17 ms·
Polish trains lock up when serviced in third-party workshops
- MichaelMoser123 3y agoAnother example for firmware manipulation: the Volkswagen emissions scandal (Dieselgate). Some firmware was changed, so that emissions were lower during emission tests. That was a big scandal some eight years ago, who remembers? https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal Maybe firmware fudging is more frequent than one would assume...
- kozak 3y agoThis is probably perfect for some EU anti-monopoly lawsuit, am I right?
- izacus 3y agoThis should be a standard consumer protection law (right to repair), not a monopoly thing :/
- joshuaissac 3y agoEU consumer protection laws generally do not apply to B2B contracts (although member states can gold-plate them to extend their scope).
- izacus 3y agoSure, but that just means it needs to be adjusted to cover outright sabotage after sale like this.
- Sosh101 3y agoMore like highly criminal behaviour like fraud and extortion.
- plagiarist 3y agoI don't see how it isn't literal fraud if the behavior isn't documented in the purchasing contracts.
- Glyptodon 3y agoIt seems like some mix of vandalism and fraud too.
- mardifoufs 3y agoSeems like the trains were manufactured by a European corporation so probably not lol.
- sofixa 3y agoDo you think European regulations don't apply to European companies? They do, it just gets less publicity when e.g. Criteo get fined for abusive tracking than when Google do.
- mardifoufs 3y agoThey do, just less so. It's harder to poke around big industrial players of member states.
- faeriechangling 3y agoSize might let you escape with a slap on the wrist but it’s hard to imagine Poland doesn’t get its pound of flesh over this.
- artursapek 3y agoSomeone’s definitely going to jail for this. I can’t even think of what the defense’s argument could be.
- actionfromafar 3y agoMaybe “I am friends with the Law and Justice party”?
- TeMPOraL 3y agoMost people in Poland don't even understand how rail has been privatized and shattered into half a million companies. To a regular person, if it's a train, it's "PKP" (Polish National Railways) - therefore something the government is responsible for. I don't think Law and Justice will be happy about some corp screwing with infrastructure and having the voters blame the government for it.
- deleted 3y ago[deleted]
- actionfromafar 3y agoI hope you are right. I'm maybe too cynical, thinking something along the tune of: "If only more of OUR judges were in place, you wouldn't see such corruption, dear people."
- TeMPOraL 3y agoWhy not both? What better way to underline the point than pressuring to make an example out of Newag? EDIT: PiS has been at the core of political turmoil for the past decade or more, but rail transportation has been an issue for much longer. It's legendary at this point, it transcends politics, and portals you straight into the 1990s. So I feel it would be in the self-interest of everyone in the government to throw the book at Newag right now.
- 3y ago
- throwaw33333434 3y agoIf I understand correctly apart from hardcoded `ifs` there was a backdoor as well. Russian agencies could use it to slow down transit of military aid to Ukraine. In my book you could argue a criminal case.
- tormeh 3y agoIt's not a monopoly, so no. Would make just as much sense to ask for a DMCA takedown of the trains.
- namaria 3y agoDo you think anti monopoly legislation only applies when some company controls some market outright?
- deleted 3y ago[deleted]
- throwaway092323 3y agoHelp us, European Union. You're our only hope.
- fransje26 3y agoWhy does about half the country keep voting for a party that is clearly against the EU then? Is it because of their unwavering love of ransomware and other frauds?
- faeriechangling 3y agoI would reach for other laws like sabotage and extortion and something that probably exists specifically for the protection of public infrastructure and charge them criminally and raid the offices and take out the executives in cuffs. They screwed with the rich and powerful here why not throw the book at them?
- ThrowAwayAcc-- 3y agoWho is the rich? The richest man in the picture is Z. Jakubas, who controls Newag. Forbes estimated his net worth for 1.9 mld PLN in 2021.
- garyfirestorm 3y agoi think the remote lock makes it a backdoor and probably criminal?
