4 ms·

I am curious what other industries are likely to have booby-trapped software which has not yet been discovered. It was only through some weird circumstances + d

I am curious what other industries are likely to have booby-trapped software which has not yet been discovered. It was only through some weird circumstances + dedicated investigation by the hacker group (I thought they were given months of access to the hardware) that this was uncovered. Most organizations do not have the resources to investigate equipment behaving oddly. For example, if HP programs printers to start failing after N pages printed, would that ever be uncovered? Is there some kind of whistleblower law that would allow someone with knowledge to come forward?

p_l 3y ago
A crucial part is the contract wording regarding what exactly was sold when NEWAG sold the trains to the operator - namely, the documentation for maintenance and repair was supposed to be complete. As in, should NEWAG encounter a critical existence failure, it should still be possible for a third party to service the trains so long as parts could be acquired, and in worst case, start working on replacement parts. With most other right-to-repair cases there's way less recourse. With trains in Europe you have legal rules that disallow hiding critical maintenance data behind trade secrets, for example.
- scyzoryk_xyz 3y ago
  This is quite the insight - we’re talking about something purchased in public tender process by a public entity. The train is almost more like a commodity and less like a product. Or „Train-as-a-service” even perhaps? My suspicion is that a lot of this happens only 99% of cases never see light of day due to NDA-s and settlements
- bdavbdav 3y ago
  In my industry we often escrow source code for these situations.
f_devd 3y ago
From personal experience it seems relatively common in the embedded-esque software space, although not always quite as sophisticated as seen here. > Is there some kind of whistleblower law that would allow someone with knowledge to come forward? Depends on where you live, unfortunately anywhere with 'stong' IP laws you aren't allowed to patch anything. Usually reverse engineering analysis is still fine, although if there is a contract saying you're not allowed to you could be screwed anyway. In the train case the locks were specifically for anti-competitive purposes, and so they can whistle-blow for that; and I think in the general case you can sue for misleading dealings/false advertising/etc but not for anything specific to the software locks/traps.
- kvdveer 3y ago
  > unfortunately anywhere with 'stong' IP laws you aren't allowed to patch anything. I am not aware of any IP laws that prohibit patching, except for circumventing copy protection (DMCA). There are plenty of laws prohibiting distributing patches, but making and using them are not commonly prohibited AFAIK.
  - f_devd 3y ago
    You can technically distribute patches, a good example of what is possible is SNES ROM hacks, where only the deltas are be distributed, and the end-user provides their own 'legal' copy; this avoids the issue of redistributing copyrighted content. However in the EU you aren't allowed to use information obtained through "decompilation" for the purpose development/production of a substantially similar program. Which means you cannot patch any program (exception exists for the purpose of interoperability), without risking some legal liability. 2009/24/EC Article 6 for anyone interested.
- me_me_me 3y ago
  > although not always quite as sophisticated as seen here It feels that implementation of that system was quite complicated. Complicated enough that quite few people must have been involved in it. Its quite sad that developers would implement this and all keep their mouth shut.
  - Muehe 3y ago
    What got me was the geofencing for the trains to break down when in competitors workshops. Was apparently only found in 2 out of 30 trains, but still there is no plausible deniability here at all.
chrisandchris 3y ago
According to this thread [1] (and an unrelated one I can't find anymore) some printer manufacturer region lock their printers accepted cartridges, which makes the product useless in some circumstances just because of your location. I think the incentive is money. 1 train is worth much money, a single printer is not. Most people won't have any issue with the printer and if so, loss is low. If just 1 train has this issue, loss might be huge. [1] https://news.ycombinator.com/item?id=31860845 https://news.ycombinator.com/item?id=31860845
- bayindirh 3y ago
  HP does this. I'm not sure if you can reset the value after moving, but the cartridges have a "Region" value. The cartridge region is printed per cartridge while printing "print quality" reports which prints full-nozzle lines to see whether there are any persistently clogged nozzles on your printhead.
- probably_wrong 3y ago
  My parents are currently bitten by this - they can't find cartridges for their HP printer and I cannot send them any because they wouldn't match the region. Also, some poor soul at The Verge went through hell and back to document the fun experience of trying to use an HP printer on a different region: https://www.theverge.com/23648726/hp-officejet-printer-region-how-to-change-why https://www.theverge.com/23648726/hp-officejet-printer-regio...
glandium 3y ago
> For example, if HP programs printers to start failing after N pages printed, would that ever be uncovered? I can't find it right now, but wasn't there a story some months ago about some printers doing exactly that to make you buy new ink cartridges?
- bayindirh 3y ago
  That was about HP's ink subscription service, "HP Instant Ink", where your printer stops printing if you stop renewing your ink subscription and try to print with the subscription supplied cartridge. I'm on my 4th HP Inkjet, and none of them did anything remotely similar. One worn down (which was a bottom of the barrel model), the two of them was donated, and AFAIK one is still pretty operational. I'm regularly using my Deskjet Ink Advantage 4515, which is ~10 years old at this point.
- QVVRP4nYz 3y ago
  It is actually quite common in hellish world of printers, but with a bit more plausible deniability. "Our printed page counter indicated the cartridge/drum needs replacement, we couldn't know it was half full / it is all to preserve maximum quality" - so typical bullshit, that people somehow already got used to. The consumer electronic is already crazy, I mean people mod-chipped Keurig to use "pirated" coffee.
- mbirth 3y ago
  I've also seen a report about ink printers failing without any proper error message because of a full sponge. (Where all the ink goes when you clean the heads.) If you disassemble the printer and replace the sponge, it magically starts working again.
byt3blight 3y ago
[dead]
grishka 3y ago
> For example, if HP programs printers to start failing after N pages printed, would that ever be uncovered? Maybe. The problem with consumer devices is that they're much better protected from their end users, so it's harder to dump the firmware to reverse engineer it. Firmware update files, while you can easily get your hands on them, are usually encrypted. Sometimes it's so bad that the best course of action is to find an RCE vulnerability and exploit it. Though, with inkjet printers being as popular in some parts of the world as they are for some reason, and being as annoying as they are, I'm surprised no one has done that yet.

