9 ms·

Polish railway system hacked, trains forced to stop by attackers

66 points by beardedwizard 3y ago

beardedwizard 3y ago
Couldn't revise title, more accurate to say "attacked". Depending on how you define hacking, you may consider radio based attacks as something else.
- nxobject 3y ago
  Well, it's an interesting question: how much technology/authentication do you need in order to call exploiting a security weakness hacking?
  - spacecadet 3y ago
    A coper wire and a tuning fork. Ones own mouth.
  - smcl 3y ago
    I don't know if it's worth splitting hairs on this. If the Cap'n Crunch 2600 hertz whistle was a hack then this kinda is too.
    - xcdzvyn 3y ago
      I'll gladly agree to disagree, but I still think there was some degree of ingenuity involved in the whistle thing that would make it "hacking", whereas these kids basically just called a phone number.
      - smcl 3y ago
        Yeah the main thing is - terminology aside - if you can easily bring a nation's rail network to a standstill then that's a bit of a problem.
    - ilyt 3y ago
      Back then "hack" didn't really meant what it means now. Now it is much more of a blanket term for near-anything
    - nxobject 3y ago
      I'll admit, I find that this question goes alongside "is a hotdog a taco or sandwich?" in my box of amusing questions to think about on the toilet.
  - beardedwizard 3y ago
    I would be pretty confident the hackers who carried it out don't parse it this finely, they are just happy it was so easy.
    - jacquesm 3y ago
      Destruction is so much easier than creation. In a normal society there are ample opportunities for easy and cheap destruction. Given a handful of motivated and smart people and within an hour or two and $500 in budget you can significantly harm any open society. But that doesn't mean that you are smart, it just means that as an attacker you have it easy. Electrical infrastructure, water, gas, telecommunications, railways and so on are all wide open to abuse and sabotage. Doing so however is in my opinion about as close as an act of war as you can get if you do it from another country and should net you a decade or more in jail if not. It's also supremely cowardly, not unlike calling in a bomb threat on an airport. Assholes will be assholes.
  - viraptor 3y ago
    You should break some kind of layer of protection or find some secret piece of information for it to be hacking. Otherwise you're just doing what anyone could do but had the decency not to.
    - jacquesm 3y ago
      How are you going to ensure that in a real emergency no time is lost digging up the secret piece of information of breaking the layer of protection? By the time you've done that the accident has already happened.
      - viraptor 3y ago
        I'm not saying anything would be changed. Just that this is not hacking. In the same way breaking the green lights at an intersection is not hacking.
        jacquesm 3y ago
        Fully agreed on that.
  - andrewaylett 3y ago
    If you're using something in a way that wasn't intended by its manufacturer, that's a hack.
  - tamimio 3y ago
    Hacking actually means modifying something or repurposing it to do something else that wasn’t its main purpose. It is not necessarily a security breach, but I blame Hollywood on this.
    - beardedwizard 3y ago
      Where is that written authoritatively that makes you so confident in such a statement? Non train operators repurposed radio equipment to stop trains. See how a bit of grammar makes all the difference, or maybe...just maybe trying to parse the term hacking so finely is part of the problem.
      - tamimio 3y ago
        > Non train operators repurposed radio equipment to stop trains. Exactly, see what I said above >not necessarily a security breach So in short, a security breach CAN be hacking (sometimes it’s not like mitm etc.), but every hacking is not a security breach. Say I used a company server to propagate another attack, that might be hacking by definition, but hacking a toaster with some rubber band to do X is definitely not a security breach.
ajuc 3y ago
Some jerks called through short-wave radio to a well-document emergency stop service. It's about as much of a "hack" as calling to your school and saying there's a bomb.
- beardedwizard 3y ago
  20 trains filled with people stopped, ease of exploitation is irrelevant - many events reported as hacks stem from obvious negligence, this is the same as writing an admin password down or leaving it default and having it used by attackers. I also left a comment addressing the potential for varied interpretations of hacked.
  - progbits 3y ago
