20 ms·
A cheap radio hack disrupted Poland's railway system
- praptak 3y agoThis hack is publicly known since at least 2010, here's a police note about the earliest case I found (in Polish): https://policja.pl/pol/aktualnosci/56015,quotRadioamatorquot-zatrzymywal-pociagi.html https://policja.pl/pol/aktualnosci/56015,quotRadioamatorquot...
- jagrsw 3y agoThe Radio-Stop was not exactly a secret - I remember talking about it with an amateur radio operator ca. 2002. He was back then saying that the railways will start operating GSM-R in the near future, and the problem of the unauthenticated Radio-Stop will go away :)
- xnzakg 3y agohttps://archive.is/vXAEb https://archive.is/vXAEb
- smilespray 3y agoCould you effectively perform this hack from a satellite or an aircraft? 150 MHz should propagate quite a distance given line of sight.
- toomuchtodo 3y agohttps://en.wikipedia.org/wiki/Sporadic_E_propagation https://en.wikipedia.org/wiki/Sporadic_E_propagation Even without drones, aircraft, or spot beams on satellites, you might be able to do this with ionospheric bounce or tropospheric ducting. 150Mhz is on the top of 2 meter HAM radio.
- ajsnigrutin 3y agoWhy would you need a satellite for that? A $25 baofeng radio from aliexpress can transmit on those frequencies, and with minimal care (not bragging about it), you can do it from pretty much everywhere with a lot of trains around. The frequency is mentioned in the article, the only info missing is the tones, and i'm pretty sure there is some tech manual somewhere on the "polish internet" that mentions those exact tones.
- KptMarchewa 3y agoIt's public. 1160 Hz, 1400 Hz, 1670 Hz
- ajsnigrutin 3y agoaudacity, aprs k1 cable and a cheap baofeng, and you too can become a criminal :)
- dylan604 3y agoif only there were two more tones...play the five tones
- smilespray 3y agoMy thought was that you didn't need a bunch of people in the field to hit a large area in one go. I got one of those Baofengs. I wander what other mischief you could commit with them.
- Johnythree 3y agoOne of the reasons that the licensing authorities dislike the Baofengs is that they can be easily re-programmed (by unskilled users) to operate on most any VHF / UHF frequency. They are legal for use by licensed Radio Amateurs (because Hams can legally build and modify their own gear), but the importers used this loop-hole to sell them to other users (eg CB, MURS, commercial two way, etc). Unfortunately, the lax administration by the authorities have allowed this to become a serious issue.
- ajsnigrutin 3y agoBaofengs have two "problems"... First, and the reason for hate by the licencing authorities is, that they have emissions on other bands (higher harmonics), sometimes way above the allowed levels. And second, the more problematic here, is that they're cheap. Every airsofter, milsimer, prepper and mall ninja will buy one or two, in "tactical" camo colors with "tactical" antenna, usually one of those huge ones, painted camo, with some kind of "tactical" camo holster, to look "tactical"... while at the same time, they have no idea about frequencies, legalities and just use the preprogrammed channels or input a random frequency in the VFO mode. Before baofeng, this wasn't an issue... cheapest radios were in $150++ range, and paying $600 (or more) for four airsofters was a lot of money... now they can get a set for $100. And in camo and "tactical" designs. Doing what the person in the article did requires not just $30 of equipment but also at least some knowledge (which frequency, what tones, what timing, how to use audacity or whatever to generate those tones, etc.), and most of the "normal" abusers of baofeng can't do that... just look at the questions on /r/baofeng on reddit... most of them are "we can't hear eachoter", because they're looking at channel numbers instead of frequencies and/or have tones enabled, and "can i listen to <some service not on uhf>?".
- toomuchtodo 3y agoPrevious: https://news.ycombinator.com/item?id=37288856 https://news.ycombinator.com/item?id=37288856
- toss1 3y ago>>Because the trains use a radio system that lacks encryption or authentication for those commands, Olejnik says, anyone with as little as $30 of off-the-shelf radio equipment can broadcast the command to a Polish train—sending a series of three acoustic tones at a 150.100 megahertz frequency—and trigger their emergency stop function. Goes without saying here that this needs to be fixed ASAP. >>The railway agency wrote that “there is no threat to rail passengers. The result of this event is only difficulties in the running of trains.” There is no threat to rail passengers, unless a passenger train does not know about a stopped train ahead of it on the tracks, e.g., a cargo train go stopped by the hack, but the passenger train 10min behind it did not and continues to rush onward towards the stopped cargo train. IDK if Poland's control system would reliably detects these conditions, but if it does not with 100% reliability, this is a real threat.
- AnimalMuppet 3y agoRailway signaling works based on whether something is there, not based on whether it should be there. If the freight train stops, then the signals for the passenger train will tell it that it cannot proceed. I don't know anything specific about Poland's rail signaling, but they can't have messed that up. It's written in blood.
