5 ms·

Breaking "DRM" in Polish trains [video]

378 points by p_l 3y ago

toomuchtodo 3y ago
Related: Polish Hackers that repaired DRM trains threatened by train company - https://news.ycombinator.com/item?id=38628635 https://news.ycombinator.com/item?id=38628635 - Dec 2023 (142 comments) Polish train maker denies claims its software bricked competitor rolling stock - https://news.ycombinator.com/item?id=38570654 https://news.ycombinator.com/item?id=38570654 - Dec 2023 (2 comments) Dieselgate, but for trains – some heavyweight hardware hacking - https://news.ycombinator.com/item?id=38567687 https://news.ycombinator.com/item?id=38567687 - Dec 2023 (293 comments) Polish trains lock up when serviced in third-party workshops - https://news.ycombinator.com/item?id=38530885 https://news.ycombinator.com/item?id=38530885 - Dec 2023 (360 comments)
- chii 3y ago
  [flagged]
  - bfeist 3y ago
    God I hate reaction videos. I wish there was a filter.
faitswulff 3y ago
For English speakers intimidated by the introduction, the actual talk is in English.
- huytersd 3y ago
  [flagged]
  - zamadatix 3y ago
    As a native English speaker: I'm curious why not? There are certainly other words and phrases which could fit just as well (concerned, confused, find incomprehensible, etc) but intimidated seems just as fine as any. Perhaps I've slogged through too many foreign slide deck presentations and simply have a particularly odd view now :p. It almost sounds as if you see a way to take this in a negative connotation though?
    - huytersd 3y ago
      Yes. I usually take someone assuming I’m scared of something as a slight affront. It’s diminutive instead of using a word like unintelligible in this case.
      - zen928 3y ago
        Try to not frame general statements through the lens of your worst critics, and to actively give charity while interpretating messages from people who don't demonstrate harmful intent. I don't see anything hostile about someone claiming that those who might feel intimidation by a language they don't speak will feel at ease (because the primarily content is in their language). Assuming a negative intention on a message of seemingly good will should be a moment for you to pause and consider why you think that way, instead of conjuring up post-hoc reasoning to decipher a hidden hate message.
        septillianator 3y ago
        well said
        rpastuszak 3y ago
        100% agree. Not a comment on that parent comment per se (didn't read it as it's flagged), but in PL "intimidating" has much more negative connotations which makes the word a tad hard to translate (e.g. intimidating → zastraszający == "trying to scare sm/sb"). Things like this might slip if EN is not your first language. > Assuming a negative intention on a message of seemingly good will should be a moment for you to pause and consider why you think that way, instead of conjuring up post-hoc reasoning to decipher a hidden hate message. As a kid living in a German speaking country I had to deal with racism fairly regularly. I moved to the UK in my early 20s. I still remember the feeling of dread when I saw a nail salon asking for a premium for "nails (with polish)". I obviously knew what that meant, but for a split second I was pissed xd
  - misnome 3y ago
    “If” definitely looks like the right word.
  - mbork_pl 3y ago
    Tbf, I'm Polish and a language nerd a bit, and I consider a phrase "intimidated by the Polish language" completely justified. ;-)
    - kevin_b_er 3y ago
      The intro from the host/master of ceremonies sounds like German, not Polish.
      - mbork_pl 3y ago
        Ah, you're right, I assumed from the title it would be Polish. But frankly, given the history of my country, the same goes for German, too...
fbdab103 3y ago
I am curious what other industries are likely to have booby-trapped software which has not yet been discovered. It was only through some weird circumstances + dedicated investigation by the hacker group (I thought they were given months of access to the hardware) that this was uncovered. Most organizations do not have the resources to investigate equipment behaving oddly. For example, if HP programs printers to start failing after N pages printed, would that ever be uncovered? Is there some kind of whistleblower law that would allow someone with knowledge to come forward?
- p_l 3y ago
  A crucial part is the contract wording regarding what exactly was sold when NEWAG sold the trains to the operator - namely, the documentation for maintenance and repair was supposed to be complete. As in, should NEWAG encounter a critical existence failure, it should still be possible for a third party to service the trains so long as parts could be acquired, and in worst case, start working on replacement parts. With most other right-to-repair cases there's way less recourse. With trains in Europe you have legal rules that disallow hiding critical maintenance data behind trade secrets, for example.
  - scyzoryk_xyz 3y ago
    This is quite the insight - we’re talking about something purchased in public tender process by a public entity. The train is almost more like a commodity and less like a product. Or „Train-as-a-service” even perhaps? My suspicion is that a lot of this happens only 99% of cases never see light of day due to NDA-s and settlements
  - bdavbdav 3y ago
    In my industry we often escrow source code for these situations.
- f_devd 3y ago