- plagiarist 3y ago[flagged]
- radres 3y agoDepends on country's laws and contracts between parties. If the contract does not mandate service by the manufacturer, only suggests it, this sounds illegal. Not because of hacking, because of not documenting behavior and disturbing state entity hence the people.
- plagiarist 3y agoOh, yes. I agree that this sounds like actual fraud if it is undocumented. I disagree that disabling the machines would count as "hacking." I am cynical about the latter because I personally would like this sort of malicious shit to qualify as hacking. I'd also like the telemetry and recording in all modern cars to be considered hacking.
- hedora 3y agoOne practical solution is to make certain clauses unenforceable in end user license agreements and all non-negotiated contracts. For starters clauses allowing the vendor to upload any user specific data (anonymized or not) and prohibitions against specific uses of the software would be unenforceable. The former ensures privacy, and the latter would make the behavior of the train manufacturer illegal (in the US), since it’d fall under the CFAA: https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act (Sections a.5 and a.7 in the section “Criminal offenses under the Act”)
- p_l 3y ago
- dheera 3y agoWho are these hackers and how did they get their hands on a train, among all things?
- meithecatte 3y agoAs explained by the linked article in Polish, the workshop reached out to them and asked of they could figure out why the train isn't working.
- wielebny 3y agoHere a comprehensive write-up in Polish in a somewhat sensationalized - but rightly so - tone: https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/ https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhak...
- HeWhoLurksLate 3y agohttps://translate.google.com/?sl=auto&tl=en&text=https%3A%2F%2Fzaufanatrzeciastrona.pl%2Fpost%2Fo-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow%2F&op=translate https://translate.google.com/?sl=auto&tl=en&text=https%3A%2F... for those of you who like me can't quite understand literally anything otherwise
- mciancia 3y agotldr hackers are from DragonSector (one of the top CTF teams) - https://dragonsector.pl/ https://dragonsector.pl/ They were contacted by workshop which was doing maintenance of those trains and had no idea why they stopped working
- jseutter 3y agoThe truth is almost stranger than fiction. They are members of a group called Dragon Sector and were brought in by the train operator after 6 of their 12 largest trains became unresponsive after having inspections done at a rail yard owned by not-the-manufacturer of the trains. The manufacturer said the trains became unresponsive because of malpractice at the train repair shop and mentioned some condition that didn't appear to be in the maintenance manual. The train operator made contact with Dragon Sector and asked for their help. It's a wild read: https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/ https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhak... It appears to be malicious code included by the manufacturer to prevent third party repair that at one point included geolocation for triggering. Given that the train operator had to reduce train schedules for this which impacted service and income, it might end up as evidence in a lawsuit against the manufacturer at some point.
- flutas 3y agoI've honestly wondered for a while how many devices (from phones to cars) have features like this that haven't been documented yet. Also how many engineers have worked on features like this without whistle-blowing over behavior like this.
- ysofunny 3y ago.... just imagine how many instructions you can hide in a 64-bit address space (I'm thinking of you intel hacker magic)
- hedora 3y agoI can’t change the 12V lead acid battery in my EV without using a reverse engineered OBD-II dongle. If you don’t use the dongle to reset the charge circuit, it fries the new battery in about a month. Here are incorrect directions explaining how to do it: https://www.mybmwi3.com/forum/viewtopic.php?t=17838 https://www.mybmwi3.com/forum/viewtopic.php?t=17838 Step 14 requires the magic dongle. Note that they are not disconnecting the main battery, so they are risking electrocution from the >> 100V DC batteries. There are some comments about not letting the old battery get into a low voltage state. That’s tricking the charger into not overcharging the new battery to death.
- physhster 3y agoRegistering batteries has been a thing for BMWs for at least a decade. The dance around keeping windows open etc is a little more annoying, but nothing out of the ordinary.
- me_me_me 3y agoanother reason not to buy BMW added to the list
- hedora 3y agoMy two main complaints are the battery thing, and that it eats tires. The on-board computer is far superior to anything else I've used (jog wheel, not touch screen), and BMW is at the very top of the list of car manufacturers that respect end-user privacy. Also, it's ridiculously fun to drive (coming from a manual transmission sports car).