- KptMarchewa 3y agoThere's a way but multiple things have to go wrong. https://en.m.wikipedia.org/wiki/Szczekociny_rail_crash https://en.m.wikipedia.org/wiki/Szczekociny_rail_crash
- tialaramex 3y agoWow, that's a lot of places where human error was able to make things worse. Particularly the fact that it's possible to use a "subsidiary signal" to just override the problem. The equivalent British scenario calls for the signaller to vocally inform the driver (e.g. today over GSM-R) something akin to "Pass the danger signal at caution, obeying all other signals". This may mean if there are a multiple related failures, you need to "caution" drivers the same way repeatedly - but without that final sentence the driver may ignore signals that are not related to the failure you understood, and passing those really will kill somebody. The requirement to move "at caution" meaning with the ability to stop on sight means trains under these conditions don't go very fast - they can't, even on straight lines in broad daylight you can't see far enough to go full speed on a passenger train under those rules, but it also means if you screwed up and there is a serious problem the driver under caution can see the problem with enough time to stop. It further ensures there's an incentive not to allow such situations to persist as they presumably must have for Poland to deliberately fit the "subsidiary" lamps.
- fnord77 3y agowhy aren't hack sabotages seen as acts of war? they can do as much or more damage as, say, blowing up a bridge
- hawski 3y agoMaybe they could be, but you have to catch someone doing it first and it would have to be clear they are agents of a foreign government. That's not easy.
- at0mic22 3y agoYou don’t need to our days. Just blame Putin, sure bet
- nme01 3y agoI imagine that as with any covert operation it’s hard to prove who’s behind it. Blowing up a bridge is also not something that will cause a war easily.
- krisoft 3y ago> why aren't hack sabotages seen as acts of war? There is this mistaken belief that an act of war somehow immediately and automatically triggers war. This is not the case. If a country wants to wage war against an other they will find a reason. If they don't want to / it is not in their interest to do so they won't. This answers your question. It is not seen as an act of war because the country in question (Poland) wouldn't benefit from seeing it as an act of war at this moment in time.
- RIMR 3y agoIt's also fundamentally irrational to define malicious non-state actions as acts of war. As an example, if someone from Canada were to come to the US and blow up a government building, no matter how severe the damage and human loss, we wouldn't dare consider that an act of war by Canada, unless evidence existed that the Canadian government or military were involved somehow. Likewise, Poland has no interest in defining malicious actions by a Russian national or Russian Imperialism supporter as an act of war by Russia without clear evidence that The Russian state was directly involved. Getting back to the original point though, I see no reason not to define attacks against infrastructure, regardless of who was responsible, foreign or domestic, or their motives, as acts of terrorism.
- oatmeal1 3y agoThe world is astoundingly safe that these sorts of thing don't happen all the time. Anyone who could light a cigarette could start wildfires all over California and many other places during the summer. Anyone who can buy a GPS jammer could disrupt one of the busiest airports in the world. With all the misanthropes out there you'd think chaos would happen more often. Glad it doesn't.
- praptak 3y agoUp until a point anyone with a knife could hijack a plane and fly it into a building.
- noman-land 3y agoCeramic and plastic knives exist and could easily be smuggled aboard an airplane. I think the key insight is that most people don't want to do mass harm and instead just want to live in peaceful freedom and do their own thing.
- baud147258 3y agonow the pilots have learned that if there's a person with a knife aboard the plane, they won't open the cockpit doors to avoid a potential hijacking and more casualties. And passengers know that if hijackers take control of the plane, the hijacker might crash it somewhere instead of holding the passengers and crew hostage, like it was done with plane hijackings before 9/11 and might fight back. So with the example of the 9/11 attacks, the situation has changed enough that a plane hijacking with a knife is much more unlikely
- Alupis 3y agoHijacking? Yes. Causing mass death and terror? No.
- thejazzman 3y agoThat really has nothing to do with being on airplane though, does it? There are endless places where you can get within stabbing distance of a group of people. I'd actually expect a plane to the one of the absolute safest places, because like others said, everyone on that place has just become a victim. It doesn't even matter if you like the person being victimized, you're gonna exploit that distraction and beat the fuck out of the dude. In public people are much quicker to just run away and keep themselves safe.
- Animats 3y agoThis is a problem. You don't want an emergency stop signal to be ignored because somebody didn't update their encryption keys. And it's very useful for railroad workers to be provided with handhelds that can send an emergency stop signal. Here's one used in the US.[1] This is for yard operations, where there's slow-speed (the US limit is 20mph) traffic going in various directions without full signal control. Outside the "yard limit", signals control, and speeds are higher. If you have no idea what a railroad yard working environment is like, here's a Union Pacific recruiting video.[2] They're up-front about what you're getting into; the intro shows someone at 5:48 AM in a snowstorm in a railyard in Chicago. [1] https://railserve.biz/react-safety-device/ https://railserve.biz/react-safety-device/ [2] https://www.youtube.com/watch?v=lMViWazEYoc https://www.youtube.com/watch?v=lMViWazEYoc
- KptMarchewa 3y agoThere is no encryption.
