3 ms·

Newag issued a statement since, denying all allegations and saying that it was their competition which "hired hackers to slander them". I've met q3k because we

by Tade0 3y ago

Newag issued a statement since, denying all allegations and saying that it was their competition which "hired hackers to slander them". I've met q3k because we used to work at the same company and briefly on a project together. Not the kind of person I would suspect of participating in a conspiracy of this sort and Newag's statement generally reads like "we didn't think we would get caught".

deleted 3y ago
[deleted]
aneutron 3y ago
While I haven't met the guys in this case, I am familiar with their work. Additionally, I am fairly certain they are not stupid enough to not have kept detailed, forensic-quality records of their actions and whatever they dumped. Sure it may not stand up in court as evidence but it will be more than enough to show that they didn't pull this out of nowhere
senkora 3y ago
^I think this is being downvoted because of poor reading comprehension skills. Please note that the parent comment is in favor of the hacking group.
- Tade0 3y ago
  Thank you for pointing this out - I reread the post and can imagine now how someone would read it differently than I intended.
  - TomaszZielinski 3y ago
    I read and reread it and IMHO it's perfectly clear.
tensility 3y ago
Unfortunately for Newag, other than in the court of public opinion, firmware deliveries count as written evidence.
- Tade0 3y ago
  Part of their statement says(loosely translated): "No hacker can tell, based on the content of the digital record alone, who is the author of the digital record in question" Boy oh boy. Either they're not singing their firmware (which is a serious indictment in and of itself) or proving that it was them all along will be trivial, but the ones signing off this message are unaware of this. Overall they got caught with their pants down and handling it badly as evidenced by the fact that they don't even have a scapegoat prepared.
  - TomaszZielinski 3y ago
    "Pants down" situation aside, if the firmware is not signed or verified in any way, then isn't it prone to "neutrino bit reversal", potentially causing Bad Things? I have no idea how those systems work and what guarantees they provide, but this would be hair-raising...
    - account42 3y ago
      You can have checksums without signatures. Not that either a commonly checked after installation so most systems are still vulnerable to random bit flips.

by Tade0 3y ago

deleted 3y ago

[deleted]

aneutron 3y ago

While I haven't met the guys in this case, I am familiar with their work. Additionally, I am fairly certain they are not stupid enough to not have kept detailed, forensic-quality records of their actions and whatever they dumped. Sure it may not stand up in court as evidence but it will be more than enough to show that they didn't pull this out of nowhere

senkora 3y ago

^I think this is being downvoted because of poor reading comprehension skills. Please note that the parent comment is in favor of the hacking group.

Tade0 3y ago
Thank you for pointing this out - I reread the post and can imagine now how someone would read it differently than I intended.
- TomaszZielinski 3y ago
  I read and reread it and IMHO it's perfectly clear.

tensility 3y ago

Unfortunately for Newag, other than in the court of public opinion, firmware deliveries count as written evidence.

Tade0 3y ago
Part of their statement says(loosely translated): "No hacker can tell, based on the content of the digital record alone, who is the author of the digital record in question" Boy oh boy. Either they're not singing their firmware (which is a serious indictment in and of itself) or proving that it was them all along will be trivial, but the ones signing off this message are unaware of this. Overall they got caught with their pants down and handling it badly as evidenced by the fact that they don't even have a scapegoat prepared.
- TomaszZielinski 3y ago
  "Pants down" situation aside, if the firmware is not signed or verified in any way, then isn't it prone to "neutrino bit reversal", potentially causing Bad Things? I have no idea how those systems work and what guarantees they provide, but this would be hair-raising...
  - account42 3y ago
    You can have checksums without signatures. Not that either a commonly checked after installation so most systems are still vulnerable to random bit flips.