- Bermion 3y agoHow many similar practices actually get discovered? In a way this is the "right" thing to do in a capitalist society. We are incentivising this behaviour by making it profitable. An honest company cannot compete with a company doing this, unless very rigorous regulations and enforcement of them. This gets harder and harder as tech gets more opaque. Adding more regulation, auditing, hoping that _all_ entrepreneurs are honest, are crutches trying to patch a fundamentally broken economical system. If capitalism were a software, we would call practices like this code smell. We can try patching it up with some specific legislation and (costly) enforcement by e.g. code auditing in this case. But the real issue is that our economy is not optimizing for global (national) utility, it is optimizing for profits of individual business owners.
- mannykannot 3y agoThe fact that an entity can sometimes benefit from deceit has nothing to do with capitalism, specifically, and capitalism is not the simple proposition that profit justifies anything, even if some people sometimes suggest that it is, in order to advance their agenda - in a rather deceitful manner, I might add!
- augustulus 3y agodo you have a counter-argument? because what I’m reading here is “you’re wrong and lying or lied to because of an ‘agenda’” and that’s it what do you think GP or someone who has lied to GP really thinks? why are they lying? what’s their agenda? do you agree that we (in the West) currently broadly live under Friedman’s version of capitalism, and, if so, do you agree that it broadly follows the mantra of “profit/shareholder value above all else”? if you don’t think we live under that system, what system do you think we live under, and what differs it from the mantra of “profit/shareholder value above all else”?
- mannykannot 3y agoYou have presented a preposterous and completely unjustifiable reading of what I actually wrote, and then demand me to justify it? That's not going to happen, of course.
- atticora 3y agoIt would be so easy to get away with this kind of extortion at my work. Nobody reads my code that carefully, or cares if I don't get it reviewed and just merge it. Only one other person could understand it if he tried, and he has no interest or involvement in it. It could easily look like just a bit of incompetence on my part that requires some additional consulting from me after I have moved on. That's not how I roll ... or sleep well, so my employer is in no danger from me. But there are many short-term devs who come through here, and I don't have the time to police them in detail. But conceivably an LLM could do it. It could be just another step in a build pipeline. But, when LLMs can do this well, they can also write most of the code going into the pipeline.
- jonp888 3y agoThe EN50128 safety standard for the European safety critical rail software places great importance on the development process. Every change to the software has to be based on a defined requirement, and in order to validate the software you have to prevent evidence that every change was approved by a reviewer that is competent for that area of the software. The validation report contains the signature of this person. If your code passes every test, but it wasn't developed in accordance with the process, it might as well not exist. Of course I can't say how well this process was followed in NEWAG, but in theory rogue changes shouldn't be possible.
- justinclift 3y ago> But conceivably an LLM could do it. It'd be kind of funny if an LLM did that "unintentionally", and wasn't able to unlock the code it wrote... ;)
- ceejayoz 3y agoThis doesn't sound like the sort of thing some rogue developer secretly slips into the codebase.
- fnimick 3y agoExactly. This is a company initiative to increase company profits. It's smart business, as long as it's not illegal or the fine is insufficiently high.
- SSLy 3y ago> A rather amusing situation was encountered with another train set that refused to work on November 21, 2022, despite not being in service at the time. The computer reported a compressor failure, although the mechanics determined that there was nothing wrong with the compressor. Unfortunately, the train still did not raise its pantographs. The analysis of the computer code revealed a condition enforcing the failure, which read as follows: > if the day is greater than or equal to 21, and > if the month is greater than or equal to 11, and > if the year is greater than or equal to 2021 > then report a compressor failure.
- radu_floricica 3y agoA reason to code it like this is to avoid that specific date to appear in the compiled code.
- serf 3y agoI guess a charitable interpretation is that the compressor manufacturer set an 'expiry date' to ensure replacement of a vital component. (but it's probably just shady business.)
- Ukv 3y agoAlso the wrong way to implement an expiry data, since it'd work fine again when the day goes below 21 or month below 11, even if the year is 2021 or greater - which seems to be what happened if they only noticed it in November 2022 rather than 2021.
