14 ms·
They have not been trained for this
- deleted 2y ago[deleted]
- sroussey 2y agoI remember this story of “hackers” discovering that the train company disabled trains being serviced by competitors. It’s a shame they are being sued. Hopefully, they raise enough to do painful and invasive discovery.
- scotty79 2y agoIt's a shame that the company wasn't charged with sabotage and possibly treason. Attacking trains, even the ones you manufactured is an attack on nationally crucial infrastructure.
- aeontech 2y agoPrevious discussion, when it was first discovered - I am surprised there wasn't more: https://news.ycombinator.com/item?id=38893116 https://news.ycombinator.com/item?id=38893116
- lukan 2y agoThere is way more (see first comment) https://news.ycombinator.com/item?id=38788360 https://news.ycombinator.com/item?id=38788360
- terramex 2y agoThere was much, much more discussion here, e.g: https://news.ycombinator.com/item?id=38530885 https://news.ycombinator.com/item?id=38530885 https://news.ycombinator.com/item?id=38567687 https://news.ycombinator.com/item?id=38567687 https://news.ycombinator.com/item?id=38628635 https://news.ycombinator.com/item?id=38628635 https://news.ycombinator.com/item?id=38788360 https://news.ycombinator.com/item?id=38788360 & more
- dang 2y agoThanks! Macroexpanded: Manufacturer's Repair DRM Killed Train's Power, Broke Compressor - https://news.ycombinator.com/item?id=38893116 https://news.ycombinator.com/item?id=38893116 - Jan 2024 (2 comments) Breaking "DRM" in Polish trains [video] - https://news.ycombinator.com/item?id=38788360 https://news.ycombinator.com/item?id=38788360 - Dec 2023 (51 comments) Polish DRMed trains stop as predicted due to date-based logic-bomb - https://news.ycombinator.com/item?id=38729035 https://news.ycombinator.com/item?id=38729035 - Dec 2023 (103 comments) Trains were designed to break down after third-party repairs, hackers find - https://news.ycombinator.com/item?id=38638865 https://news.ycombinator.com/item?id=38638865 - Dec 2023 (233 comments) Polish Hackers that repaired DRM trains threatened by train company - https://news.ycombinator.com/item?id=38628635 https://news.ycombinator.com/item?id=38628635 - Dec 2023 (142 comments) Polish train maker denies claims its software bricked competitor rolling stock - https://news.ycombinator.com/item?id=38570654 https://news.ycombinator.com/item?id=38570654 - Dec 2023 (2 comments) Dieselgate, but for trains – some heavyweight hardware hacking - https://news.ycombinator.com/item?id=38567687 https://news.ycombinator.com/item?id=38567687 - Dec 2023 (293 comments) Polish trains lock up when serviced in third-party workshops - https://news.ycombinator.com/item?id=38530885 https://news.ycombinator.com/item?id=38530885 - Dec 2023 (360 comments)
- magicalhippo 2y ago> Macroexpanded Unrelated but is this macro available to others, or just mods? I tried searching the webs for it but found nothing.
- dang 2y agoI use that word as a joke/metaphor - sorry if that misled you! here's more of an explanation if curious: https://news.ycombinator.com/item?id=40564558 https://news.ycombinator.com/item?id=40564558
- magicalhippo 2y agoAha, thanks for the explanation. Bit tedious to do manually, but helpful. Perhaps one day I'll sit down and attempt to make a greasemonkey script for that.
- jdiez17 2y agoI just donated 133,7€ and will gladly do it again if further legal costs arise. Please consider also making a generous donation and post about it in this thread. What Newag is doing here is absolutely vile. They want to charge 20.000€ per train to “reactivate” them after they have been serviced at third party workshops. We must not let them win and set a precedent. I highly encourage everyone to watch the previous presentation: https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_trains https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra...
- silexia 2y agoWe need to fight for the Right to Repair to be in legislation for ALL products! If we buy a product, we should have full access to all software and have the ability to fix it!
- SR2Z 2y agoAt 20k euros, would it not just be cheaper to hire some software people to jailbreak them? If companies that did this got jailbroken and blacklisted by the government, pretty much nobody would try this bullshit.
- None4U 2y agoThis ("software people to jailbreak them") is exactly the identity of the hackers who have been sued
- datavirtue 2y agoIt takes a lot of resources, all rooted in a lot of uncertainty. Not an option for businesses that need equipment.
- talldayo 2y ago> Not an option for businesses that need equipment. On the flip side, it can often be the only option for businesses that need equipment. The US has a longstanding trend of hacking John Deere tractors to accept third-party servicing since John Deere's first-party offerings are both expensive and often unavailable.
- deleted 2y ago[deleted]
- lupire 2y agoIs no one suing the manufacturer for vandalizing the trains?
