3 ms·

pretty sure even if they have source code version control, the "funny" patches are outside of the version control and applied on top before making a build.

• eschneider 3y ago
  That's almost certainly not the case. In general for vehicles, you're installing signed, verified images. Not only would it be a LOT harder to consistently apply OOVC patches that don't show up anywhere, having signed builds that don't match your source would be a worse red flag than just having the code in version control.
  • hgomersall 3y ago
    You do get deniability though. Given their line is "this is malicious code that was put on the train. Physical security is the responsibility of the train companies”, they would argue the fact their binaries are different is proof of malicious actors. Essentially, if they're going to do this, a good route is for them to be the malicious actors. Just before shipping, someone trusted surreptitiously switches the binaries to the modded versions.
    • octacat 3y ago
      yes, they probably have a "clean" build and "a build with extra functionality" build. So, they could even install a clean build for some trains. Though, investigators could just compare firmware from all trains made so far. Another question if it would be even be investigated.