- drra 3y agoSo these trains are exclusively used in Poland by quite a big number of regional train companies. There are 5 servicing levels starting from P1 up to most complex P5. It used to be that only these major companies would do P3+ but since a few years tenders were won by several smaller competitors at much lower prices all thanks to European Union Agency For Railways that opened that market. It started with 4 trains that were serviced by SPS Mieczkowski and just wouldn't start. The company was forced to pay €0.5m in penalties and trains were sent back to Newag. At the same time several other trains from different companies that didn't even got to service but spent a bit too much time in one place became immobilized. This all led to SPS Mieczkowski hiring Dragon Sector to investigate and they found several separate routines to disable trains. This case is investigated by Central Anti-Corruption Bureau in Poland but I doubt it'll do much harm to Newag. The Office of Rail Transport of Poland that would spam rail company with complaints and orders for a small mistake in train schedule washed it's hands from intervening in this case and train purchases have highly regulated tender process and very little wiggle room for rail companies.
- opliko 3y agoTheir newer variant, Impuls 2, is actually used outside of Poland too - Italian FSE operates 11 of them. Though considering they were hoping to continue their expansion into Italy I imagine they might not have sabotaged these trains (but who knows, maybe they're fine with burning even new customers).
- KptMarchewa 3y ago>This case is investigated by Central Anti-Corruption Bureau in Poland but I doubt it'll do much harm to Newag. The Office of Rail Transport of Poland that would spam rail company with complaints and orders for a small mistake in train schedule washed it's hands from intervening in this case and train purchases have highly regulated tender process and very little wiggle room for rail companies. It's clearly a crime of sabotage under Art. 254a kk. Tender process does not matter in this case. We just need a competent prosecutor. https://sip.lex.pl/akty-prawne/dzu-dziennik-ustaw/kodeks-karny-16798683/art-254-a https://sip.lex.pl/akty-prawne/dzu-dziennik-ustaw/kodeks-kar...
- jaymzcampbell 3y agoThis brought to mind the AARD "crash" which Microsoft used to basically destroy competition from DR-DOS back in the day. > The AARD code was a segment of code in a beta release of Microsoft Windows 3.1 that would determine whether Windows was running on MS-DOS or PC DOS, rather than a competing workalike such as DR-DOS, and would result in a cryptic error message in the latter case. This XOR-encrypted, self-modifying, and deliberately obfuscated machine code used a variety of undocumented DOS structures and functions to perform its work. https://en.wikipedia.org/wiki/AARD_code https://en.wikipedia.org/wiki/AARD_code https://www.geoffchappell.com/notes/windows/archive/aard/drdos/index.htm https://www.geoffchappell.com/notes/windows/archive/aard/drd... https://news.ycombinator.com/item?id=36042213 https://news.ycombinator.com/item?id=36042213
- jacquesm 3y agoWhy go back so far into history when weeks suffice: https://news.ycombinator.com/item?id=37897428 https://news.ycombinator.com/item?id=37897428
- xenadu02 3y agoThe AARD code (which was a non-fatal warning that didn't stop you from using Windows) never actually shipped. It was patched to be non-reachable in the final release, probably a binary patch to avoid a regression and long build times (including a large packing problem: optimizing floppy disk layout) FWIW DR-DOS was a dead end product at launch. It was abundantly clear to anyone with two brain cells to rub together that people/OEMs were not going to buy two operating systems: a GUI OS and a DOS that also acted like a bootloader for the GUI OS. The idea that there would exist, for any significant length of time, a market for a standalone text-only 16-bit DOS was complete and utter fantasy. DR-DOS was never significant in terms of sales. Even if the AARD code had actually shipped in the final Windows 3.x release it wouldn't have mattered.