- terramex 2y ago> It was also revealed that the Polish Internal Security Agency (ABW) had, in October 2022, submitted a case against Newag regarding the abovementioned software manipulation incidents to the prosecutor's office in Nowy Sącz, which initially downplayed the incident until said findings publicly came to light, after which, the investigation was taken over by the regional prosecutor's office in Kraków on suspicion of crimes committed under Article 269 §1 and Article 286 §1 of the Polish Penal Code. > The Sejm's [Sejm is "the lower house of the bicameral parliament of Poland"] Parliamentary Committee for Combating Transport Exclusion subsequently convened three hearings regarding the abovementioned allegations on 17 January, 27 February and 26 March 2024, whose participants included representatives of the Dragon Sector team, Newag, railway operators and members of the Sejm.[19] https://en.wikipedia.org/wiki/Newag#2023_revelation_of_software_sabotage https://en.wikipedia.org/wiki/Newag#2023_revelation_of_softw... I could not find any later updates in polish media.
- praptak 2y agoThe latest update I found is [0] but there aren't any substantial updates about the criminal part of the affair. https://kolejowyportal.pl/dragon-sector-newag-wprowadza-opinie-publiczna-w-blad/ https://kolejowyportal.pl/dragon-sector-newag-wprowadza-opin...
- intunderflow 2y agoNo, and frankly if the Polish government won't do anything with this overwhelming evidence then they've got the train manufacturer they deserve. You can lead a horse to water...
- nicce 2y agoIf that will happen, maybe it is time to start following that money.
- ryandrake 2y agoLooks like train manufacturers are taking a page out of the playbooks of many other companies today. The practice of manufacturers remotely disabling products after the time of purchase (for whatever reason) is becoming a scourge in many other product areas. The device's manufacturer should have no say about how a product is used once money is handed over in exchange for it. This really has to stop. Regulatory agencies around the world are asleep to this problem.
- notpushkin 2y agoCopyright is the root of the problem. More regulation could be a solution, sure, but is it really what we want?
- duxup 2y agoI have no problem with some wide ranging law about right to repair. If that's regulation, yes please.
- jopsen 2y ago> If that's regulation, yes please It is, and as much as we all want to pretend this is always about rent seeking. There can be other reasons. Some systems are bought in manners that include service contracts and outs liability on manufacturers. In such scenarios one man's kill switch could be a safety feature. You don't want unauthorized personel messing about a medical x-ray device. Because (a) you want it to work, (b) there might be 10k+ volts sitting in giant capacitors. I'm guessing it's similar with airplanes. --- In complex enterprise systems, right to repair might not always be simple. But if it comes to your home appliances, a tractor, car, etc. I'd be a lot less worried.
- mulmen 2y agoThis is simply solved through liability. If someone can provide the service and liability guarantees for less than the manufacturer then you hire them. John Deere is proof that the manufacturer alone can't be trusted because they can't provide timely service in a time-critical industry.
- 752963e64 2y ago[dead]
- josefritzishere 2y agoThe CCC are heroes and should be celebrated as such.
- DaSHacka 2y agoNot sure I'd go that far, though their efforts on matters like these are certainly appreciated.
- immibis 2y agoNote that the CCC is more-or-less just a container organization for people who actually do stuff individually. These particular hackers are heroes. Even things like the Congress are run by some people who more-or-less decided to run the Congress each year. There substantial inertia in how things like that are done, of course.
- pmarreck 2y agoWhat happened to the old moral rule of "if you explain to your mom what you are doing and she is dismayed, you are doing things wrong"? Because what Newag is doing very clearly violates it.
- shermantanktop 2y agoPresumably that rule isn’t profitable to follow, and so the prime directive (maximize money in any legal or quasi legal way possible) takes precedence.
- the_gipsy 2y ago"to have a fiscal obligation (to your shareholders)" or something like that.
- deleted 2y ago[deleted]
- joe_the_user 2y agoThat rule is essentially about "what will get you in trouble politically". But today you have a fair number of large and monopolistic operations that just ignore such effects - the press is underfunded and corrupt and politicians are simply corrupt (in a broad sense).
- charlieyu1 2y agoPeople seldom tell the truth to their families and there is always some way to distort a bit to convince yourself
- atoav 2y agoNewag is acting like the mafia here: "Wouldn't it be a shame if your trains stopped working..?" Not that I want to tell the Polish how to do things (I don't), but a satisfying outcome would be one where they found out precisely who gave the order to program Newag trains like that and then jail them. Add to their jailtime for each train that is found running the software and force Newag to do free maintenance on those trains. If Poland wants to show a hard stance on how to deal with people trying to fuck over the public to earn money that's as good as its gonna get. If Poland wants to tell everybody that fucking the polish public pays off even if there is overwhelming evidence that you did it — ok.
