13 ms·
I hacked a train toilet
- jruohonen 3y ago"Amusingly this is not the first DoS vulnerability I've found on a train — but that will have to wait for another article." Don't say more.
- alex-moon 3y agoAlways lovely to see a reminder that electromechanical (non-software) systems can also be hacked. This is the sort of stuff "place hackers" use to get into buildings.
- madsbuch 3y agoMost systems can be hacked with force. You can also "hack" you way into a bank vault if you have 15 million tons of dynamite and an atomic bomb (not sure if there would be anything to come for in the vault at this point, though)
- hlandau 3y agoThis is a fixable bug though. And no force of any kind was used here. As mentioned other trains use the same lever design, but with the lever being spring-returned, which doesn't exhibit this 'vulnerability'. It could also just be fixed in software by making the lock lever input to the microcontroller edge-triggered instead of level-triggered, so that if someone does actually do this it won't lead to a DoS.
- Y_Y 3y agoDenial of Shitter attacks are always unethical. For real though, this is a cool idea and hack, but only a real bastard would put the toilet out of action deliberately. Of course that sort of person does happen to frequent British trains and this is hence valuable research.During the Polish train hacking debacle it was suggested that saboteurs be charged with harming vital national infrastructure, I hope that toiletblockers would be similarly indicted.
- mschuster91 3y ago> Denial of Shitter attacks are always unethical. Here in Germany, the railway itself is the worst culprit - in December, when DB took over the notorious Hof-Munich line, I travelled on a 6-car double decker train that had 5 broken toilets, all of them because either the water was out or the sewage tank full. Not fun. The second worst culprits are idiots throwing trash into the toilet. Diapers, tampons and wet wipes don't belong into regular toilets - but especially not into vacuum toilets like on trains or planes.
- pflenker 3y agoMy train once stopped in Bremen because only one toilet was working and soccer fans were aboard the train. In Bremen we could all leave the train, go to the toilet there and resume our trip some 20 minutes later. That was a bizarre experience.
- davchana 3y agoIn India on long route buses (like 8+ hours) its common for bus to stop for a tea food and bathroom break/stop.
- hollerith 3y agoIt's common on buses in the US, too, but we are talking about passenger trains.
- mattpallissard 3y agoCross country Amtrak has a few stops like that as well.
- blahedo 3y agoI've ridden almost all of the long-distance Amtrak lines and not seen what you describe. There are "long stops" where there are crew changes and refill and restock, but they are not primarily for passengers to visit the train station (and through-passengers that wish to get some fresh air are explicitly warned not to leave the platform, though this is not generally enforced if someone wants to take their chances).
- madsbuch 3y agoI would probably not use the word hacked here, more ruined – Yes, if we use things out of their intended use, block doors, forces switches even though locked, hold switches in intermediate states, it will ruin things. Maybe this is why toilets never work on trains when I need them. What a shame...
- rvnx 3y agoIt's a form of vandalism, breaking toilets for fun and bragging about it. Not cool. Of course you can damage or break any physical system if you apply too much force or use it the wrong way intentionally.
- stavros 3y agoThe author didn't break the toilet. I don't know why commenters here think he did.
- nsteel 3y agoHe is intentionally putting the toilet door controller into a state where a vacant toilet can no longer be accessed. That toilet is of no use to people needing the toilet ... he broke the toilet.
- hlandau 3y agoNothing intentional about it. I certainly wasn't expecting it to get wedged in the way it did. It was back to functioning normally only a short time later in any case.
- nsteel 3y agoIt reads as if the first time (of two) it was stuck this way. So, for some reason you tried playing around again with the lock?! Come on. In any case, on behalf of British train users, please stop occupying the toilet needlessly and playing with the door locks. What happens if you or the next person gets locked in there? What happens if someone thinks you're being suspicious and calls the transport police? The services are delayed enough as it is.
- lukan 3y agoWas there anything wrong, with the good old mechanical locks in train toilets? I have seen so many (elderly) people struggle to properly use the fancy electric ones (and lots of embarrassment, with doors that were indeed not locked) and apparently some people have fun, intentionally disabling them. You know, some people sometimes just have a urgent buisness and are in need of a working toilet on a train.
- madsbuch 3y agoMy guess is that this type of round sliding door takes up much less space compared to solutions where you manually close the door. Unfortunately, manually round sliding doors can be very heavy to close. Especially for wheel chair users. My guess is that this is probably the only way, if you also want to support disabled users while ensuring them most agency in the intimate process of using a toilet.
