8 ms·
Norway reviews cybersecurity after remote-access feature found in Chinese buses
- dredmorbius 1y agoNB: Title shortened for length
- wood_spirit 1y agoIf these were esims they would be much harder to detect or remove? BYD electric busses have recently rolled out where I live in Sweden.
- embedding-shape 1y ago> If these were esims they would be much harder to detect or remove? It's not clear in the article how exactly they discovered it, but by the text that mentions it, I do get the impression they just came across the SIM ports/cards themselves: > internal tests at a secure facility found Romanian SIM cards inside the buses But it could also have been that they put the entire bus in a giant Faraday cage (or similar) and tried to see if it emits anything. If they did that, then eSIM or SIM wouldn't have matter, nor where on the bus it was, they'd eventually see it. But if they just physically came across it, then maybe eSIMs would allow them to place them in less accessible areas. But then maybe that wouldn't matter anyways, if the SIM cards are permanently attached anyways. Bottom line, hopefully wouldn't have made a difference.
- zidel 1y agoA local group of security people have been running a weekend project they call Project Lion Cage where they take Chinese cars into a local mine with spectrum analyzers etc. to watch where they send data and so on. This is how the bus was evaluated as well. Tor Indstøy has quite a few posts on his LinkedIn page talking about the work and what they have found. Press release (Norwegian): https://www.mynewsdesk.com/no/ruter/pressreleases/ruter-tar-samfunnsansvar-gjennomfoerte-unik-sikkerhetstest-av-elektriske-busser-3412738 https://www.mynewsdesk.com/no/ruter/pressreleases/ruter-tar-...
- SchemaLoad 1y agoIf you wanted to maliciously get around this you could just listen for background radio signals. When AM radio and GPS vanish, don't transmit.
- Tor3 1y ago"But it could also have been that they put the entire bus in a giant Faraday cage" And that's what they did. If that was necessary for the conclusions is not said in the article. Only that the remote access could - Update software (well, that's pretty common) - Diagnosis (ditto), and - Manage the control system for battery and power supply. The conclusion by the team was that the buses can be remotely stopped or bricked by the manufacturer.
- bluGill 1y agoBricking a bus via remote software update is easy. What is hard is remotely updating a vehicle and not bricking any of them. I'm under NDA so lets just say it is hard to get something that passes our test group when we are trying to make things work correctly. Trying to brick a vehicle is easy mode. (now if you want to brick it in a specific way that can be hard)
- bronlund 1y agoThis is just stupid. All modern vehicles har been fully remote controllable for years.
- alephnerd 1y agoThe issue was the eSIMs identified were not disclosed by Yutong, which clearly falls afoul of procurement and cybersecurity regulations.
- bronlund 1y agoI wasn't aware of that, thanks. But still, if you go buy a car right now, I doubt they are going to make it a sales pitch that you are not the only one who can control your car.
- amarant 1y agoThis is why we invented the fine print. Not putting this information in the fine print is fraudulent behaviour
- bronlund 1y agoIt was most likely in the specs from the beginning. You can't have busses roaming around with no way to turn them off remotely.
- asplake 1y agoCan't you? And who should have that power? I believe that this is the concern.
- secondcoming 1y agoYes, those wild buses on the loose have been a major problem
- 1y ago
- dlgeek 1y agoWhatever happened with the Polish trains that had all the backdoors that were discovered?
- gessha 1y agoAh, but you see, domestic enshittification and anti-consumer actions are different from the foreign influence boogeyman. \s
- wafflemaker 1y agohttps://www.aftenposten.no/norge/i/Vz7LA6/forsvarets-kinesiske-elbusser-kjoerer-i-faste-ruter-til-norske-militaeranlegg https://www.aftenposten.no/norge/i/Vz7LA6/forsvarets-kinesis... Here, an article (from June 2025) about Chinese buses full of cameras and other sensors driven regularly inside secret Norwegian army bases. Those buses are to be used during a war or a crisis.
- gessha 1y agoI’m with you. I’m arguing that crippled antitrust and anti-consumer practices are part of the problem that led to Chinese buses full of cameras being deployed in western countries. I’ll go a step further and claim DMCA, anti-reverse engineering and other copyright-protection policies have further crippled the ability of the west to detect and prevent such foreign tech influence.
- hopelite 1y agoIt doesn't matter, the point was to get the scare story out.
- sdfhbdf 1y agoNo news. They're stuck in courts. See: https://cyberdefence24.pl/cyberbezpieczenstwo/blokady-w-pociagach-newagu-zwrot-w-sprawie https://cyberdefence24.pl/cyberbezpieczenstwo/blokady-w-poci...