    Emergency stop signal should be easy to send when it is needed. Most trains have a emergency brake lever inside which is also very easy to abuse, but is there for safety. It is better to enforce harsh penalties for abuse.
    - mschuster91 3y ago
      In Germany, in addition there is yet another emergency signal - if you need a train to stop (say, because someone fell into the tracks) and you can see the train (so no time to call 112), wave your hand in a circular motion [1]. [1] http://www.tf-ausbildung.de/SignalbuchOnline/sh3.htm http://www.tf-ausbildung.de/SignalbuchOnline/sh3.htm
      - throw_a_grenade 3y ago
        Same in Poland, though here you can also use white lantern, if you don't have red one.
    - mytailorisrich 3y ago
      Harsh penalties are ineffective and irrelevant in terrorism and warfare situations, or even only against lunatics. Here I don't think that this signal system is designed to be used by the public. I'm guessing that there are transmitters installed and operated by the railways and perhaps police/emergency services but no-one else. I am sure that the system will now be upgraded to include cryptographic authentication or something to that effect.
yread 3y ago
So someone unauthorized emitted a radio signal that 20 trains just accepted as emergency stop signal (presumably because there was no verification)?
- beardedwizard 3y ago
  Yes, and this has been possible since the 70s.
- tialaramex 3y ago
  You don't want time for any non-mechanical verification because stopping a train needs to begin immediately if there are serious problems Poland is apparently in the process of purchasing and installing GSM-R, which is basically like old mobile phone (cellular radio) technology but specifically for Railways. Although GSM's security is hardly state of the art it would definitely be reasonable to call that "verification" if they had it. The "easy" way for lay people to send such a message under GSM-R would be to obtain a real transmitter, maybe steal one. Presumably since they're buying GSM-R they currently have either an ad hoc secure system or they don't have a secure system at all and so in the latter case yes there would be no verification.
  - yread 3y ago
    I was thinking more like cryptographical verification not manual
phaiax 3y ago
More context: https://www.wired.com/story/poland-train-radio-stop-attack/ https://www.wired.com/story/poland-train-radio-stop-attack/
Kwpolska 3y ago
This isn’t hacking. The “system” is analogue radio, and the sequence of tones to activate emergency braking is public knowledge. Here: go to [0] and search with Ctrl-F for "radiostop". Now you can become a “hacker” too. [0]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02006D0860-20130124 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A... (via niebezpiecznik.pl)
- dobin 3y ago
  As the gruq discussed in his keynote at HITB-HKT a few days ago, one can make the argument that the "train system" was hacked: Simple mechanisms were used to bring the whole system down.
- tgv 3y ago
  The sequence of tones to influence telephone switchboards were known as well. It was the origin of hacking. This may be an easy hack, but it still is one. BTW, it's good that attention is being called to it. There is a bit of tension in the region, as you may know, and opponents are not going to play nice. That also makes me suspect this was not a malicious attack.
- precommunicator 3y ago
  Not even that. Trains in Poland are generally using analog radio, if you go on frequency, which you can find publically, or just scan for it and say [specific phrase which you can find on Wikipedia] five times, that's the equivalent of playing the recording. All train operators who will hear that must stop immediately.
rasz 3y ago
The "attack" is use of standard A 1r 'Alarm' signal for Radio-Stop rail system. Signal described in detail in readily available Ie-1 rail signaling manual, official Ministry of Infrastructure regulations, EU regulations (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32006D0860 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...) and manuals for rail radio systems. There are multiple YT tutorials going back 10 years. Comments under one of the recent ones from 9 months ago already mention someone being arrested for doing very same thing 3 months prior. Problem is its a simple signal consisting of three standard https://en.wikipedia.org/wiki/Selcall https://en.wikipedia.org/wiki/Selcall tones. Its same as https://www.dallasnews.com/news/politics/2017/04/12/dallas-spends-100000-to-upgrade-emergency-sirens-after-hack-but-it-s-just-the-beginning/ https://www.dallasnews.com/news/politics/2017/04/12/dallas-s... Solution is adoption of https://en.wikipedia.org/wiki/GSM-R https://en.wikipedia.org/wiki/GSM-R