p_l 3y ago

A crucial part is the contract wording regarding what exactly was sold when NEWAG sold the trains to the operator - namely, the documentation for maintenance and repair was supposed to be complete. As in, should NEWAG encounter a critical existence failure, it should still be possible for a third party to service the trains so long as parts could be acquired, and in worst case, start working on replacement parts. With most other right-to-repair cases there's way less recourse. With trains in Europe you have legal rules that disallow hiding critical maintenance data behind trade secrets, for example.

scyzoryk_xyz 3y ago
This is quite the insight - we’re talking about something purchased in public tender process by a public entity. The train is almost more like a commodity and less like a product. Or „Train-as-a-service” even perhaps? My suspicion is that a lot of this happens only 99% of cases never see light of day due to NDA-s and settlements
bdavbdav 3y ago
In my industry we often escrow source code for these situations.

f_devd 3y ago

From personal experience it seems relatively common in the embedded-esque software space, although not always quite as sophisticated as seen here. > Is there some kind of whistleblower law that would allow someone with knowledge to come forward? Depends on where you live, unfortunately anywhere with 'stong' IP laws you aren't allowed to patch anything. Usually reverse engineering analysis is still fine, although if there is a contract saying you're not allowed to you could be screwed anyway. In the train case the locks were specifically for anti-competitive purposes, and so they can whistle-blow for that; and I think in the general case you can sue for misleading dealings/false advertising/etc but not for anything specific to the software locks/traps.