- andy_ppp 1y agoI do worry if they are adding this to buses what are they doing to MacBooks and your phone? Do people here think these devices are compromised or should we take Apple’s word for it!?
- immibis 1y agoOf course they're compromised, by Apple, to comply with UK law.
- wiseowise 1y agoDo you seriously think Apple wouldn’t notice? They’re probably one of the most hated companies in the world, millions are itching to see them fail.
- andy_ppp 1y agoSo where will they get Mac’s or iPhones made if they found out there was some shenanigans going on?
- jonplackett 1y agoThe make a lot of stuff in India and Vietnam now due to the tariffs and general attempts at diversifying
- ChrisMarshallNY 1y ago
- ChrisArchitect 1y agoRelated out of Denmark: Danish authorities in rush to close security loophole in Chinese electric buses https://www.theguardian.com/world/2025/nov/05/danish-authorities-in-rush-to-close-security-loophole-in-chinese-electric-buses https://www.theguardian.com/world/2025/nov/05/danish-authori...
- throwmeaway307 1y agothat's why Intelites are more clever. their "easter eggs" aren't so easy to find... deep in the 2^64-bitspace
- linhns 1y agoSurprisingly Norway choose this brand, never had a good ride in one, feels like sitting in a water boiler.
- TrainedMonkey 1y agoMaybe not so surprising as Norway summer temp averages get into mid 60s F (18C) at the warmest.
- johnofthesea 1y agoRuter operates in and around Oslo where temperatures higher than average. Anyway some of old (diesel?) buses had broken heating and were heating even if it was warm outside. These are still improvement.
- wafflemaker 1y agoThat's averages, but Norway has hot summer days too. Factor in thinner atmosphere (more UV), lower sun angles, over 20h days and you get more warmth with less average temperature. And those buses stink like inside of a plastic factory. Never been to a plastic factory, but rode these buses. And the smell is strong even a year into use. Makes you wonder if China has same rules for carcinogenic plastic in consumer goods.
- stonemetal12 1y agoTo sell in to the local market they would have had to meet local standards.
- RealityVoid 1y agoAll I can say is that shivers go down my spine what could happen if one of those OEM's that have remote updates possible would get their keys compromised. You could brick hundreds of thousands of vehicles. I would be scared shitless to store those things.
- IAmBroom 1y agoForget bricking them. How about driving their batteries to overheat? An entire fleet across a city enflamed...
- RealityVoid 1y agoNot sure that would be possible on demand, but... Yeah, there are tons of options there. Absolutely terrifying. For context, for a short while I wrote SW for auto BCM's albeit the security stuff not the drive your batteries stuff.
- wil421 1y agoDidn’t North Korea supposedly start a data center fire to cover their tracks? I believe they attached the UPS batteries.
- drykjdryj 1y agohttps://en.wikipedia.org/wiki/Speed_(1994_film) https://en.wikipedia.org/wiki/Speed_(1994_film)
- burnt-resistor 1y agohttps://movieweb.com/speed-3-official-update-action-sequel-keanu-reeves/ https://movieweb.com/speed-3-official-update-action-sequel-k... Speed 3: The 'Net Unleashed with Keanu Reeves and Sandra Bullock needs to happen and should be about an EV bus held hostage by ransomware.
- SchemaLoad 1y agoIf they were designed to do that from the start maybe. But usually low level stuff like battery management wouldn't be accessible to the main updatable OS. A lot of it isn't even software controlled, but physical parts designed to pop before things catch fire.
- tiahura 1y agoYou never know when they might need to send the repo man.
- dreamcompiler 1y agoThe life of a repo man is always intense.
- josefritzishere 1y agoIf your transport is accessible remotely, it can be hacked remotely. This reminds me of that story about Polish Trains. In that case GPS was used to execute a kill code. https://social.hackerspace.pl/@q3k/111528162462505087 https://social.hackerspace.pl/@q3k/111528162462505087
- bronlund 1y agoThis 10 year old article may be of interest if you are into stuff like that: https://illmatics.com/Remote%20Car%20Hacking.pdf https://illmatics.com/Remote%20Car%20Hacking.pdf
- pksebben 1y agoWhen the next petya-class worm hits, IOT is going to be so very painful. Personally, I'd like to skip over all of the buildup and go straight to hoverboard mafia pizza delivery.