66 points by beardedwizard 3y ago

Couldn't revise title, more accurate to say "attacked". Depending on how you define hacking, you may consider radio based attacks as something else.

nxobject 3y ago
Well, it's an interesting question: how much technology/authentication do you need in order to call exploiting a security weakness hacking?
- spacecadet 3y ago
  A coper wire and a tuning fork. Ones own mouth.
- smcl 3y ago
  I don't know if it's worth splitting hairs on this. If the Cap'n Crunch 2600 hertz whistle was a hack then this kinda is too.
  - xcdzvyn 3y ago
    I'll gladly agree to disagree, but I still think there was some degree of ingenuity involved in the whistle thing that would make it "hacking", whereas these kids basically just called a phone number.
    - smcl 3y ago
      Yeah the main thing is - terminology aside - if you can easily bring a nation's rail network to a standstill then that's a bit of a problem.
  - ilyt 3y ago
    Back then "hack" didn't really meant what it means now. Now it is much more of a blanket term for near-anything
  - nxobject 3y ago
    I'll admit, I find that this question goes alongside "is a hotdog a taco or sandwich?" in my box of amusing questions to think about on the toilet.
- beardedwizard 3y ago
  I would be pretty confident the hackers who carried it out don't parse it this finely, they are just happy it was so easy.
  - jacquesm 3y ago
    Destruction is so much easier than creation. In a normal society there are ample opportunities for easy and cheap destruction. Given a handful of motivated and smart people and within an hour or two and $500 in budget you can significantly harm any open society. But that doesn't mean that you are smart, it just means that as an attacker you have it easy. Electrical infrastructure, water, gas, telecommunications, railways and so on are all wide open to abuse and sabotage. Doing so however is in my opinion about as close as an act of war as you can get if you do it from another country and should net you a decade or more in jail if not. It's also supremely cowardly, not unlike calling in a bomb threat on an airport. Assholes will be assholes.
- viraptor 3y ago
  You should break some kind of layer of protection or find some secret piece of information for it to be hacking. Otherwise you're just doing what anyone could do but had the decency not to.
  - jacquesm 3y ago
    How are you going to ensure that in a real emergency no time is lost digging up the secret piece of information of breaking the layer of protection? By the time you've done that the accident has already happened.
    - viraptor 3y ago
      I'm not saying anything would be changed. Just that this is not hacking. In the same way breaking the green lights at an intersection is not hacking.
      - jacquesm 3y ago
        Fully agreed on that.
- andrewaylett 3y ago
  If you're using something in a way that wasn't intended by its manufacturer, that's a hack.
- tamimio 3y ago
  Hacking actually means modifying something or repurposing it to do something else that wasn’t its main purpose. It is not necessarily a security breach, but I blame Hollywood on this.
  - beardedwizard 3y ago
    Where is that written authoritatively that makes you so confident in such a statement? Non train operators repurposed radio equipment to stop trains. See how a bit of grammar makes all the difference, or maybe...just maybe trying to parse the term hacking so finely is part of the problem.
    - tamimio 3y ago
      > Non train operators repurposed radio equipment to stop trains. Exactly, see what I said above >not necessarily a security breach So in short, a security breach CAN be hacking (sometimes it’s not like mitm etc.), but every hacking is not a security breach. Say I used a company server to propagate another attack, that might be hacking by definition, but hacking a toaster with some rubber band to do X is definitely not a security breach.

ajuc 3y ago

Some jerks called through short-wave radio to a well-document emergency stop service. It's about as much of a "hack" as calling to your school and saying there's a bomb.