  From personal experience it seems relatively common in the embedded-esque software space, although not always quite as sophisticated as seen here. > Is there some kind of whistleblower law that would allow someone with knowledge to come forward? Depends on where you live, unfortunately anywhere with 'stong' IP laws you aren't allowed to patch anything. Usually reverse engineering analysis is still fine, although if there is a contract saying you're not allowed to you could be screwed anyway. In the train case the locks were specifically for anti-competitive purposes, and so they can whistle-blow for that; and I think in the general case you can sue for misleading dealings/false advertising/etc but not for anything specific to the software locks/traps.
Zuiii 3y ago
Slight tangent, but I really looked forward to (and enjoyed!) the "This Year in Crypto" talks given by DJB and Tanja Lange at past C3s. It was a fun way for a non-cryptologist like me to keep track of all the major happenings in this field. Sadly they stopped giving them a few years back. Does anyone know if there are similar end-of-year roundups that non-cryptologist s can follow to keep up to date?
- namibj 3y ago
  The security nightmares talk at (also) 37c3?
HideousKojima 3y ago
Has Newag provided any evidence of their claim that this is a conspiracy by their competitor and the hacker group? Or is it literally just them saying "no we didn't"?
- ngcc_hk 3y ago
  The fact is they found those gps or even third party part denial and how could these be conspiracy I wonder?
- seba_dos1 3y ago
  I think it goes without saying, but it's of course the latter.
- avallach 3y ago
  In various trains, over 20 versions of the compiled firmware with unique variants of the locking algorithm were found. And to make matters worse, the trains were found to have something that appears to be a GSM-to-CAN bridge. It isn't reverse engineered yet but AFAIK shouldn't be there and in the worst case may be a remote control backdoor.
  - Maxious 3y ago
    Both these points were clarified in the audience questions - it's a UDP to CAN bridge so the Linux based passenger information system knows the state of the train. And only the Linux system is GSM connected (to get network announcements etc.), none of the firmwares were installed remotely, only when trains were sent back to the manufacturer physically.
everyone 3y ago
Perhaps cases like this are good. Most people dont mind DRM at all, they couldnt even tell you what it is though their phones / cars / etc. are riddled with it. A case like this involving a train that wont move is something that's easy to comprehend for the general public and is clearly utter bullshit.
- trinsic2 3y ago
  Yes, this is a perfect example of what DRM is really about. I'm a repair guy and I'm always trying to protect my customers against walled gardens, and what not. Talking about this article makes explaining right repair so much easier. My concern is the changes they're making to bios in Consumer grade OEM Desktop and Laptops. With adding UEFI certificates to anti-theft software that is enabled by default people just don't understand what's really going on. This article explains it beautifully. Thank you Newtag!
tester756 3y ago
Everytime I see news about this story it gets crazier and crazier, holy shit!
albertzeyer 3y ago
Now here: https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_trains https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra...
lnsru 3y ago
GPS spoofing might be a solution when such problem occurs. Just make the electronics think, the train moves along equator at 30 mph. I assume the malicious software does not check if train moves on some tracks or just moves.
- p_l 3y ago
  It's mentioned in the talk, the software interrogates speed data from odometers.
  - alexvoda 3y ago
    Then place the train on a giant dynamometer while spoofing the GPS.
    - yetihehe 3y ago
      Much more simple - just rewrite nvram to disable the blocks before returning a train. More effective - sue manufacturer because this whole affair is breach of contract.
      - p_l 3y ago
        Manipulating odometers would be actually illegal from the pov of railway regulations. Two wrongs don't make a right there.
- HackerThemAll 3y ago
  Once the lock condition evaluates to true, the lock bit flips and the train is locked forever (until the manufacturer brings the "magic wand" and unlocks it. It's a scam.
  - p_l 3y ago
    Wasn't mentioned in this talk, but was mentioned in publications earlier - if you attached another train of the same type to the locked one to try and tow it, the freshly attached train locked up too
Log_out_ 3y ago
IoT aka mafia with chips strikes again I worked with PLCs for some time and the whole "a dozen different versions" rings a USBell for me. if I Google newag plc programmer at linkedin, I promise you the number will be the same as the number of versions found in the trains, all branching away from one initial version by one initial programmer. Ocassionally a fb gets exchanged on a USB stick, but the whole version controller magic never reaches the team.
Idesmi 3y ago
These guys are my heroes.
fargle 3y ago
Wow, it's a full hour presentation but time very well spent would be an understatement! This issue has been covered before, but only the rough outline compared to this talk. Great job guys! We all need a lot more like you.
HackerThemAll 3y ago
Shady business practices like that were popular in Poland in 1990s just after the iron curtain collapsed. It's great this emerged to public. The funny thing is that prime minister of the former idiotic government was aware of that and did nothing. Law and justice mafia party is all about pacts, corruption and theft.