- noir_lord 1y agoGo full Snowcrash - I can think of several current world leaders who need "Poor Impulse Control" tattooing on their foreheads. I need to re-read that book, one of my all time favourites.
- t-3 1y agoSo... did the Chinese company put Romanian SIMs in the busses? Or was it an importer that installed those? Are there fleet management features enabled by that connectivity or are they actually secret? Also, why would they purchase busses that they thought couldn't be remotely monitored or controlled?! That seems like a very valuable feature for public transport.
- bronlund 1y agoGood questions!
- CerebralCerb 1y agoThe fleet management features that lead to the review are documented and were easily disabled.
- hopelite 1y agoTo me this smells of rather basic economic/political propaganda to scare people. The collective west is clearly getting orders from high above to apply pressure on China and it may just be that this is part of it, spreading an air of concern and fear to dissuade other people who pay attention to this kind of thing in municipalities to avoid Chinese manufacturers. It's rather basic social engineering that has the ham fist of "intelligence" all over it.
- theyinwhy 1y ago> The collective west is clearly getting orders from high above God?
- hopelite 1y agoCalling the U.S. based intel triumvirate God does not seem helpful.
- vintermann 1y agoI don't think it's orders as much as vibes. Some people have finely tuned senses for what they should do to be seen as one of the trustworthy ones, the ones that get it, the ones we could use in a more important job. And that trickles down: one of the things you do, is obviously to network with and boost people who look out for the same kind of political trustworthiness. The ones at the top, assuming they're not asleep/drunk at the wheel/there at all, don't have to do much. The machine operates itself.
- IAmBroom 1y agoI work in rail safety. Two major non-Chinese train companies attempted to merge a few years ago, explicitly to build a company that could compete with China's national company, and provide safer alternatives to state-sponsored cyberhacking of Western rail. It fell down to an anti-monopoly decision by a single person in the EU ministry, who killed the proposal. Several attempts were made to streamline the merger, but she wouldn't budge. As a result, CRCC continues to win contracts abroad, largely (it is believed) by undercutting competition. IP theft is known to be one objective of their at-loss or low-profit contracts (I've been involved in fighting that, specifically). It's hardly a stretch to imagine that having control of the rail in countries that might oppose you militarily is strategically huge. This article is about busways, but the parallels are obvious.
- l5870uoo9y 1y agoLogistics in war is essential so it’s not a stretch. You can easily extend that line of thought to anything from drones to cars.
- beefnugs 1y agoYes easily, like how they use all the public transit buses at the frontlines of ukraine
- XorNot 1y agoUkraine has been buying up every cheap car in Europe for use in miscellaneous service just behind the front or as low profile transportation at it, so I'm not sure what your point is? Civilian transportation has numerous vital roles in supporting a nation during a war.
- adrianN 1y agoThe European champion would still be ten times smaller than the Chinese but would have factual monopoly in Europe. I don’t think blocking the merger was entirely unreasonable.
- coldtea 1y ago>The transport operator stressed there is no evidence of misuse but said the discovery moves concerns “from suspicion to concrete knowledge”. (...) The case comes as Chinese electric buses are increasingly adopted across global markets, If a state wants to hide strategic "war/espionage" control, they don't use eSims and open mobile communications, trivially discoverable and traceable. Sounds like some bs "IoT" / telemetry shit manufactures are shoving down our throats for over a decade. The other side is feigning shock at common industry practices (don't all Tesla's require a net connection for example), to paint it as some unique issue, and kill their sales. In other words , just another episode in the trade war. Not unlike the DJI drones, which added all kinds of shit because the regulators demanded it, and then they act surprised that it has that shit... https://uavcoach.com/dji-ban/#7 https://uavcoach.com/dji-ban/#7
- deleted 1y ago[deleted]
- MisterTea 1y agoWhats sad is Norway sits right next to the country which manufactures Scania and Volvo Busses, but instead buys busses from thousands of km away. I suppose cost is all that maters these days, even for national infrastructure which must remain in control and secure.
- dsign 1y agoI know for a fact that at least one of those companies also installs SIM cards in all their busses. The only difference is who could potentially use the backdoor, and yes Sweden seems slightly less poised to attack Norway than China. At least these days. Because, let's face it, the Swedes owned Norway back in the day and them wanting their oil-rich lucky cousin back at home is deranged but not as much as the Chinese wanting the fjords....
- mort96 1y agoSurprised to learn that Volvo manufactures buses in Sweden considering they're 78% owned by a Chinese conglomerate..
