7 ms·
Polish DRMed trains stop as predicted due to date-based logic-bomb
- RecycledEle 3y agoRichard M. Stallman has a proposed fix to this through 4 software freedoms.
- Eisenstein 3y agoI'm not sure if this is a 'I can't believe they actually did that' moment, or an 'I told you so' moment, because even though it is the inevitable result of tolerating such technology in the consumer sphere, by using it against an entire nation's transportation system I am in awe of how incredibly brazen it is. You don't cut open the golden goose! You had it great being able to screw over consumers but now you have gotten governments and infrastructure involved, and you will reap the consequences.
- nonrandomstring 3y agoThis might be a defining case that sets the power relation between governments and the comapnies that supply all the stuff they need.
- gloyoyo 3y agoWhatever the criminal filings are, hopefully they get what they deserve.
- apapapa 3y agoOne can only hope that it will be the outcome... Won't keep my hopes up
- ProjectArcturis 3y agoWhere can I learn more about this?
- p_l 3y agoA good start is https://social.hackerspace.pl/@q3k/111528162462505087 https://social.hackerspace.pl/@q3k/111528162462505087 and https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hacking/ https://badcyber.com/dieselgate-but-for-trains-some-heavywei... There were also multiple threads on earlier parts of the story, but those are the "origin" english language versions.
- segfaultbuserr 3y agoNext week, it will be presented at this year's 37C7 at Chaos Computer Club. Get your popcorn ready.
- dredmorbius 3y ago<https://news.ycombinator.com/item?id=38730275 https://news.ycombinator.com/item?id=38730275>
- YPPH 3y agoContext: https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/ https://www.theregister.com/2023/12/08/polish_trains_geofenc...
- userbinator 3y agoThey also claimed to have found an undocumented key combination in the cabin controls that would unlock the trains. I hope everyone who operates these trains now knows what that is.
- p_l 3y agoThe combo was removed in software update, unfortunately.
- userbinator 3y agoI wonder what necessitated the update; or was it a forced one, as seems typical these days? The other question this begs is, what other "interesting" hidden features did they add in the update?
- p_l 3y agoTo summarise from what Dragon Sector published: - After one of the trains was "restarted" with the unlock code, some of the trains that went to manufacturer for various reasons returned with software that had the unlock code patched out - Some trains that have locked up outside of Maintenance halls and which were sent to NEWAG returned with added GPS geofencing for the lockup logic and changed time period (previously the lockup engaged if train didn't run for 10 days) - More cases to be presented at 37c3
- CoastalCoder 3y agoI really really hope it was the Konami cheat code.
- CoastalCoder 3y agoIs the manufacturer still disputing that they're the ones who installed that logic bomb?
- p_l 3y agoIn public, yes, also their probable paid PR sock puppets on social media.
- hakdbha 3y agoHope they get the book thrown at them for such blatant attempts at ripping off the communities they serve. Greedy af people
- icehawk 3y agoIf checking if 21 <= day AND 11 <= month AND 21 <= year is the actual logic they used to check if a date is after Nov 21 2021, I'm not sure they should be writing code that runs on a train. (Edit: Fixed inequality direction.)
- p_l 3y agoThis is due to IEC 61131-3 environment - they are getting date value as 3 separate variables from system. Similar stuff is common in PLCs all across the world.
- tczMUFlmoNk 3y agoSure, but regardless of input format, the test in GP's comment would indicate that October 22, 2021 is not before November 21, 2021. The right test is something like "year < 21 || year == 21 && (month < 11 || month == 11 && (day <= 21))". And yes, probably refactor that logic for clarity, but from this form you can see that it is not equivalent to the test above.
- p_l 3y agoThe code as deployed has errors (the link actually shows ghidra decompile of relevant portion). Months & days are counted from 1. The error is what makes it so that instead of failing "unfixably" once 2021-11-21 happens, it instead simulates failure between nov. 21 and dec. 1, and dec. 1 and january 1, every year starting with 2021.