- hlandau 3y ago(Author here.) I have seen videos (not on trains) of one hybrid - a power-operated round sliding door, but with a physical lock on it, that hooks onto the door frame. So that would be one option. I think the current iteration is fine though - the replacement of the confusing "lock button" with the physical handle, even if emulated, is comprehensible to most, I would think. The "the door is now locked" voiceover also helps reassure people. (Most people are just trying to lock the door and not "fuzz test" the lock handle...)
- lukan 3y agoAh, you were the author as well. Have you noticed anyone from the train company about this flaw? (not saying that much would come out of it, but I think one should try)
- zilti 3y agoI've just way too often seen these fake-physical locks be broken, or working in an unexpected way (with a fucking explanatory sticker with three lines of text explaining it). Who signs off on such crap?
- Popeyes 3y agoUK train toilets are a classic in the bad design book. You have people who haven't locked the door being exposed to the carriage, you have people unable to close the door and people unable to open the door. And that's if you manage to get to the toilet and it hasn't been ruined by a previous occupant.
- midasuni 3y agoOlder toilets were far smaller with a normal kayak handle which opened and closed quickly and had a big simple lock. However those don’t work with some passengers - wheelchair users for example, people with difficultiy holding handles etc. Making toilets more accessible for some groups makes them less accessible for others (. As a society we choose what level to have it at. Some trains in the U.K. have a good balance - a large wheelchair accessible toilet, and a small traditional one, although they sometimes struggle with communicating it.
- zilti 3y agoThat's a nice excuse at first sight, but there is no reason not to just use a normal, physical lock, instead of making the lock worse for absolutely everyone and excusing it with "but accessibility!", all because a few people with lots of good intentions but absolutely no clue at all want to pat each other's backs for being oh so considerate.
- arp242 3y agoThe increased size is indeed very nice from an accessibility perspective, but it seems to me that practically everyone capable of going to the lavatory on their own is also capable of operating a (well-designed) mechanical lock on their own. And for everyone who needs help to do this it's a non-issue because the person helping them can close and lock the door. The caveat here is that I'm not an expert on this, and that I'm possibly argueing from a position of ignorance. But none of the people claiming accessibility benefits (there are several) have made a very convincing case, beyond a mere assertion that it's more accessible. The door design as such is more accessible, but I don't think it actually matters in this context.
- LASR 3y agoThese mechanical hacks are always fun to discover. Although, that poor soul waiting for the toilet, just to find that it was locked with nobody inside - that could be you. These things are harder to test. It’s not just software and state machines. And then there are the truly dangerous mechanical “hacks”. Eg the radiology machine that incorrectly dosed radiation. Therac-25.
- rvnx 3y agoIt's more as if you say "ok if I put glue inside the keylock of someones car, then it will be very difficult to open it, see this is unsafe"
- matheusmoreira 3y agoIt's more like they created a defective system whose safety features can be overcome. Just like this disaster here: https://admiralcloudberg.medium.com/a-legal-and-moral-question-the-crash-of-turkish-airlines-flight-981-and-the-dc-10-cargo-door-saga-d22f0b9fa689 https://admiralcloudberg.medium.com/a-legal-and-moral-questi... > require McDonnell Douglas to redesign the door locking system so that it would be "physically impossible to position the external locking handle and vent door to their normal locking positions unless the locking pins are fully engaged."
- mst 3y agoSeems like given all he did was wiggle a handle it could also potentially happen accidentally. The glue comparison would be more akin to him breaking out logic probes.
- deleted 3y ago[deleted]
- zabzonk 3y agoha! this reminded me of 1969 when i rode from my english boarding school to my parent's flat in paris, france. my dad was working from the UK embassy, helping to organise the RAF stuff at the paris airshow. i was about 15. i got down to dover and across the channel ok, but at calais the trains were all screwed up. i had a seat reserved but it was filled with an elderly frenchwoman in full black regalia who womanfully resisted all efforts of me and the train conductor to pry her out of it. i retreated to the loo (train was packed) and spent the next hour or so pretending dire gastric problems.
- fifilura 3y agoI have actually been in a situation where the motorized door started opening when I was doing my thing. On a train in Sweden. I had the handle in reach so I tried to push it back, but eventually I had to prioritize getting my trousers on. Also in this kind of car the toilet is wider than a usual double seat so there were actually seats outside facing the toilet. Rather embarrasing situation but we are all born naked so it was mostly a fun story. I have no idea what happened, i was not curious enough to go back and investigate, I just got back into my seat and tried to look invisible.
