4 ms·

Who are these hackers and how did they get their hands on a train, among all things?

by dheera 3y ago

meithecatte 3y ago
As explained by the linked article in Polish, the workshop reached out to them and asked of they could figure out why the train isn't working.
wielebny 3y ago
Here a comprehensive write-up in Polish in a somewhat sensationalized - but rightly so - tone: https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/ https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhak...
- HeWhoLurksLate 3y ago
  https://translate.google.com/?sl=auto&tl=en&text=https%3A%2F%2Fzaufanatrzeciastrona.pl%2Fpost%2Fo-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow%2F&op=translate https://translate.google.com/?sl=auto&tl=en&text=https%3A%2F... for those of you who like me can't quite understand literally anything otherwise
mciancia 3y ago
tldr hackers are from DragonSector (one of the top CTF teams) - https://dragonsector.pl/ https://dragonsector.pl/ They were contacted by workshop which was doing maintenance of those trains and had no idea why they stopped working
jseutter 3y ago
The truth is almost stranger than fiction. They are members of a group called Dragon Sector and were brought in by the train operator after 6 of their 12 largest trains became unresponsive after having inspections done at a rail yard owned by not-the-manufacturer of the trains. The manufacturer said the trains became unresponsive because of malpractice at the train repair shop and mentioned some condition that didn't appear to be in the maintenance manual. The train operator made contact with Dragon Sector and asked for their help. It's a wild read: https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/ https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhak... It appears to be malicious code included by the manufacturer to prevent third party repair that at one point included geolocation for triggering. Given that the train operator had to reduce train schedules for this which impacted service and income, it might end up as evidence in a lawsuit against the manufacturer at some point.
- vidarh 3y ago
  I would love to know if the checks were as brazen as presented in that post, or if the coordinate checks were obfuscated in some way. It sounds like they just assumed the operator would fold long before even getting at the code and couldn't even be bothered trying to make it look accidental.
  - q3k 3y ago
    The main obfuscation was the way IEC 61131-3 constructs get first compiled to C and then to assembly. There's a lot of indirection and zero strings in the resulting code, meaning it's very difficult to actually find whatever logic you're looking for. But once you see it, it is obvious and seems like it was built like any other logic.
    - vidarh 3y ago
      That's amazing. If I was going to pull a stunt like this, I'd like to think I'd find some way of trying to make it look like a bug. Must be very satisfying to find something like this. I guess this is going to provide plenty of billable hours for lawyers at this point...
- Pet_Ant 3y ago
  Well the error message claims that they are infringing copyright. It very well could be that they are within their rights if the initial license/contract stipulated that they would only service the trains in their authorised locations. This should be illegal, but very well might be.
  - planede 3y ago
    How would copyright be in-scope at all? At worst this infringes EULA.
  - xeeeeeeeeeeenu 3y ago
    Excerpt from an Onet article[1] about this: >Until a few years ago, rolling stock manufacturers such as Newag from Nowy Sącz and PESA from Bydgoszcz were able to dominate the maintenance market. It was mainly them who entered tenders for compulsory maintenance of their vehicles, because other companies knew they were at a disadvantage. At the time, the dominant narrative of the manufacturers was that the "Maintenance System Documentation," a kind of manual for a given vehicle, was the manufacturer's secret, its intellectual property, and under no circumstances could this be passed on to other service companies. This led to a situation in which railroad companies across the country were forced to use the manufacturer's expensive service. And the latter, having a monopoly on repairing its trains, dictated outlandish prices, even tens of percent higher than another company would have given, the rail safety expert points out. >Our source adds that later, thanks to the European Union Agency for Railways, the interpretation of regulations changed, allowing other companies access to service trains. This led to the opening of the market to other companies in the industry. [1] - https://wiadomosci.onet.pl/kraj/awarie-pociagow-newagu-hakerzy-ujawniaja-kto-stoi-za-celowymi-usterkami/g4hymmg https://wiadomosci.onet.pl/kraj/awarie-pociagow-newagu-haker...
Crosseye_Jack 3y ago
You wouldn’t download a train, would you?

