6 ms·

I just donated 133,7€ and will gladly do it again if further legal costs arise. Please consider also making a generous donation and post about it in this threa

I just donated 133,7€ and will gladly do it again if further legal costs arise. Please consider also making a generous donation and post about it in this thread. What Newag is doing here is absolutely vile. They want to charge 20.000€ per train to “reactivate” them after they have been serviced at third party workshops. We must not let them win and set a precedent. I highly encourage everyone to watch the previous presentation: https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_trains https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra...

silexia 2y ago
We need to fight for the Right to Repair to be in legislation for ALL products! If we buy a product, we should have full access to all software and have the ability to fix it!
SR2Z 2y ago
At 20k euros, would it not just be cheaper to hire some software people to jailbreak them? If companies that did this got jailbroken and blacklisted by the government, pretty much nobody would try this bullshit.
- None4U 2y ago
  This ("software people to jailbreak them") is exactly the identity of the hackers who have been sued
  - datavirtue 2y ago
    It takes a lot of resources, all rooted in a lot of uncertainty. Not an option for businesses that need equipment.
    - talldayo 2y ago
      > Not an option for businesses that need equipment. On the flip side, it can often be the only option for businesses that need equipment. The US has a longstanding trend of hacking John Deere tractors to accept third-party servicing since John Deere's first-party offerings are both expensive and often unavailable.
    - seba_dos1 2y ago
      It not only was an option in this case, it was the path taken when all the other options were depleted.
- pantalaimon 2y ago
  That’s pretty much what happened and how this story came about
- kosma 2y ago
  The company was a bit too much in bed with the government to begin with...
- atoav 2y ago
  This isn't a software issue. This is a hackers-found-out-they-were-cheating-and-deactivated-their-train-DRM-and-now-these-hackers-are-getting-sued-issue. And getting sued by a train manifacturer is typically a asymmetrical battle for a private person. Consider watching the original talk (very entertaining and insightful, probably one of the best hacking related videos I watched in 2024), and if you like them toss them a tenner or so.
  - trod1234 2y ago
    Rather than Cheating, don't you mean tortuous interference, followed by vexatious litigation? When you intentionally design systems with purpose to delay, but overall sabotage, you show malice and you defraud the purchaser (after-the-fact), you also interfere with their business with third-parties, and impose coercive costs that have never been acceptable. Coercion is generally not accepted by any civilized society that still follow its original founding principles, and coercion and corruption tend to go hand-in-hand.
- majke 2y ago
  The firmware would need to be certified. They mentioned that in the q&a couple of minutes ago. Apparently its a critical component.
  - mx20 2y ago
    I remember they said in the last talk last year that there is a "cheat code" that resets the software locks, but almost every train also had slightly different software to obfuscate that they are sabotaging their competition.
    - psd1 2y ago
      Yes, although i recall it was more lack of build automation meaning not every train had every patch
conartist6 2y ago
I couldn't figure out how to donate from their website. Where did you donate to?
- jdiez17 2y ago
  The payment information is a bit obfuscated, being only a parenthesized sequence of letters and numbers in the OP. IBAN: DE41 2001 0020 0599 0902 01 BIC: PBNKDEFFXXX Purpose: Lokomotive Payee: CCC eV
  - boneitis 2y ago
    I don't suppose they have any other published, easier methods? I spent almost an hour trying to jump through the fiery, spinning hoops being dangled by my bank website only to finally at the end be given an "It looks like this part of our site isn't working. Please try again later." Thank you, bank /s For anyone else wanting to try their hand and weather the gauntlet, I found slightly more detail of their published bank acct info at: https://www.ccc.de/en/membership https://www.ccc.de/en/membership and an official, physical address over at: https://www.ccc.de/en/imprint https://www.ccc.de/en/imprint
    - School-Cotton 2y ago
      If you are American the easiest way to send money to a European bank account is Wise. If you’re European you should be able to do it through your bank.
    - immibis 2y ago
      For Europeans, this is an extremely easy method and the normal way to send money electronically. The information provided is all that's needed. If you're trying to send from America, it's still the normal way to send a payment to Europe so see how your bank sends international payments.
      - School-Cotton 2y ago
        I have to contradict this, as an American. Don’t attempt to send from your bank as it is likely to be difficult and complicated and involve huge fees. Use Wise instead.
boricj 2y ago
> I highly encourage everyone to watch the previous presentation: https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_trains https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra... According to the schedule [1], there's a presentation from that team titled "We've not been trained for this: life after the Newag DRM disclosure" that will start at 23:00 local time (in about 30 minutes at the time of this writing) on this livestream [2]. Edit: presentation's over and it was outstanding. [1] https://events.ccc.de/congress/2024/hub/en/event/we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure/ https://events.ccc.de/congress/2024/hub/en/event/we-ve-not-b... [2] https://streaming.media.ccc.de/38c3/eins/hls https://streaming.media.ccc.de/38c3/eins/hls
- kaszanka 2y ago
  Here's the live recording link for those who missed it and are too impatient to wait for the cleaned-up one: https://streaming.media.ccc.de/38c3/relive/233cb1d4-4833-5384-aeee-d99344433e0b https://streaming.media.ccc.de/38c3/relive/233cb1d4-4833-538...
  - asciii 2y ago
    Thank you! I have to say that my favorite in their latest update is the 60 day counter can be reset after closing the cabin door and hitting the SOS in the toilet. Now I want interview with the engineers sharing these product requirements...
  - canucker2016 2y ago
    The Luigi-related reference of the talk at 37:03 of the livestream, "Delay, Deflect, Derail" (referring to the response by the Newag train manufacturer representatives, including the president and vice-president of the company, at the parliamentary committee meetings) got a round of applause from the audience. The "...Derail" portion of the slogan references Newag's handout shown a few seconds earlier in the presentation.
    - canucker2016 2y ago
      One of the last slides: Lessons learned? Lawsuits are temporary, glory is forever. Go public.
masklinn 2y ago
Was going to sling an even 100, but yours is funnier so did the same, thanks.
anovikov 2y ago
Precedent isn't as big a concern as many might think, most of Europe does not operate under a precedent-based justice system: it doesn't matter what were the previous decisions of courts on similar cases, the law is the only thing that matters.
- etruong42 2y ago
  Can you elaborate? I'm not a lawyer, but my understanding of the value of precedent is to have courts rule on matters in a manner that is consistent with past rulings. Are you suggesting that courts can interpret the law completely differently from how past courts have ruled? Do you feel like that makes court decisions unpredictable? To be clear, the law changes over time, so newer laws have less precedence, and I expect courts to respect new laws even though no courts have made ruling based on such a law before.
  - hmottestad 2y ago
    Norway works on a precedent system. When electric scooters were reclassified as «small electric vehicles» they suddenly came under the same drunk drive laws as motorbikes and cars. So the lower courts ruled a bunch of drunk driving of electric scooters as severely as they would drunk driving of a 2000 kg car that can go 200 km/h. Essentially they just followed the precedence of previous rulings on drunk driving without taking into consideration the intent of the law. People got huge fines and lost their car licenses for several months on the assumption that if they were careless enough to drink and drive an electric scooter they would be just as likely to drink and drive their car. Eventually a case went all the way to the Supreme Court where they actually thought it through and and decided that there wasn’t any reason to assume that a person would drink and drive a car just because they did so with an electric scooter.