- praptak 3y agoGP point is that encryption would add a layer of things that can fail, to a system where a false negative is extremely costly.
- thejazzman 3y agoI actually know someone who was hit by a train in these circumstances in the 90s. He was in the hospital for years. We're all still incredibly amazed that he's still alive -- on the upside, he got one hell of a payout over it. But yeah, it's REALLY important these radios work :|
- rob74 3y agoI was thinking the same thing and wondering what the use case may be for doing this via radio - thanks for clearing it up! But once you use unencrypted radio, you open it up for remote exploitation - the same thing that can be sent from close up can also be sent from further away with more powerful equipment. That's probably why the systems I was aware of until now use magnets on the track (this can of course only be used to make sure trains stop at a signal, or respect the speed limit, not for arbitrarily stopping them).
- 0xA43 3y agoI've tried to translate the article on the one and only polish offensive cybersec site in case if you want to learn more https://telegra.ph/How-easy-is-it-to-paralyze-the-Polish-railroad-Lets-find-out-08-28 https://telegra.ph/How-easy-is-it-to-paralyze-the-Polish-rai...
- jimmytucson 3y agoGreat article. It goes into the radio and the audio frequencies, and talks about equipment that can transmit the signal, from handheld radios to SDRs, and even covers how to build your own (with circuit diagrams). Much better than the article linked IMO.
- nimbius 3y agoTrue story some amateur radio hams managed to nearly torch our shops substation relay with radios. Basically our main transformer switchgear was opening and closing on its own every few minutes. We run a diesel truck repair company and it was killing everything from the front office to the air compressors and anything in between. The electric company told us there's an ultra low frequency "DX" the hams sometimes get into that their own power lines use to communicate with substations. Pretty silly. We lost the air conditioner and the boombox that year.
- Johnythree 3y agoThis is spin at best. There have been various systems which attempt to reuse existing frequencies by feeding them over un-shielded power lines. And as experts have warned so many times, it will always end up in tears. If you put radio energy on un-shielded lines, the signals will leak out, causing interference to licensed services. Or will leak in, causing interference from licensed services. And because of the risk of outgoing interference, the signal levels must be kept low, which means that any interference leaking inwards will be much worse. The only possible remediation is to use good error correction so that the effect is minimised. But of course that slows down the communication rate, so the power authorities don't bother. And of course this interference can be caused by a large number of industrial electronics, eg motor speed controllers, welders, and so many others. The point however, is that even if the fault was caused by a flaky VLF control system, then it is very unlikely that it was caused by the relatively low power transmission from an Amateur Radio setup. To try and blame Radio Amateurs when they are legally operating on a licensed Ham band, using very low power levels is ludicrous. And to rabbit on about "ultra low frequency DX" only further demonstrates that the power authorities don't have a clue. It's not ULF and whether or not it is DX is irrelevant. If the power authorities were concerned about interference, they would not have relied on a notoriously unreliable system, or would have run an Optical Fiber along with their Earth/Neutral cables.
- LastWeekendWas 3y ago[dead]
- lafar6503 3y ago[flagged]
- burtekd 3y agoIt's not a hack. It's just sending a well-known three tones sequence on given frequency.
- system2 3y agoMaybe not but definitely an exploit of a known system flaw. Just like deauthenticating wifi clients with aireplay-ng.
- jakozaur 3y agoPoland needs to upgrade rail systems, there were plans years ago, but it was costly and postponed. Unfortunately, the radio-stop works well and it's reliable. Now with around 80% of military equipment to Ukraine is transported through Poland, those vulnerabilities are going to be exploited. Russia already run remotely groups though encrypted messages and crypto payments: https://www.washingtonpost.com/world/2023/08/18/ukraine-weapons-sabotage-gru-poland/ https://www.washingtonpost.com/world/2023/08/18/ukraine-weap... The aim is to do some diversion or disinformation. There were many instances of producing fake news or misrepresent about some events. Please do your part and refrain from sharing those news about Poland without double checking sources. Unfortunately, some "news" were picked by mainstream media, even though they could not find any evidence behind that (e.g. turning back non-white people on Poland-Ukrainian border by Polish officials).
- KptMarchewa 3y ago> Poland needs to upgrade rail systems, there were plans years ago, but it was costly and postponed. Unfortunately, the radio-stop works well and it's reliable. GSM-R wasn't really postponed, but the implementation by PKP PLK was botched. There's NIK report about that: https://www.nik.gov.pl/aktualnosci/krajowy-programu-kolejowy-systemy-ertms-etcs.html https://www.nik.gov.pl/aktualnosci/krajowy-programu-kolejowy...
- PM_me_your_math 3y agoI like how they give you the frequency so you can try it yourself.