Who are these hackers and how did they get their hands on a train, among all things?

by dheera 3y ago

Who are these hackers and how did they get their hands on a train, among all things?

As explained by the linked article in Polish, the workshop reached out to them and asked of they could figure out why the train isn't working.

wielebny 3y ago

Here a comprehensive write-up in Polish in a somewhat sensationalized - but rightly so - tone: https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/ https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhak...

HeWhoLurksLate 3y ago
https://translate.google.com/?sl=auto&tl=en&text=https%3A%2F%2Fzaufanatrzeciastrona.pl%2Fpost%2Fo-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow%2F&op=translate https://translate.google.com/?sl=auto&tl=en&text=https%3A%2F... for those of you who like me can't quite understand literally anything otherwise

mciancia 3y ago

tldr hackers are from DragonSector (one of the top CTF teams) - https://dragonsector.pl/ https://dragonsector.pl/ They were contacted by workshop which was doing maintenance of those trains and had no idea why they stopped working

jseutter 3y ago

The truth is almost stranger than fiction. They are members of a group called Dragon Sector and were brought in by the train operator after 6 of their 12 largest trains became unresponsive after having inspections done at a rail yard owned by not-the-manufacturer of the trains. The manufacturer said the trains became unresponsive because of malpractice at the train repair shop and mentioned some condition that didn't appear to be in the maintenance manual. The train operator made contact with Dragon Sector and asked for their help. It's a wild read: https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/ https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhak... It appears to be malicious code included by the manufacturer to prevent third party repair that at one point included geolocation for triggering. Given that the train operator had to reduce train schedules for this which impacted service and income, it might end up as evidence in a lawsuit against the manufacturer at some point.

vidarh 3y ago
I would love to know if the checks were as brazen as presented in that post, or if the coordinate checks were obfuscated in some way. It sounds like they just assumed the operator would fold long before even getting at the code and couldn't even be bothered trying to make it look accidental.
- q3k 3y ago
  The main obfuscation was the way IEC 61131-3 constructs get first compiled to C and then to assembly. There's a lot of indirection and zero strings in the resulting code, meaning it's very difficult to actually find whatever logic you're looking for. But once you see it, it is obvious and seems like it was built like any other logic.
  - vidarh 3y ago
    That's amazing. If I was going to pull a stunt like this, I'd like to think I'd find some way of trying to make it look like a bug. Must be very satisfying to find something like this. I guess this is going to provide plenty of billable hours for lawyers at this point...
Pet_Ant 3y ago
Well the error message claims that they are infringing copyright. It very well could be that they are within their rights if the initial license/contract stipulated that they would only service the trains in their authorised locations. This should be illegal, but very well might be.
- planede 3y ago
  How would copyright be in-scope at all? At worst this infringes EULA.
- xeeeeeeeeeeenu 3y ago
  Excerpt from an Onet article[1] about this: >Until a few years ago, rolling stock manufacturers such as Newag from Nowy Sącz and PESA from Bydgoszcz were able to dominate the maintenance market. It was mainly them who entered tenders for compulsory maintenance of their vehicles, because other companies knew they were at a disadvantage. At the time, the dominant narrative of the manufacturers was that the "Maintenance System Documentation," a kind of manual for a given vehicle, was the manufacturer's secret, its intellectual property, and under no circumstances could this be passed on to other service companies. This led to a situation in which railroad companies across the country were forced to use the manufacturer's expensive service. And the latter, having a monopoly on repairing its trains, dictated outlandish prices, even tens of percent higher than another company would have given, the rail safety expert points out. >Our source adds that later, thanks to the European Union Agency for Railways, the interpretation of regulations changed, allowing other companies access to service trains. This led to the opening of the market to other companies in the industry. [1] - https://wiadomosci.onet.pl/kraj/awarie-pociagow-newagu-hakerzy-ujawniaja-kto-stoi-za-celowymi-usterkami/g4hymmg https://wiadomosci.onet.pl/kraj/awarie-pociagow-newagu-haker...

Crosseye_Jack 3y ago

You wouldn’t download a train, would you?