silexia 2y ago

We need to fight for the Right to Repair to be in legislation for ALL products! If we buy a product, we should have full access to all software and have the ability to fix it!

SR2Z 2y ago

At 20k euros, would it not just be cheaper to hire some software people to jailbreak them? If companies that did this got jailbroken and blacklisted by the government, pretty much nobody would try this bullshit.

None4U 2y ago
This ("software people to jailbreak them") is exactly the identity of the hackers who have been sued
- datavirtue 2y ago
  It takes a lot of resources, all rooted in a lot of uncertainty. Not an option for businesses that need equipment.
  - talldayo 2y ago
    > Not an option for businesses that need equipment. On the flip side, it can often be the only option for businesses that need equipment. The US has a longstanding trend of hacking John Deere tractors to accept third-party servicing since John Deere's first-party offerings are both expensive and often unavailable.
  - seba_dos1 2y ago
    It not only was an option in this case, it was the path taken when all the other options were depleted.
pantalaimon 2y ago
That’s pretty much what happened and how this story came about
kosma 2y ago
The company was a bit too much in bed with the government to begin with...
atoav 2y ago
This isn't a software issue. This is a hackers-found-out-they-were-cheating-and-deactivated-their-train-DRM-and-now-these-hackers-are-getting-sued-issue. And getting sued by a train manifacturer is typically a asymmetrical battle for a private person. Consider watching the original talk (very entertaining and insightful, probably one of the best hacking related videos I watched in 2024), and if you like them toss them a tenner or so.
- trod1234 2y ago
  Rather than Cheating, don't you mean tortuous interference, followed by vexatious litigation? When you intentionally design systems with purpose to delay, but overall sabotage, you show malice and you defraud the purchaser (after-the-fact), you also interfere with their business with third-parties, and impose coercive costs that have never been acceptable. Coercion is generally not accepted by any civilized society that still follow its original founding principles, and coercion and corruption tend to go hand-in-hand.
majke 2y ago
The firmware would need to be certified. They mentioned that in the q&a couple of minutes ago. Apparently its a critical component.
- mx20 2y ago
  I remember they said in the last talk last year that there is a "cheat code" that resets the software locks, but almost every train also had slightly different software to obfuscate that they are sabotaging their competition.
  - psd1 2y ago
    Yes, although i recall it was more lack of build automation meaning not every train had every patch

conartist6 2y ago

I couldn't figure out how to donate from their website. Where did you donate to?

