Polish Hackers Repaired Trains the Manufacturer Artificially Bricked. Now The Train Company Is Threatening Them

Submitted ⁨⁨11⁩ ⁨months⁩ ago⁩ by ⁨btp@kbin.social⁩ to ⁨technology@lemmy.world⁩

https://www.404media.co/polish-hackers-repaired-trains-the-manufacturer-artificially-bricked-now-the-train-company-is-threatening-them/

In one of the coolest and more outrageous repair stories in quite some time, three white-hat hackers helped a regional rail company in southwest Poland unbrick a train that had been artificially rendered inoperable by the train’s manufacturer after an independent maintenance company worked on it. The train’s manufacturer is now threatening to sue the hackers who were hired by the independent repair company to fix it.

After breaking trains simply because an independent repair shop had worked on them, NEWAG is now demanding that trains fixed by hackers be removed from service.

source

Comments

Sort:hotnew top

ShittyBeatlesFCPres@lemmy.world ⁨11⁩ ⁨months⁩ ago
This story should be on every newspaper front page right below war correspondents.

source
- Lev_Astov@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Yeah, especially in the EU where apparently their laws regarding circumventing DRM might make the people who fixed this the bad guys instead of this comically evil manufacturer who put GPS kill switches on public passenger trains.
  
  source
- FlashMobOfOne@lemmy.world ⁨11⁩ ⁨months⁩ ago
  
  right below war correspondents
  
  Eh, they should report war on the same page as the weather if you ask me.
  
  source
  - obinice@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Let us know what country you’re in, so the next time you’re invaded and genocided we’ll remember it’s barely as important as the weather forecast.
    
    source
    -> View More Comments
  - metaStatic@kbin.social ⁨11⁩ ⁨months⁩ ago
    in the sport section
    
    Go Team Go.
    
    source
    -> View More Comments
  - tsonfeir@lemm.ee ⁨11⁩ ⁨months⁩ ago
    Well, climate change is front page news…
    
    source
BloodSlut@lemmy.world ⁨11⁩ ⁨months⁩ ago
“We didn’t add a kill switch to our trains to force the use of our maintenance service, but fuck the hackers that removed the kill switch we didn’t implement, and the trains that were hacked and don’t have the kill switch we didn’t add should be removed from service.”

source
- Th3D3k0y@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Dear Reader, Regarding your recent free and non-profitable un-fucking of our problem, please use the honor system and manually refuck yourself. Love, Technology Companies.
  
  source
  - thefartographer@lemm.ee ⁨11⁩ ⁨months⁩ ago
    Someone’s gonna figure out a horror movie for this called The Refucker
    
    source
  - ASeriesOfPoorChoices@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Wasn’t free - they were paid to hack it.
    
    But yeah.
    
    source
    -> View More Comments
- Jessvj93@lemmy.world ⁨11⁩ ⁨months⁩ ago
  “And how dare those hackers go through all the trouble of finding those (literal) GPS coordinates of train maintenance centers not in our system to circumvent us getting more money.”
  
  source
andrewrgross@slrpnk.net ⁨11⁩ ⁨months⁩ ago
That’s awesome. Man, fuck that company. Bricking a train? Outrageous.

source
- Bizarroland@kbin.social ⁨11⁩ ⁨months⁩ ago
  Poland ought to ban that company from ever working or operating or selling any products inside of its country and any trains made by that company that are not currently owned by Poland should be prevented from traveling on the tracks that cross through Poland.
  
  source
  - SpookyUnderwear@eviltoast.org ⁨11⁩ ⁨months⁩ ago
    This is the kind of government intervention I can get behind. This story is so outrageous, it’s hard to believe it’s true.
    
    source
  - funkless_eck@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
    unfortunately they have a right wing government so it’s likely they’ll want more of this not less
    
    source
    -> View More Comments
  - BearOfaTime@lemm.ee ⁨11⁩ ⁨months⁩ ago
    Maybe make it the entire executive and senior management, rather than the company.
    