- hakfoo 3y agoDR-DOS was a viable product for many years. It first appeared as a product to compete with MS/PC-DOS 3.x releases in the late 1980s. XT-class machines were still on the market, and Windows was far from unchallenged dominance. If you asked in 1989 what computing would look like by 1995, "OS/2", "Unix", or "something we haven't even imagined yet" were viable guesses, probably even more so than "That clunky Windows/386 shell will subsume almost all drivers and functionality, but you'll still need a glorified version of DOS 3.3 as a bootloader." Aside from whether DR-DOS was a compelling retail product, it served an important market purpose: it forced a price ceiling for MS-DOS. This probably spurred Microsoft's questionably-legal bundling and pricing strategy, but the end result is that OEMs weren't paying $150 for a copy of DOS through the 1990s.
- InsomniacL 3y ago> "The manufacturer argued that this was because of malpractice by these workshops" Is this intended to say: - The manufacturer says the locks are caused by malpractice of the 3rd party workshops or - The manufacturer says they lock the trains because of past malpractice of the 3rd party workshops The poster also states > "One version of the controller actually contained GPS coordinates to contain the behaviour to third party workshops." This seems oddly specific, there are better ways to determine if the train has been serviced by the manufacturer or not, such as using PKI. I can imagine a scenario where this isn't for greed of servicing fees, perhaps the brakes need replacing every x miles and if this isn't performed the train locks for safety. If the 3rd party workshops specified thought "there's more life left in these pads, I'll just reset the counter and make the train think the pads are new" The manufacturer would have significant backlash should the train then crash and kill people, regardless if the 3rd party workshop was at fault. I'm all for right to repair for most things, however commercial public transport isn't one of them unless there's some vetting/accreditation process.
- celticninja 3y agoI disagree. The owner should be able to get them repaired without needing the manufacturer to approve.
- InsomniacL 3y agoIf the Manufacturer doesn't put security systems in place, situations like this are more likely https://news.sky.com/story/fraud-officers-arrest-one-in-dawn-raid-on-uk-engine-parts-provider-13024145 https://news.sky.com/story/fraud-officers-arrest-one-in-dawn... > "The company supplies engine parts to several major airlines in the UK and abroad. > In August. the Civil Aviation Authority announced it was investigating the same company for the "supply of a large number of suspect unapproved parts"."
- celticninja 3y agoThis wasn't a security system it was a straight up fiddle. The fact it was undocumented is the real tell.
- wafflemaker 3y agoHow can somebody even attempt to find faults like these without being a magician? Are people reading tons of assembly code in the process?
- tensility 3y agoYes, that's exactly what happened. The reference in the article to the tool named Ghidra is the confirmation to your hunch.
- shadowgovt 3y agoOn an open source architecture, many eyes hypothetically leave few places for malicious action to hide. This is not always 100% foolproof, but it seems to work out pretty well most of the time. On a closed source architecture, this sort of thing is generally safeguarded by contract and law. Company can get away with it once, but if the law and contracts were properly crafted there will be fines and jail time that discourages them from doing it again.
- bombcar 3y agoReading decompiled (reverse-engineered) code is not as insanely hard as it sounds. You can usually find functions, and then it's a matter of finding _what_ a function does. If you can somehow attach a debugger or get breakpoints, it's even easier.
- tensility 3y agoIn some cases, oddly, the intent of a function can actually become clearer when the logic gets stripped of all the bad naming protocols and names for the moving pieces have to be reconstructed from only its actions and contexts. In a perfect world, this shouldn't be true and the content embedded within those symbols in the source code should be an easy lever towards relatively perfect understanding of both intent and implementation; however, software is a relatively young discipline and this is actually a difficult linguistic problem.
- rasz 3y agoSame guys cracked Toshiba password mechanism hidden inside EC/KBC (Renesas M16C) https://q3k.org/slides-recon-2018.pdf https://q3k.org/slides-recon-2018.pdf couple of years ago.
- TomaszZielinski 3y agoThe world is such a small place--I open HN and read a movie-grade story about trains that I took many times. In fact, it's even possible I was going by one of those grounded trains.. In any case, either there was no code review, or the reviewers accepted that for one reason or another. Not sure which case is more scary..
