerabilities that hackers could exploit wirelessly.

But while all commercial trailers run similar braking hardware, NMFTA found that tank trailers are more susceptible to wireless attacks due to their physical construction. Unlike a standard dry van—which is primarily built of fiberglass with metal confined to the edges or subframe—a tanker features a continuous metal shell. When a brake controller is installed, its ground is typically chassis-bonded directly to the trailer. So when attackers broadcast radio frequency signals, that metal shell acts as a big antenna, moving the signals across the ground plane. And because the brake controller reads voltage as a difference, or delta, the fluctuation effectively induces the malicious command into the braking system.

“It’s very important for bulk haulers to complete that EC80 safety recall on all of their tractors, because that recall also remediates security issues,” Gardiner stressed. “What we discovered is really unfortunate—that the most susceptible equipment is the equipment that also hauls the most hazardous materials.”

Next steps for fleets

Gardiner urges carriers to apply the Bendix software updates immediately using the standalone utility provided to dealers and fleets.

In the meantime, fleet IT staff and technicians can sharpen their defensive skills by registering for the Fleet Cyber Challenge. And NMFTA is continuing to research mitigations specifically for tankers, recently conducting rolling tests at a former Air Force base in Rome, New York.

“We think there’s a way to mitigate these wireless attacks based on the results we had in those tests,” Gardiner said. “And if anyone is willing to host us, we would love to go to their site to continue testing and really zero in on how we can protect tankers in a way fleets could easily deploy.”