- NikkiA 3y agoHere in the UK the pendolino class trains, at least while operated by Virgin, were notorious for entering into an oscillating open/close loop. So much so that several times the staff would announce which cars had working toilets after each pickup station. Often times, apologising for the smell in the other cars.
- wkjagt 3y agoI don’t understand why we have to put microcontrollers in everything. I think a toilet on a train is basically the same use case as a toilet on a plane and all the planes I’ve been on, all had an old fashioned sliding lock mechanism that works totally ok. I wonder if the train bathroom the poster describes has a timer to avoid people from occupying the bathroom for the complete duration of the journey, and that’s why a mechanical lock won’t work?
- hlandau 3y agoThe microcontroller obsession is real. As is the desire to do everything via software and not mechanically - see touchscreens in cars. I'm pretty sure it's because as developers, we're addicted to the notion of making everything software-defined so you can change everything later if needed. As a developer it's a thought process I understand well, but seems to increasingly lead to detrimental outcomes, like the extreme touchscreenisation of cars - awful from a safety perspective. I am told that "superloos" (those automated self-cleaning toilets installed on the pavement) do have some kind of time limit and will play some kind of audial warning a few minutes before opening. More concerning about those toilets are stories where people somehow managed to be inside the toilet when the self-cleaning process started (which involved the entire chamber being filled with liquid). Supposedly this would happen when someone used the toilet, but held the door open as they left so someone else could use it without paying. The toilet, then thinking it was empty, proceeds to unwittingly try and drown the "undeclared" occupant.
- IshKebab 3y agoPeople definitely got confused by the old design, but I don't understand why they didn't go with the obvious fix: just add an unlock button. Or use a mechanical lock that people can obviously trust. The worst designed toilet lock I ever saw was some kind of weird button you push to lock it. It was so untrustworthy (in the sense that you couldn't tell if it had really locked) that the owners had put up a sign explaining exactly what to do to lock the door and that yes it really was locked.
- tgsovlerkhgsel 3y agoOr, much easier to retrofit: A label saying "Open/Unlock" next to the open button.
- mst 3y ago> Of course, there is a reason for the separation of the closing and locking functions, but not the opening and unlocking functions: it avoids a Denial of Service attack where someone can just press “close” and then jump out before the door closes. If the interior “close” button automatically locked the door, this would result in the toilet becoming permanently inaccessible. There was a class of rolling stock used on UK lines (I encountered them over near Bradford IIRC) that had precisely that misdesign for the inside close button. I had to be really careful using those because my natural reflex is to hit 'close' on my way out for tidiness' sake, and I think I actually -did- the first time I used one of those and only realised what I'd done to my fellow commuters immediately after I heard the click.
- deleted 3y ago[deleted]
- razakel 3y agoThat would be the class 333.
- mst 3y ago[looks] Yep. Ta. Think I was on them in '03 when they were shiny and new and I was commuting from Morecambe to Bradford due to getting unceremoniously redeployed from Salford to Bradford after an acquisition. I do not recommend this as a life choice, though other than the toilet door problem they -were- rather pretty rolling stock.
- zzzeek 3y ago[flagged]
- netsharc 3y agoSomehow the "Wow, that's amazing, now shut up nerd!" vibes of the bully in me got raised reading his write-up. In the video he even managed to fail showing how he could DoS the toilet by stepping out after "locking" the toilet from the inside, because he was pushing open the closing door in order to be able to get out, and that disabled the whole system. At the bottom of the article there's a link to a talk he did if you want to see what kind of a person was doing these "hacks"...
- matsemann 3y agoOr maybe he just wanted to show how it worked, but actually not disable the toilet for others.....? Holy crap, you and the person you're replying to sounds much worse and annoying than what this person did on the train. Get down from your high horses.
- ajsnigrutin 3y ago> Of course, there is a reason for the separation of the closing and locking functions, but not the opening and unlocking functions: it avoids a Denial of Service attack where someone can just press “close” and then jump out before the door closes. If the interior “close” button automatically locked the door, this would result in the toilet becoming permanently inaccessible. This was done in my elementary school (~7-15yo) "back in my times", with analog doors with hand-turned locks. Those door locks usually had a 'screw-like' interface on the outside (similar to this: https://m.media-amazon.com/images/I/51KhCg9ZDFL.jpg https://m.media-amazon.com/images/I/51KhCg9ZDFL.jpg ), so one of the kids would "have to pee" 5 minutes before the end of the lesson, go to the toilets and lock all the doors from outside with a screwdriver/swiss army knife so all of the toilet stalls would seem occupied.