- imag0r 3y agoOh, I bet that code was well reviewed and put through some serious testing. You can guess that from the presence of the geofence with additional trigger condition ;)
- jrochkind1 3y agoCode review by a _third party_? Does that usually happen? It's clear this was intended by the manufacturer of the trains, who directed the writing of the code, it's not like a hacker put this in without their manager knowing, right? What kind of code review are you thinking of by whom? [Wait, reading other comments, I'm thinking HN switched the article at the top, and some of these comments were written when the article at the top had much less information? That may explain why these comments are so confusing!]
- scotty79 3y agoThat should be a basic requirement for any purchase where public funds are involved in any manner. If something is not open source then third party audit should be a bare minimum.
- TomaszZielinski 3y agoA day has passed and today my comments about code reviews don't really make sense to me anymore. I think I lost forest for the trees :). So now it makes perfect sense to me that you thought it was about a 3rd party review, or about a rogue developer.
- sgerenser 3y agoI’m sure it was the work of a rogue engineer.
- tester756 3y agoHoly shit those aren't some random ass hackers They are members of top CTF team of last decade - Dragon Sector Also, the story is wild as fuck!
- faeriechangling 3y agoSo these manufacturers literally ransomed Poland by crippling critical infrastructure? This is an incredibly brazen crime and I’m not so confident they will get away with it.
- brohee 3y agoNewag stock price falling quite a bit after the post, is that the first Mastodon induced price correction? https://g.co/kgs/WVku4C https://g.co/kgs/WVku4C
- freedude 3y agoThis answers the question, How can I define corporate level malicious protectionism?
- cryptonector 3y agoWell, it gives you an example, not quite a definition.
- hnthrowaway0315 3y agoI think the way to fix this is to make sure manufacturers follow certain standards so that the products can be serviced by anyone who holds certificates in those standards. This is mostly to break the liability/insurance barrier.
- TeMPOraL 3y agoThat's approximately what the EU forced to happen - third party repair shops were approved and allowed access to the service documentation. But that means nothing when the manufacturer decides to sabotage the trains in firmware and even install an Internet-connected hardware backdoor.
- CKMo 3y agoUgh, please do not give car manufacturers any ideas! ...or Boeing.
- crazygringo 3y agoGenerally I'm not part of the crowd that wants to send CEO's and management to jail for what are ultimately just bad business decisions. But this should absolutely result in jail time. This is literally no different from if the managers of the company physically snuck into trainyards and snipped wires and removed valves or whatever. It's literally just sabotage. It's a crime that should result in years of jail time for everyone in management who participated in this decision.
- TeMPOraL 3y agoYup. And this isn't sabotaging some random webshit SaaS. This is sabotaging critical national infrastructure - infrastructure that's of military relevance, and need I remind anyone, there's a hot war being waged over our eastern border right now. I feel a good enough prosecutor could pin charges of treason here.
- gruez 3y agoAs much as I like to rake the executives over the coal for this, I'm disturbed by the trend of calling anything vaguely against the national interest as "treason". Nowadays if I hear someone is accused of treason absent any context, it could mean anywhere between "knowingly selling nukes to iran" to "lobbied for/against a policy that the accuser thinks is bad". In this case they're arguably scamming the government out of money, but that can hardly be compared to the crime knowingly aiding a known adversary.
- thaumasiotes 3y ago> In this case they're arguably scamming the government out of money, but that can hardly be compared to the crime knowingly aiding a known adversary. I don't really get your argument. In this case they're intentionally crippling a capability of the Polish state. There does not appear to be any particular intended beneficiary (other than themselves), but any and all enemies of the Polish state foreseeably benefit when the Polish state's abilities are curtailed. Furthermore, the general understanding of treason does not require aiding a known adversary - it requires attacking, injuring, or otherwise betraying whoever has authority over you. > I'm disturbed by the trend of calling anything vaguely against the national interest as "treason". I guess what I'm saying here is that this involves something that is contrary to the national interest in very specific ways. The connection is not vague. If I'm an American and I arrange to kidnap Joe Biden and hold him for ransom, does that sound like "treason" to you? All I want is money. But someone might think there's an important difference between the effect I'm trying to produce and the effect I actually do produce.