kvdveer 3y ago
> unfortunately anywhere with 'stong' IP laws you aren't allowed to patch anything. I am not aware of any IP laws that prohibit patching, except for circumventing copy protection (DMCA). There are plenty of laws prohibiting distributing patches, but making and using them are not commonly prohibited AFAIK.
- f_devd 3y ago
  You can technically distribute patches, a good example of what is possible is SNES ROM hacks, where only the deltas are be distributed, and the end-user provides their own 'legal' copy; this avoids the issue of redistributing copyrighted content. However in the EU you aren't allowed to use information obtained through "decompilation" for the purpose development/production of a substantially similar program. Which means you cannot patch any program (exception exists for the purpose of interoperability), without risking some legal liability. 2009/24/EC Article 6 for anyone interested.
me_me_me 3y ago
> although not always quite as sophisticated as seen here It feels that implementation of that system was quite complicated. Complicated enough that quite few people must have been involved in it. Its quite sad that developers would implement this and all keep their mouth shut.
- Muehe 3y ago
  What got me was the geofencing for the trains to break down when in competitors workshops. Was apparently only found in 2 out of 30 trains, but still there is no plausible deniability here at all.

chrisandchris 3y ago

According to this thread [1] (and an unrelated one I can't find anymore) some printer manufacturer region lock their printers accepted cartridges, which makes the product useless in some circumstances just because of your location. I think the incentive is money. 1 train is worth much money, a single printer is not. Most people won't have any issue with the printer and if so, loss is low. If just 1 train has this issue, loss might be huge. [1] https://news.ycombinator.com/item?id=31860845 https://news.ycombinator.com/item?id=31860845

bayindirh 3y ago
HP does this. I'm not sure if you can reset the value after moving, but the cartridges have a "Region" value. The cartridge region is printed per cartridge while printing "print quality" reports which prints full-nozzle lines to see whether there are any persistently clogged nozzles on your printhead.
probably_wrong 3y ago
My parents are currently bitten by this - they can't find cartridges for their HP printer and I cannot send them any because they wouldn't match the region. Also, some poor soul at The Verge went through hell and back to document the fun experience of trying to use an HP printer on a different region: https://www.theverge.com/23648726/hp-officejet-printer-region-how-to-change-why https://www.theverge.com/23648726/hp-officejet-printer-regio...

glandium 3y ago

> For example, if HP programs printers to start failing after N pages printed, would that ever be uncovered? I can't find it right now, but wasn't there a story some months ago about some printers doing exactly that to make you buy new ink cartridges?

bayindirh 3y ago
That was about HP's ink subscription service, "HP Instant Ink", where your printer stops printing if you stop renewing your ink subscription and try to print with the subscription supplied cartridge. I'm on my 4th HP Inkjet, and none of them did anything remotely similar. One worn down (which was a bottom of the barrel model), the two of them was donated, and AFAIK one is still pretty operational. I'm regularly using my Deskjet Ink Advantage 4515, which is ~10 years old at this point.
QVVRP4nYz 3y ago
It is actually quite common in hellish world of printers, but with a bit more plausible deniability. "Our printed page counter indicated the cartridge/drum needs replacement, we couldn't know it was half full / it is all to preserve maximum quality" - so typical bullshit, that people somehow already got used to. The consumer electronic is already crazy, I mean people mod-chipped Keurig to use "pirated" coffee.
mbirth 3y ago
I've also seen a report about ink printers failing without any proper error message because of a full sponge. (Where all the ink goes when you clean the heads.) If you disassemble the printer and replace the sponge, it magically starts working again.

byt3blight 3y ago

[dead]

grishka 3y ago

> For example, if HP programs printers to start failing after N pages printed, would that ever be uncovered? Maybe. The problem with consumer devices is that they're much better protected from their end users, so it's harder to dump the firmware to reverse engineer it. Firmware update files, while you can easily get your hands on them, are usually encrypted. Sometimes it's so bad that the best course of action is to find an RCE vulnerability and exploit it. Though, with inkjet printers being as popular in some parts of the world as they are for some reason, and being as annoying as they are, I'm surprised no one has done that yet.