- Metacelsus 3y agoIn elementary school I would lock the stall from inside, and then climb over the top :)
- grishka 3y agoYou guys had stalls with doors and locks in your school toilets? Fancy.
- Loughla 3y agoWe had dividers that went to your chest height and no doors. Like a prison. This was to eliminate smoking in the bathrooms. It did, and nobody used them. We just smoked outside the back of the building.
- ajsnigrutin 3y agoWe had full on stalls with brick/cement walls up to the ceiling (stall sized still, but private), so even the farts were muffled. Communist construction was no joke. Later in college, with some "modernized", capitalist toilets, we got an "open room", thin wooden "walls" that left the botton 20 centimeters open and left a gap on top. In the old part of the buildings, we still had proper stalls, some even with a small sink inside the stall.
- tr888 3y ago[flagged]
- ooterness 3y agoThey used unexpected inputs to manipulate a computerized access-control system. How is that not a hack?
- vrmvrm 3y agoFor most people, 'a hack' refers to a clever solution or exploit used to solve a problem, not merely something that breaks it.
- dang 3y agoPlease don't cross into personal attack in HN comments, regardless of how foolish others are or you feel they are. It's not what this site is for, and destroys what it is for. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the intended spirit of the site, we'd appreciate it.
- jack_riminton 3y agoThis isn't a hack
- lofaszvanitt 3y agoGuy moves like some archenemy from a game :D.
- eCa 3y ago> Of course, there is a reason for the separation of the closing and locking functions, but not the opening and unlocking functions There’s also a psychological aspect to performing the separate action of locking. There are trains in Denmark that only have the ’close’ button. Quite jarring the first time.
- ijhuygft776 3y agobad design... almost as bad as most software.
- userbinator 3y agoA traditional sliding deadbolt[1], which cannot be locked while the door is open since the tongue will prevent the door from closing completely, takes very little force to operate (for those arguing that this overly complex design is "because accessibility"), and can be combined with a switch to prevent the power operated mechanism from attempting to move the door if the lock isn't all the way open (i.e. the switch actuates before the tongue protrudes.) But in this case they clearly attempted to complicate things as much as possible, so no surprise that additional edge-case bugs and points of failure were also introduced. [1] https://i.redd.it/3mclitgdus6b1.jpg https://i.redd.it/3mclitgdus6b1.jpg
- LtWorf 3y agoAnd how do you deal when someone felt sick inside a toilet? Or when a little child locked himself and can't unlock? Or when someone without a ticket went in?
- userbinator 3y agoAnd how do you deal when someone felt sick inside a toilet? Or when a little child locked himself and can't unlock? You add a mechanical override cylinder. Conversely, I could ask "how do you deal with electronic failures that leave the door locked?" Or when someone without a ticket went in? If you got on the train, you already have a ticket. Or do you need a separate ticket just to enter the toilet(!?)
- userbinator 3y agoHow about y'all actually try to write some counterarguments to my points? Or do you just not like to hear the truth?
- LtWorf 3y ago> If you got on the train, you already have a ticket Well you wrote this… which makes me think you've never even seen a train in real life. You should try, before going about designing trains :)
- zikohh 3y agoThe fact that not all trains say please lock the door and the bad UX mean I've seen plenty of people open the door and when they shouldn't have.
- protocolture 3y agoWe had these payphones years ago, some of them still exist but time is running out. Probably the first attempt at a digital payphone in Australia. What we found is that if you held down the language button (IIRC a flag with an L on it), before and as you are lifting the handset, the payphone will display "Out of Order" and you could replace the handset and the message would persist until the handset is lifted again. Of course this was high school, and so we took a purely scientific approach to ruining a lot of peoples lives. If you had a bank of 3 payphones, and you took 2 out of commission in this manner, no one would investigate the out of order handsets long enough to reverse the condition. So you would get a very long line behind the working handset. However if you took all 3 offline, angry telephony consumers would test the handsets and restore them to working order. It was a repeatable study on almost every bank of payphones in our town.
- fieryskiff17 3y ago[dead]
- fsckboy 3y ago>The problem with this design is that most people don't understand state machines, and this design confused a lot of people who were unable to lock the door correctly, or believed they'd locked the door when they hadn't. no, the problem was that it's a stupid state machine that even conducting experiments with you can't be sure how it works unless you're Shrodinger's cat and and you have Shrodinger outside the door and you can communicate
- averageRoyalty 3y ago> Modern trains in the UK have disabled toilets with power-operated doors. Did anyone else find this sentence hard to grok? I was trying to work out why the UK had stopped modern train power-operated door based toilets from working for a moment.