- trod1234 2y agoNewAg is clearly acting with malice and sabotage in mind (as well as extortion), and when it comes to trains and railways this is not just a business matter, it becomes a strategic national security issue. "Wouldn't it be a shame if the trains filled with perishable food stuffs stopped working in route..., and the harvests rot" Do you know of any country where food security doesn't impact the government's ability to keep order? If any non-service operator, did this, like a third-party, they would reasonably be considered a terrorist organization, and the members of such a cohort should be treated as such. Even if the claim is made its only for small specific things which you had to agree to, its an inserted vulnerability into the supply chain that is both non-essential for regular function, which has been designed to be essential. At a bare minimum, they pave the way for such groups even if they don't act on it themselves.
- randunel 2y ago> If more than the € 30,000 required to date is donated, if the legal costs are lower or if court costs are repaid, all payments received in excess will be used for the statutory purposes of the Chaos Computer Club e.V.. Please note that the CCC e.V. is not formally recognised as a non-profit organisation. That is one sure way to make people not donate to the cause. I want to support the people, but I don't want my money to go elsewhere, and there is no way of knowing how much has been raised to date or guarantees to get the funds back when the legal costs eventually get covered by Newag. The only guarantee stated is that they will definitely use money for something else. Not OK.
- lionkor 2y agoan e.V. is by its very nature very non-profit-y. I am not an expert, so I encourage you to look up e.V. aka "eingetragener Verein", but basically, its similar to a nonprofit and a lot of rules and laws apply. Its not formally a non-profit in any country because e.V. is a specific German thing. You can, however, rely on that being very rock solid and not for-profit.
- jdiez17 2y agoThat’s a fair point and I had to re-read that sentence multiple times to understand what they are saying. They should indeed say how much money towards this cause has been received.
- saaaaaam 2y agoI’m assuming they have to say this from a legal perspective. In reality what they are saying is “we don’t know how much the legal fees will come to, could be less, could be more. However, once we have proper accounting, if there is money left over this will support CCC” I’m not familiar with German governance for quasi not for profits, but I suspect the idea that funds are conditional for one specific purpose probably breaches governance, and returning funds to donors if certain conditions are/are not met could be problematic from a tax point of view. I know this would be the case in other European jurisdictions with which I am more familiar. And here (from another HN link I just browsed) is other work CCC is doing, his time exposing a major security flaw in VW Audi Group security policies: https://cyberinsider.com/vw-suffers-major-breach-exposing-location-of-800000-electric-vehicles/ https://cyberinsider.com/vw-suffers-major-breach-exposing-lo...
- datavirtue 2y agoThis is almost universal. If manufacturers are not already doing this they are planning it. There is a lot of anxiety around the business model because a lot of the world is advancing and manufacturers are popping up everywhere with cheaper machines on offer. The moats are disappearing and durable goods manufacturers are clamoring for the next wave in the business model: subscription services for maintenance and support. Ford has a connected fleet service offering that is picking up steam and could prove very lucrative in the commercial vehicle space. A lot of this is rooted in an eroding labor pool that is lacking in bodies, training and experience. This train fiasco is definitely bordering on criminal but it isn't far off from the wave of "progress" that is taking place.
- niepiekm 2y agoNewag is also after the Chairwoman of the Parliamentary Team for Combating Transport Exclusion, MP Paulina Matysiak and filed for revoking her immunity. She's been looking into the matter since the news broke last year. https://transinfo-pl.translate.goog/inforail/jest-wniosek-o-uchylenie-immunitetu-paulinie-matysiak-w-zwiazku-ze-sprawa-newagu/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en https://transinfo-pl.translate.goog/inforail/jest-wniosek-o-...
- devwastaken 2y agowe live in a post intellectual property age. its about manufacturing and resources now. it is overwhelmingly used to suppress upstarts and remove diverse competition in the market before they can get their legs. regulators go on to work for the companies they regulated. The conflicts of interest create an oligopoly that is more about lawyers than about engineering. its time we repealed it all. no one gets to own an idea of the universe. especially not a faceless org created for tax purposes.
- userbinator 2y agoSadly, I suspect discoveries like this will only cause other companies to learn from it --- by making it even more difficult to discover their "plausible-deniability" tricks, and hiding them under the guise of "security". Big Tech has been playing that game for a while: https://news.ycombinator.com/item?id=36926276 https://news.ycombinator.com/item?id=36926276 https://news.ycombinator.com/item?id=24955071 https://news.ycombinator.com/item?id=24955071
- neilv 2y agoCan someone please summarize (for those of us who don't know the full story) why the government(s) that bought these trojaned trains isn't ripping the train vendor a new orifice, and pinning medals on the hackers who exposed this?
- immibis 2y agoThe governments are very capitalist and believe big companies should be allowed to do whatever they want.
- sizzle 2y agoIs there a reason they aren’t slapping up a Bitcoin or ethereum or even monero wallet address for crypto donations?! Seems like they are taking a stance against crypto? Why else not use this perfect new decentralized medium for financial support?
- Dkuku 2y agoI wonder why there are no lawsuits from the companies that had to pay to unlock the trains and did not get any documentation what was fixed/replaced to get it running (in 10min) especially that it was not a single train that had to be unlocked. It's like having ransomware on the plc.