- praptak 3y agoI wonder who coded the malware clauses and who knew about them. Didn't anyone think of whistleblowing? Btw, here's the page with anonymous opinions about the company from (unvetted) employees https://www.gowork.pl/opinie_czytaj,19587 https://www.gowork.pl/opinie_czytaj,19587 They seem to have a pretty toxic work environment.
- gorbachev 3y agoWhen asked to do this sort of a thing as a software developer, make sure to ask the directions in writing.
- dark-star 3y agoIn this case, they probably got the trains cheaper by agreeing to have them services only at official service stations. Still a shady practice but not worse than having expiring license keys for unlocking features or similar things
- KptMarchewa 3y agoTender process does not matter when you do crimes - just like you can't sell yourself to slavery or allow someone to kill you.
- sundvor 3y agoOh you want brakes with that? Sorry you forgot to renew your license.
- p_l 3y agoNope, there was separate tender for just trains, and for the servicing. NEWAG (manufacturer) won the train contract, but lost the servicing contract tender. Under current rules they had to provide as part of the first contract complete documentation for servicing that any legitimate (vetted & certified) 3rd party company could then use. By servicing I mean literally taking the train apart and handling individual assemblies to original manufacturers at times. So it is very shady, unethical, and illegal.
- jakub_g 3y agoBuried in the comments are links to longer write-ups with additional details: Polish: https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/ https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhak... https://wiadomosci.onet.pl/kraj/awarie-pociagow-newagu-hakerzy-ujawniaja-kto-stoi-za-celowymi-usterkami/g4hymmg https://wiadomosci.onet.pl/kraj/awarie-pociagow-newagu-haker... English: https://zaufanatrzeciastrona-pl.translate.goog/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/?_x_tr_sl=pl&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp https://zaufanatrzeciastrona-pl.translate.goog/post/o-trzech... https://wiadomosci-onet-pl.translate.goog/kraj/awarie-pociagow-newagu-hakerzy-ujawniaja-kto-stoi-za-celowymi-usterkami/g4hymmg?_x_tr_sl=pl&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp https://wiadomosci-onet-pl.translate.goog/kraj/awarie-pociag... For context: Poland is split into 16 voivodships, and after a reform from early 2000s, pretty much each of them has its own local railway company (which cooperate). Basically "everyone knew" for over a year something was fishy with Newag trains, after a series of faults in trains owned by different companies which used a 3rd-party service company instead of servicing with Newag, so the service company hired the hacker guys, it took a while for the folks to reverse engineer things and understand what's precisely going on.
- rdudek 3y agoAwesome! I had to look the word "voivodship" up. I am Polish, so I knew what województwo meant. But I didn't know there was an English equivalent of that word other than governing state. An interesting read on Wikipedia: https://en.wikipedia.org/wiki/Voivodeship https://en.wikipedia.org/wiki/Voivodeship
- thaumasiotes 3y agoI think the best shot a modern Anglophone has at knowing the word is that it was used in Dracula for the title of Vlad the Impaler. [Voivode, that is, not voivodeship. But if you know the title voivode, the meaning of voivodeship is obvious.] It is not immediately obvious why the word would have been adopted into English in more or less the native form as opposed to being translated into an equivalent title, the way we talk about German "dukes" and "duchies".
- RicoElectrico 3y agoIt's quite unfortunate as Newag trains are rather higher quality than Pesa (other Polish manufacturer). I suppose so reliable, they needed to generate artificial faults :D
- __natty__ 3y agoWill be interesting to see the impact of this situation on the contract with European railroad services Akiem - they signed a 164 million euro contract with Newag for services and trains for France. [1] [1] https://biznes.pap.pl/pl/news/all/info/3509606,newag-inks-eur-164-million-net-contracts-for-supplying-and-maintaining-electric-locomotives https://biznes.pap.pl/pl/news/all/info/3509606,newag-inks-eu...