    source
  - psud@aussie.zone ⁨11⁩ ⁨months⁩ ago
    I feel like train operators will have heard of this, and will not be accepting that company’s tenders
    
    source
  - vinhill@feddit.de ⁨10⁩ ⁨months⁩ ago
    Realistically, that would be quite an overreaction and the corporation does have valuable knowledge and skill in creating trains. But how great it would be if this were to cause open source code to be a requirement…
    
    source
- thefartographer@lemm.ee ⁨11⁩ ⁨months⁩ ago
  Run by fucking criminals. We should brick them like they’re The Sticky Bandits
  
  source
  - AlwaysNowNeverNotMe@kbin.social ⁨11⁩ ⁨months⁩ ago
    Better to brick them like The Cask of Amontillado.
    
    source
  - pelotron@midwest.social ⁨11⁩ ⁨months⁩ ago
    Great idea, Marv.
    
    source
DacoTaco@lemmy.world ⁨11⁩ ⁨months⁩ ago
The person is doing a talk about it in hamburg, germany (36c3) next week. Its on my to watch list because that sounds hella interresting

source
- khannie@lemmy.world ⁨11⁩ ⁨months⁩ ago
  That actually does sound hella interesting. I’m saving your comment to try to remember but actually look it up in about two years when I scroll back though my saved posts.
  
  source
  - YoorWeb@lemmy.world ⁨11⁩ ⁨months⁩ ago
    youtube.com/@mediacccde
    
    source
    -> View More Comments
  - helenslunch@feddit.nl ⁨11⁩ ⁨months⁩ ago
    I’m saving your comment to try to remember their comment to try to remember to watch that.
    
    source
  - threelonmusketeers@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
    Does Lemmy know have a remind me bot yet?
    
    source
  - foyrkopp@lemmy.world ⁨11⁩ ⁨months⁩ ago
    C3 talks are available online for quite some time after the actual event, so you might still be able to watch it then.
    
    source
    -> View More Comments
  - verity_kindle@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
    Same, same.
    
    source
- pwalker@discuss.tchncs.de ⁨11⁩ ⁨months⁩ ago
  It’s 37c3, but thx for the hint. The talk is called Breaking “DRM” in Polish trains by Redford, q3k, MrTick
  
  I will try to watch it on stage, unfortunately still no final schedule available
  
  source
  - DacoTaco@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Fixed the edition number. I always forget what number we are at haha. I will not be on site, but i saved it in my planner : halfnarp.events.ccc.de/#dec115da17562cebafa9ba7a1…
    
    source
    -> View More Comments
NeoNachtwaechter@lemmy.world ⁨11⁩ ⁨months⁩ ago
Nowadays satire can never be as good as reality is.

source
- Hamartiogonic@sopuli.xyz ⁨11⁩ ⁨months⁩ ago
  Trump and the whole Brexit circus have set a very high bar, but somehow someone still manages to produce quality comedy.
  
  source
helenslunch@feddit.nl ⁨11⁩ ⁨months⁩ ago
This reminds me of the hacked McDonalds ice cream machines. Except the shitty manufacturers won that one.

source
- damirK@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Sadly they will probably win this as well. Some claim there could safety concerns and it isn’t certified or could damage their brand… time for people’s manufacturing of products? Hehe
  
  source
  - Burn_The_Right@lemmy.world ⁨11⁩ ⁨months⁩ ago
    But if the people controlled the means of production… that would be…
    
    source
  - psud@aussie.zone ⁨11⁩ ⁨months⁩ ago
    I think this one might go well. Company preventing a country’s trains from being serviced by a third party. I expect that train builder has already tanked their business, but it would be an interesting one to be litigated, the sort of case that can get the law changed
    
    source
  - WallEx@feddit.de ⁨11⁩ ⁨months⁩ ago
    I’m not firm in polish law, do they have the same laws as in the USA? Because that’s what you’re comparing right?
    
    source
    -> View More Comments
  - Aceticon@lemmy.world ⁨10⁩ ⁨months⁩ ago
    This is an EU country, not the US.
    