- smusamashah 3y agoIs this considered a legal mechanism for a public service? If this is the code it has to be in some documents as legal binding already right otherwise they just wouldn't have been able to do this.
- nonrandomstring 3y agoLegal mechanisms seem moot in a situation of sabotage against the national infrastructure of a state. The word that's in th back of my mind right now is, at a stretch, "terrorism".
- labster 3y agoNah, it’s clearly extortion, and clearly not terrorism. In wartime it could also be sedition. But the intent is to extract euros, not terrify a populace into political submisssion.
- nonrandomstring 3y agoFair enough. I dislike misuse of the "terrorism" word too. But if someone else had done exactly this, for slightly different motives...
- SuperNinKenDo 3y agoI would say your original choice is better. Sabotage. And for the purpose of extortion. Such are some of the few times when "making an example" is both necessary and justified. Will be curious to see what happens.
- paulmd 3y agowhether or not it's terrorism, at an absolute minimum it's fraud
- mensetmanusman 3y ago"you wouldn't download a train would you?"
- deleted 3y ago[deleted]
- CodeWriter23 3y agoMy people call that “a load of horseshit”
- kbrosnan 3y agoThis train DRM is crazy. At the beginning of the month they found geofences > We (@redford, @mrtick and I) have reverse engineered the PLC code of NEWAG Impuls EMUs. These trains were locking up for arbitrary reasons after being serviced at third-party workshops. The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parties. > We found that the PLC code actually contained logic that would lock up the train with bogus error codes after some date, or if the train wasn't running for a given time. One version of the controller actually contained GPS coordinates to contain the behaviour to third party workshops. > It was also possible to unlock the trains by pressing a key combination in the cabin controls. None of this was documented. > The key unlock was deleted in newer PLC software versions, but the lock logic remained. > After a certain update by NEWAG, the cabin controls would also display scary messages about copyright violations if the HMI detected a subset of conditions that should've engaged the lock but the train was still operational. > The trains also had a GSM telemetry unit that was broadcasting lock conditions, and in some cases appeared to be able to lock the train remotely. https://social.hackerspace.pl/@q3k/111528162462505087 https://social.hackerspace.pl/@q3k/111528162462505087
- luxuryballs 3y agoam I correct to assume that none of this was in the manual?
- p_l 3y agoThat's effectively the core of the accusations against NEWAG. The manual was supposed to allow comprehensive maintenance and repair, without requiring manufacturer's input.
- kbrosnan 3y agoThe people investigating this claim that much of this is undocumented. I don't speak Polish nor have access to any of the primary documentation for the train. We may see more info next week as they are scheduled to present at the 37th CCC. https://events.ccc.de/congress/2023/infos/index.html https://events.ccc.de/congress/2023/infos/index.html Q3k is active here, https://news.ycombinator.com/threads?id=q3k https://news.ycombinator.com/threads?id=q3k
- macintux 3y agoPrevious discussions over the last few weeks: * https://news.ycombinator.com/item?id=38530885 https://news.ycombinator.com/item?id=38530885 - 363 comments * https://news.ycombinator.com/item?id=38628635 https://news.ycombinator.com/item?id=38628635 - 139 comments * https://news.ycombinator.com/item?id=38567687 https://news.ycombinator.com/item?id=38567687 - 298 comments * https://news.ycombinator.com/item?id=38638865 https://news.ycombinator.com/item?id=38638865 - 235 comments * https://news.ycombinator.com/item?id=38570654 https://news.ycombinator.com/item?id=38570654 - 2 comments
- dang 3y agoThanks! Macroexpanded: Trains were designed to break down after third-party repairs, hackers find - https://news.ycombinator.com/item?id=38638865 https://news.ycombinator.com/item?id=38638865 - Dec 2023 (232 comments) Polish Hackers that repaired DRM trains threatened by train company - https://news.ycombinator.com/item?id=38628635 https://news.ycombinator.com/item?id=38628635 - Dec 2023 (139 comments) Polish train maker denies claims its software bricked competitor rolling stock - https://news.ycombinator.com/item?id=38570654 https://news.ycombinator.com/item?id=38570654 - Dec 2023 (2 comments) Dieselgate, but for trains – some heavyweight hardware hacking - https://news.ycombinator.com/item?id=38567687 https://news.ycombinator.com/item?id=38567687 - Dec 2023 (293 comments) Polish trains lock up when serviced in third-party workshops - https://news.ycombinator.com/item?id=38530885 https://news.ycombinator.com/item?id=38530885 - Dec 2023 (359 comments)
- userbinator 3y agoI wish these neighbourly hackers could go after Apple and see if they can get to the bottom of this: https://news.ycombinator.com/item?id=36926276 https://news.ycombinator.com/item?id=36926276
- turquoisevar 3y agoWhat bottom is there to get to? It’s due to calibration data. If the parts match up it uses the available calibration data, if not it ignores calibration data and reverts to uncalibrated state.