378 points by p_l 3y ago

Related: Polish Hackers that repaired DRM trains threatened by train company - https://news.ycombinator.com/item?id=38628635 https://news.ycombinator.com/item?id=38628635 - Dec 2023 (142 comments) Polish train maker denies claims its software bricked competitor rolling stock - https://news.ycombinator.com/item?id=38570654 https://news.ycombinator.com/item?id=38570654 - Dec 2023 (2 comments) Dieselgate, but for trains – some heavyweight hardware hacking - https://news.ycombinator.com/item?id=38567687 https://news.ycombinator.com/item?id=38567687 - Dec 2023 (293 comments) Polish trains lock up when serviced in third-party workshops - https://news.ycombinator.com/item?id=38530885 https://news.ycombinator.com/item?id=38530885 - Dec 2023 (360 comments)

chii 3y ago
[flagged]
- bfeist 3y ago
  God I hate reaction videos. I wish there was a filter.

faitswulff 3y ago

For English speakers intimidated by the introduction, the actual talk is in English.

huytersd 3y ago
[flagged]
- zamadatix 3y ago
  As a native English speaker: I'm curious why not? There are certainly other words and phrases which could fit just as well (concerned, confused, find incomprehensible, etc) but intimidated seems just as fine as any. Perhaps I've slogged through too many foreign slide deck presentations and simply have a particularly odd view now :p. It almost sounds as if you see a way to take this in a negative connotation though?
  - huytersd 3y ago
    Yes. I usually take someone assuming I’m scared of something as a slight affront. It’s diminutive instead of using a word like unintelligible in this case.
    - zen928 3y ago
      Try to not frame general statements through the lens of your worst critics, and to actively give charity while interpretating messages from people who don't demonstrate harmful intent. I don't see anything hostile about someone claiming that those who might feel intimidation by a language they don't speak will feel at ease (because the primarily content is in their language). Assuming a negative intention on a message of seemingly good will should be a moment for you to pause and consider why you think that way, instead of conjuring up post-hoc reasoning to decipher a hidden hate message.
      - septillianator 3y ago
        well said
      - rpastuszak 3y ago
        100% agree. Not a comment on that parent comment per se (didn't read it as it's flagged), but in PL "intimidating" has much more negative connotations which makes the word a tad hard to translate (e.g. intimidating → zastraszający == "trying to scare sm/sb"). Things like this might slip if EN is not your first language. > Assuming a negative intention on a message of seemingly good will should be a moment for you to pause and consider why you think that way, instead of conjuring up post-hoc reasoning to decipher a hidden hate message. As a kid living in a German speaking country I had to deal with racism fairly regularly. I moved to the UK in my early 20s. I still remember the feeling of dread when I saw a nail salon asking for a premium for "nails (with polish)". I obviously knew what that meant, but for a split second I was pissed xd
- misnome 3y ago
  “If” definitely looks like the right word.
- mbork_pl 3y ago
  Tbf, I'm Polish and a language nerd a bit, and I consider a phrase "intimidated by the Polish language" completely justified. ;-)
  - kevin_b_er 3y ago
    The intro from the host/master of ceremonies sounds like German, not Polish.
    - mbork_pl 3y ago
      Ah, you're right, I assumed from the title it would be Polish. But frankly, given the history of my country, the same goes for German, too...

fbdab103 3y ago

I am curious what other industries are likely to have booby-trapped software which has not yet been discovered. It was only through some weird circumstances + dedicated investigation by the hacker group (I thought they were given months of access to the hardware) that this was uncovered. Most organizations do not have the resources to investigate equipment behaving oddly. For example, if HP programs printers to start failing after N pages printed, would that ever be uncovered? Is there some kind of whistleblower law that would allow someone with knowledge to come forward?

p_l 3y ago
A crucial part is the contract wording regarding what exactly was sold when NEWAG sold the trains to the operator - namely, the documentation for maintenance and repair was supposed to be complete. As in, should NEWAG encounter a critical existence failure, it should still be possible for a third party to service the trains so long as parts could be acquired, and in worst case, start working on replacement parts. With most other right-to-repair cases there's way less recourse. With trains in Europe you have legal rules that disallow hiding critical maintenance data behind trade secrets, for example.
- scyzoryk_xyz 3y ago
  This is quite the insight - we’re talking about something purchased in public tender process by a public entity. The train is almost more like a commodity and less like a product. Or „Train-as-a-service” even perhaps? My suspicion is that a lot of this happens only 99% of cases never see light of day due to NDA-s and settlements
- bdavbdav 3y ago
  In my industry we often escrow source code for these situations.
f_devd 3y ago
From personal experience it seems relatively common in the embedded-esque software space, although not always quite as sophisticated as seen here. > Is there some kind of whistleblower law that would allow someone with knowledge to come forward? Depends on where you live, unfortunately anywhere with 'stong' IP laws you aren't allowed to patch anything. Usually reverse engineering analysis is still fine, although if there is a contract saying you're not allowed to you could be screwed anyway. In the train case the locks were specifically for anti-competitive purposes, and so they can whistle-blow for that; and I think in the general case you can sue for misleading dealings/false advertising/etc but not for anything specific to the software locks/traps.