- ZeroGravitas 1y agoI think that's Volvo Cars that the main Volvo sold off to Ford and ended up with Geeky. Trucks and busses remain with the parent Volvo AB.
- adrianb 1y agoVolvo cars was sold to Geely but Volvo Buses (+ trucks) is still a Swedish company.
- eliasson 1y agoWhat is even more sad is that not even Swedish regions buy Scania or Volvo busses. Where I live the region just replaced all local busses with BYD.
- ponector 1y agoAre they making fully electric buses there? Do they have capacity to manufacture thousands of buses annually?
- submeta 1y agoAh, and they never review iPhones/Android phones after Israeli companies demonstrated they can backdoor any cellphone on this planet, and especially after they demonstrated they can explode consumer devices and maim 3000+ people overnight. They don’t review Windows machines either after the Snowden revelations. How many wars did the Chinese start in the past century?
- avereveard 1y agoGlad you asked 1929 – Sino-Soviet Conflict (Chinese Eastern Railway) — ROC authorities moved to seize the CER in Manchuria; the USSR responded militarily. (Initiation: ROC seizure.) 1954–1955 – First Taiwan Strait Crisis — PRC began large-scale shelling of Kinmen/Matsu and amphibious operations (e.g., Yijiangshan). (Initiation: PRC artillery/offensives.) 1958 – Second Taiwan Strait Crisis — PRC opened intense bombardment of Kinmen/Matsu. (Initiation: PRC artillery.) 1962 – Sino-Indian War — PRC launched major offensives in October after a series of frontier incidents. (Initiation: PRC large-scale attack; India calls it unprovoked, PRC says “counter-attack.”) 1967 – Nathu La & Cho La clashes (India border) — Firefights erupted while India was fencing the pass; Chinese forces are generally assessed to have fired first at Nathu La. (Initiation: PRC fire in initial clash.) 1969 – Sino-Soviet Border Conflict — PLA ambushed Soviet troops on Zhenbao/Damansky Island in March; further clashes followed. (Initiation: PRC ambush.) 1974 – Battle of the Paracel Islands (vs South Vietnam) — PLAN/PLA forces expelled RVN units and took full control of the Paracels. (Initiation: PRC naval attack in contested area.) 1979 – Sino-Vietnamese War — PRC invaded northern Vietnam in February. (Initiation: PRC cross-border invasion.) 1984–1989 – Sino-Vietnamese Border War (post-1979 phase) — PRC mounted periodic offensives and artillery duels (e.g., Laoshan/Johnson Mountain). (Initiation: multiple PRC attacks in a protracted conflict.) 1988 – Johnson South Reef Skirmish (Spratlys, vs Vietnam) — PLAN engaged Vietnamese forces and seized the reef. (Initiation: PRC assault during standoff.) Internal (civil/unification campaigns) 1926–1928 – Northern Expedition — ROC (KMT) launched a national unification war against warlords. (Initiation: ROC campaign.) 1930–1934 – Encirclement Campaigns against the Chinese Soviet — ROC initiated successive large operations against CCP base areas. (Initiation: ROC offensives.) 1949–1950 – Hainan & Zhoushan/Coastal-Islands Campaigns — PRC amphibious operations against ROC-held islands during the civil war endgame. (Initiation: PRC landings.) 1950–1951 – Tibet (Chamdo campaign → occupation) — PLA entered eastern Tibet and compelled the Seventeen-Point Agreement. (Initiation: PRC invasion; PRC frames as “peaceful liberation.”)
- croes 1y agoWait until they found out about John Deere, Tesla or any other car with eCall.
- dredmorbius 1y agoExpand? (Teasers ... aren't especially conducive to "intellectual curiosity and thoughtful conversation": <https://news.ycombinator.com/item?id=13108404 https://news.ycombinator.com/item?id=13108404> <https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20intellectual%20curiosity%20thoughtful%20conversation&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...>.)
- croes 1y agoIt's common knowdledge that Tesla makes OTA updates all the time. Same security problem. And eCall obviously needs a SIM card in the car and it's not yours. The remote kill switch became prominent in the Ukrainian war when Russian troops stole John Deere farm vehicles to find them been remotly disabled later on.
- dredmorbius 1y agoThanks!