beardedwizard 3y ago
20 trains filled with people stopped, ease of exploitation is irrelevant - many events reported as hacks stem from obvious negligence, this is the same as writing an admin password down or leaving it default and having it used by attackers. I also left a comment addressing the potential for varied interpretations of hacked.
- progbits 3y ago
  Emergency stop signal should be easy to send when it is needed. Most trains have a emergency brake lever inside which is also very easy to abuse, but is there for safety. It is better to enforce harsh penalties for abuse.
  - mschuster91 3y ago
    In Germany, in addition there is yet another emergency signal - if you need a train to stop (say, because someone fell into the tracks) and you can see the train (so no time to call 112), wave your hand in a circular motion [1]. [1] http://www.tf-ausbildung.de/SignalbuchOnline/sh3.htm http://www.tf-ausbildung.de/SignalbuchOnline/sh3.htm
    - throw_a_grenade 3y ago
      Same in Poland, though here you can also use white lantern, if you don't have red one.
  - mytailorisrich 3y ago
    Harsh penalties are ineffective and irrelevant in terrorism and warfare situations, or even only against lunatics. Here I don't think that this signal system is designed to be used by the public. I'm guessing that there are transmitters installed and operated by the railways and perhaps police/emergency services but no-one else. I am sure that the system will now be upgraded to include cryptographic authentication or something to that effect.

yread 3y ago

So someone unauthorized emitted a radio signal that 20 trains just accepted as emergency stop signal (presumably because there was no verification)?

beardedwizard 3y ago
Yes, and this has been possible since the 70s.
tialaramex 3y ago
You don't want time for any non-mechanical verification because stopping a train needs to begin immediately if there are serious problems Poland is apparently in the process of purchasing and installing GSM-R, which is basically like old mobile phone (cellular radio) technology but specifically for Railways. Although GSM's security is hardly state of the art it would definitely be reasonable to call that "verification" if they had it. The "easy" way for lay people to send such a message under GSM-R would be to obtain a real transmitter, maybe steal one. Presumably since they're buying GSM-R they currently have either an ad hoc secure system or they don't have a secure system at all and so in the latter case yes there would be no verification.
- yread 3y ago
  I was thinking more like cryptographical verification not manual

phaiax 3y ago

More context: https://www.wired.com/story/poland-train-radio-stop-attack/ https://www.wired.com/story/poland-train-radio-stop-attack/

Kwpolska 3y ago

This isn’t hacking. The “system” is analogue radio, and the sequence of tones to activate emergency braking is public knowledge. Here: go to [0] and search with Ctrl-F for "radiostop". Now you can become a “hacker” too. [0]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02006D0860-20130124 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A... (via niebezpiecznik.pl)

dobin 3y ago
As the gruq discussed in his keynote at HITB-HKT a few days ago, one can make the argument that the "train system" was hacked: Simple mechanisms were used to bring the whole system down.
tgv 3y ago
The sequence of tones to influence telephone switchboards were known as well. It was the origin of hacking. This may be an easy hack, but it still is one. BTW, it's good that attention is being called to it. There is a bit of tension in the region, as you may know, and opponents are not going to play nice. That also makes me suspect this was not a malicious attack.
precommunicator 3y ago
Not even that. Trains in Poland are generally using analog radio, if you go on frequency, which you can find publically, or just scan for it and say [specific phrase which you can find on Wikipedia] five times, that's the equivalent of playing the recording. All train operators who will hear that must stop immediately.

rasz 3y ago

The "attack" is use of standard A 1r 'Alarm' signal for Radio-Stop rail system. Signal described in detail in readily available Ie-1 rail signaling manual, official Ministry of Infrastructure regulations, EU regulations (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32006D0860 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...) and manuals for rail radio systems. There are multiple YT tutorials going back 10 years. Comments under one of the recent ones from 9 months ago already mention someone being arrested for doing very same thing 3 months prior. Problem is its a simple signal consisting of three standard https://en.wikipedia.org/wiki/Selcall https://en.wikipedia.org/wiki/Selcall tones. Its same as https://www.dallasnews.com/news/politics/2017/04/12/dallas-spends-100000-to-upgrade-emergency-sirens-after-hack-but-it-s-just-the-beginning/ https://www.dallasnews.com/news/politics/2017/04/12/dallas-s... Solution is adoption of https://en.wikipedia.org/wiki/GSM-R https://en.wikipedia.org/wiki/GSM-R