Zuiii 3y ago

Slight tangent, but I really looked forward to (and enjoyed!) the "This Year in Crypto" talks given by DJB and Tanja Lange at past C3s. It was a fun way for a non-cryptologist like me to keep track of all the major happenings in this field. Sadly they stopped giving them a few years back. Does anyone know if there are similar end-of-year roundups that non-cryptologist s can follow to keep up to date?

namibj 3y ago
The security nightmares talk at (also) 37c3?

HideousKojima 3y ago

Has Newag provided any evidence of their claim that this is a conspiracy by their competitor and the hacker group? Or is it literally just them saying "no we didn't"?

ngcc_hk 3y ago
The fact is they found those gps or even third party part denial and how could these be conspiracy I wonder?
seba_dos1 3y ago
I think it goes without saying, but it's of course the latter.
avallach 3y ago
In various trains, over 20 versions of the compiled firmware with unique variants of the locking algorithm were found. And to make matters worse, the trains were found to have something that appears to be a GSM-to-CAN bridge. It isn't reverse engineered yet but AFAIK shouldn't be there and in the worst case may be a remote control backdoor.
- Maxious 3y ago
  Both these points were clarified in the audience questions - it's a UDP to CAN bridge so the Linux based passenger information system knows the state of the train. And only the Linux system is GSM connected (to get network announcements etc.), none of the firmwares were installed remotely, only when trains were sent back to the manufacturer physically.

everyone 3y ago

Perhaps cases like this are good. Most people dont mind DRM at all, they couldnt even tell you what it is though their phones / cars / etc. are riddled with it. A case like this involving a train that wont move is something that's easy to comprehend for the general public and is clearly utter bullshit.

trinsic2 3y ago
Yes, this is a perfect example of what DRM is really about. I'm a repair guy and I'm always trying to protect my customers against walled gardens, and what not. Talking about this article makes explaining right repair so much easier. My concern is the changes they're making to bios in Consumer grade OEM Desktop and Laptops. With adding UEFI certificates to anti-theft software that is enabled by default people just don't understand what's really going on. This article explains it beautifully. Thank you Newtag!

tester756 3y ago

Everytime I see news about this story it gets crazier and crazier, holy shit!

albertzeyer 3y ago

Now here: https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_trains https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra...

lnsru 3y ago

GPS spoofing might be a solution when such problem occurs. Just make the electronics think, the train moves along equator at 30 mph. I assume the malicious software does not check if train moves on some tracks or just moves.

p_l 3y ago
It's mentioned in the talk, the software interrogates speed data from odometers.
- alexvoda 3y ago
  Then place the train on a giant dynamometer while spoofing the GPS.
  - yetihehe 3y ago
    Much more simple - just rewrite nvram to disable the blocks before returning a train. More effective - sue manufacturer because this whole affair is breach of contract.
    - p_l 3y ago
      Manipulating odometers would be actually illegal from the pov of railway regulations. Two wrongs don't make a right there.
HackerThemAll 3y ago
Once the lock condition evaluates to true, the lock bit flips and the train is locked forever (until the manufacturer brings the "magic wand" and unlocks it. It's a scam.
- p_l 3y ago
  Wasn't mentioned in this talk, but was mentioned in publications earlier - if you attached another train of the same type to the locked one to try and tow it, the freshly attached train locked up too

Log_out_ 3y ago

IoT aka mafia with chips strikes again I worked with PLCs for some time and the whole "a dozen different versions" rings a USBell for me. if I Google newag plc programmer at linkedin, I promise you the number will be the same as the number of versions found in the trains, all branching away from one initial version by one initial programmer. Ocassionally a fb gets exchanged on a USB stick, but the whole version controller magic never reaches the team.

Idesmi 3y ago

These guys are my heroes.

fargle 3y ago

Wow, it's a full hour presentation but time very well spent would be an understatement! This issue has been covered before, but only the rough outline compared to this talk. Great job guys! We all need a lot more like you.

HackerThemAll 3y ago

Shady business practices like that were popular in Poland in 1990s just after the iron curtain collapsed. It's great this emerged to public. The funny thing is that prime minister of the former idiotic government was aware of that and did nothing. Law and justice mafia party is all about pacts, corruption and theft.