- metalman 1y agolets see, a modern bus has, woooooo, conectivity, woooooo, on basicly everything, woooooo, so some manager can obsess over oil filters or the voltage on the lighting circuit, and the sixteen antenas advertised in the broshure were,in fact installed realy, wtf?, it's not like anybody is unaware that something like 10 billion things are conected to the net, and dozens, ? hundreds, of actors are doing there best to slurp up every last scrap of data, ha!, that they can the worst part is that it would be no surprise to find out that the bus comes with a monitering contract that is in effect. next it will be cranes all sensored up to detect cable stretch or who know what and didn't china just go ahead and hack the pentagon, but wooooo, Norwiegen bus hacking wooooo
- grigio 1y agoEdward Snowden
- cronelius 1y agoThis is exactly why BYD is and should continue to be banned in the US. It’s not that they are doing this, but that they have done it and they have the capability
- tw1984 1y agoshould US products be banned outside the US because NSA has done all those fancy things and have the capability to do it again?
- deleted 1y ago[deleted]
- throwaway290 1y agoNSA sold cars with remote bricking feature?
- int_19h 1y agoI think it would be eminently reasonable for e.g. China to ban US products on those grounds.
- tw1984 1y agono matter what excuses are used, it is called "闭关锁国", for which every Chinese kid got taught it to be a bad thing. Chinese learnt it the hard way as they did exact that 500 years ago and that didn't end very well.
- chhxdjsj 1y agoHospitals all of the world are wholesale switching to chinese equipment - particularly mindray monitors/anaesthetic machines. China could brick all of these hospitals. We are so incredibly dependent on them.
- hgomersall 1y agoIt should be required that all software running on vehicles should have its source code submitted to the regulators along with the tooling to create reproducible builds, with the expectation that the regulators can audit it for back doors. This should apply to cars, buses trains and planes.
- hollow-moe 1y agoShould've been made a thing even since Volkswagen's dieselgate
- vintermann 1y agoIt's a bit of a non-issue if you ask me. This remote-access feature sounds like what we usually call a software update feature if it came from a country we weren't scared of. China disabling our buses? Really? That would be insanely petty and useless. I think maybe we're straining at gnats and swallowing camels, considering virtually all our phones, computers, TVs etc. come with auto update features, usually giving someone in the US the theoretical capability to brick it. And considering what was done to Karim Khan, I'd say they're far more likely to actually use it.
- ThinkBeat 1y agoI wonder if something liked this could be found in Teslas.
- exabrial 1y agoThis is likely laziness more than malice, but... why are busses connected to the internet?
- ammo1662 1y agoIn China, most of buses in first-tier cities are connected to the internet to report their location and status. This allows you to check the approximate location of the next bus and a relatively accurate arrival time on a map app. It's especially useful in bad weather or traffic congestion , as you don't have to wait in heavy rain or strong winds for a bus with an uncertain arrival time.
- queenkjuul 1y agoReal time position tracking, CCTV streaming/archiving, automatic diagnostics logging, there's many reasons for a modern bus to have wireless data connections and I'd be shocked if most modern buses in the US and Europe don't already have such systems (i know here in Chicago the CCTV feeds can be viewed remotely by staff and most buses have their real time position available via public REST API, though i don't know what tech the buses themselves use to transmit that data)
- rsynnott 1y agoLocation reporting. How else would bus location tracking work? (I think some early implementations worked via transponders in bus stops, but that's obviously a huge pain to roll out and maintain.)
- FpUser 1y agoDuh. What is so surprising here? Is there any serious machinery from any manufacturer that does not have said remote-access feature? For example Deere equipment looted by Russia was remotely disabled by Deere.
- rramadass 1y agoRelated: Why Israel Just Banned 700 Chinese Cars from Its Military—And What It Means for Security - https://securityboulevard.com/2025/11/why-israel-just-banned-700-chinese-cars-from-its-military-and-what-it-means-for-security/ https://securityboulevard.com/2025/11/why-israel-just-banned... IDF recalls 700 Chinese EVs used by senior officers over security concerns - https://www.thejc.com/news/israel/idf-recalls-chinese-evs-security-concerns-v8xjg6xz https://www.thejc.com/news/israel/idf-recalls-chinese-evs-se...
- hmottestad 1y agoI hate the new electric busses from China. Their acceleration is much better and braking effect is also stronger. Bus drivers in Norway are binary people. They either press the accelerator or they press the brake. Most drivers call it leg day, because you spend the entire day pushing on these peddles as hard as you can. Our existing buses have terrible acceleration, which helps a lot with the comfort of the bus ride. But for some unknown reason someone decided that the bendy busses should have the only wheels with power, in the rear of the bus, after the bend. So any slight hill that is slippery from a bit of snow or frost, now becomes a a comedic video of buses trying to drive up before they flop in the middle of the bend and slide back down again.