- userbinator 3y agoIMHO that's just the "plausible deniability" excuse --- look at the evidence presented there in a bit more detail, and you'll see it starts leaning towards being deliberate. The only "calibration" is the serial number. If these Polish hackers find code that effectively does "if serial doesn't match, slightly perturb the points", it would be certain.
- turquoisevar 3y agoI’ve looked at “the evidence presented” in great detail when it made the news cycle in tech circles, I’m also pretty familiar with Apple’s calibration process and have gone through what information is publicly available via websites that document more intricate details like The Apple Wiki (they’re surprisingly accurate by the way). I’ve touched upon some of the details on calibration 4 months ago here on HN when it was a trending topic[0]. 0: https://news.ycombinator.com/item?id=36936697 https://news.ycombinator.com/item?id=36936697
- apapapa 3y agoThis is just the point of the iceberg for Apple.... Someone just defeated one of their DRM for the sensor that detects when your close the lid on your laptop (if you used a replacement part that was not bought by apple)
- RedShift1 3y agoThomas had never seen such bullshit before
- a_vanderbilt 3y agoI am Jack's complete lack of surprise. If the Polish government doesn't make an example of this company and cripple them, it will just be a signal to every other industrial manufacturer that it's OK. This is the kind of fuckery that can endanger the continuity of a nation on a wide scale.
- gigel82 3y agoActually, a one-time-only "fix" would be a huge wasted opportunity. This needs to be addressed globally for all bad actors / scalpers, including consumer device manufacturers like Apple, and other assholes like Deere tractors, etc. We need to bring back and legislate the right to repair and ownership rights.
- CogitoCogito 3y agoPoland does not have the authority or power to address this “globally”. They do have the authority and power to address the case of this specific train company.
- krisoft 3y ago> a one-time-only "fix" would be a huge wasted opportunity “One time fix” is not the correct way to see a potential prosecution here. The question is if the system is setup to punish this behaviour or not. A particular prosecution of a particular company in a particular case feels like a one time fix but it acts to demonstrate that this behaviour is not acceptable, and that we have the legal framework and the willingness to punish it. Especially of course if the prosecution is succesfull. It is a bit like calling a vehicle barrier on the side of a mountain serpentine road a “one time fix” just because it only ever caught a single runaway bus during its lifetime.
- Zak 3y agoI'm not sure a structural fix is needed here. It appears that EU law already requires unbundling service from sales in cases like this, and requires that necessary documentation is made available for third-party repair shops. Sabotaging public transit infrastructure is surely a crime in Poland, and I suspect it won't be hard for the authorities to prove that was what happened here. Sometimes people do things even when those things are illegal. All that's left to do at that point is prosecute them.
- polynomial 3y agoMaybe they were just giving trains Christmas off?
- deleted 3y ago[deleted]