jdiez17 2y ago
The payment information is a bit obfuscated, being only a parenthesized sequence of letters and numbers in the OP. IBAN: DE41 2001 0020 0599 0902 01 BIC: PBNKDEFFXXX Purpose: Lokomotive Payee: CCC eV
- boneitis 2y ago
  I don't suppose they have any other published, easier methods? I spent almost an hour trying to jump through the fiery, spinning hoops being dangled by my bank website only to finally at the end be given an "It looks like this part of our site isn't working. Please try again later." Thank you, bank /s For anyone else wanting to try their hand and weather the gauntlet, I found slightly more detail of their published bank acct info at: https://www.ccc.de/en/membership https://www.ccc.de/en/membership and an official, physical address over at: https://www.ccc.de/en/imprint https://www.ccc.de/en/imprint
  - School-Cotton 2y ago
    If you are American the easiest way to send money to a European bank account is Wise. If you’re European you should be able to do it through your bank.
  - immibis 2y ago
    For Europeans, this is an extremely easy method and the normal way to send money electronically. The information provided is all that's needed. If you're trying to send from America, it's still the normal way to send a payment to Europe so see how your bank sends international payments.
    - School-Cotton 2y ago
      I have to contradict this, as an American. Don’t attempt to send from your bank as it is likely to be difficult and complicated and involve huge fees. Use Wise instead.

boricj 2y ago

> I highly encourage everyone to watch the previous presentation: https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_trains https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra... According to the schedule [1], there's a presentation from that team titled "We've not been trained for this: life after the Newag DRM disclosure" that will start at 23:00 local time (in about 30 minutes at the time of this writing) on this livestream [2]. Edit: presentation's over and it was outstanding. [1] https://events.ccc.de/congress/2024/hub/en/event/we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure/ https://events.ccc.de/congress/2024/hub/en/event/we-ve-not-b... [2] https://streaming.media.ccc.de/38c3/eins/hls https://streaming.media.ccc.de/38c3/eins/hls

kaszanka 2y ago
Here's the live recording link for those who missed it and are too impatient to wait for the cleaned-up one: https://streaming.media.ccc.de/38c3/relive/233cb1d4-4833-5384-aeee-d99344433e0b https://streaming.media.ccc.de/38c3/relive/233cb1d4-4833-538...
- asciii 2y ago
  Thank you! I have to say that my favorite in their latest update is the 60 day counter can be reset after closing the cabin door and hitting the SOS in the toilet. Now I want interview with the engineers sharing these product requirements...
- canucker2016 2y ago
  The Luigi-related reference of the talk at 37:03 of the livestream, "Delay, Deflect, Derail" (referring to the response by the Newag train manufacturer representatives, including the president and vice-president of the company, at the parliamentary committee meetings) got a round of applause from the audience. The "...Derail" portion of the slogan references Newag's handout shown a few seconds earlier in the presentation.
  - canucker2016 2y ago
    One of the last slides: Lessons learned? Lawsuits are temporary, glory is forever. Go public.

masklinn 2y ago

Was going to sling an even 100, but yours is funnier so did the same, thanks.

anovikov 2y ago

Precedent isn't as big a concern as many might think, most of Europe does not operate under a precedent-based justice system: it doesn't matter what were the previous decisions of courts on similar cases, the law is the only thing that matters.

etruong42 2y ago
Can you elaborate? I'm not a lawyer, but my understanding of the value of precedent is to have courts rule on matters in a manner that is consistent with past rulings. Are you suggesting that courts can interpret the law completely differently from how past courts have ruled? Do you feel like that makes court decisions unpredictable? To be clear, the law changes over time, so newer laws have less precedence, and I expect courts to respect new laws even though no courts have made ruling based on such a law before.
- hmottestad 2y ago
  Norway works on a precedent system. When electric scooters were reclassified as «small electric vehicles» they suddenly came under the same drunk drive laws as motorbikes and cars. So the lower courts ruled a bunch of drunk driving of electric scooters as severely as they would drunk driving of a 2000 kg car that can go 200 km/h. Essentially they just followed the precedence of previous rulings on drunk driving without taking into consideration the intent of the law. People got huge fines and lost their car licenses for several months on the assumption that if they were careless enough to drink and drive an electric scooter they would be just as likely to drink and drive their car. Eventually a case went all the way to the Supreme Court where they actually thought it through and and decided that there wasn’t any reason to assume that a person would drink and drive a car just because they did so with an electric scooter.