    Things like the DMCA provisions forbidding working around IP protection mechanisms (and software is copyrighted) don’t apply here.
    
    IANAL (so take this it with a pinch), unless the trains are legally theirs rather than the train company’s, it’s not hacking, it’s just “software maintenance” and their only right this company has here is to withdraw product warranties because of “unauthorized changes”.
    
    There might or not be a case against the train company (for example, if the contract forbade this or the train company tried to sell those trains onwards as if they were original) but not against the people who did the software changes on the trains when authorized by the owners of said trains.
    
    source
    -> View More Comments
Syo@kbin.social ⁨11⁩ ⁨months⁩ ago
Steam engine breaks, you can fix it.

Steam engine with digital circuit breaks, you're a hacker, a pirate. DRM was a mistake.

source
- Player2@sopuli.xyz ⁨11⁩ ⁨months⁩ ago
  But how else could companies make more money off of something you already paid for? Will someone think of the shareholders‽
  
  source
- Aceticon@lemmy.world ⁨10⁩ ⁨months⁩ ago
  If you’re allowed to do any maintenance you want on the physical components of something you own, then you should be allowed to do any maintenance you want on the software components of something you own.
  
  It’s not hacking (in the sense of “unauthorized intrusion”) if you own it or have authorization to do it from the owner of it.
  
  source
WashedOver@lemmy.ca ⁨11⁩ ⁨months⁩ ago
I wonder if they were taking notes from John Deere and the automotive industry or will it be the reverse here soon?

Just imagine all these vehicles that could be bricked for not going back to the stealerships for outrageous prices on parts and incompetent service.

Also the vehicles that could be disabled for not paying for device protection plan that allows your vehicle to operate safely. It would be a shame if your vehicle stopped working on your way to work or the hospital.

I suspect Tesla, BMW, and John Deere are the closest to this reality.

I sure hope the government doesn’t help with another great cash for clunkers national program to get rid of more cars too old for these measures. Sure is a great way to drive new car sales though…

source
- Maggoty@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Oh don’t count GM and a Ford out of it. They’re already kicking android auto and Apple car to the curb so they can control more stuff and get access to more data. The savvier they get the closer that comes to reality.
  
  Of course, by the end of our lives you won’t own a car at all. You’ll subscribe to a car company that will act like a hybrid ride share and rental program. Commutes will be on a rideshare basis and you’ll be able to rent a car for a weekend road trip.
  
  source
  - WashedOver@lemmy.ca ⁨11⁩ ⁨months⁩ ago
    I just heard about GM this morning in my tech news. I didn’t realize that about Ford too.
    
    I’ve drawn a line in the sand with my vehicles at about 2011 for tech. I love tech and I love cars but just not into the current versions of everything being touch screen controls.
    
    Give me knobs for climate controls, great shifters, and gauges for the rest. They don’t need all of these computer systems that fail or become outdated as soon as they are released like the manufacturer’s nav systems. We also don’t need them to stop working completely because a sensor failed and can only be replaced by the dealer.
    
    My phone in a holder can be the smartest part of the car for me thanks.
    
    source
    -> View More Comments
- Hamartiogonic@sopuli.xyz ⁨11⁩ ⁨months⁩ ago
  If the manufacturer can stop your trains, then obviously anyone with the necessary hacking skills can do it too. Certain governments might be very interested in tampering with the logistics of another country.
  
  source
- helenslunch@feddit.nl ⁨11⁩ ⁨months⁩ ago
  John Deere was hardly the first. We introduced legislation to regulate the automotive industry in 1994.
  
  source
roguetrick@kbin.social ⁨11⁩ ⁨months⁩ ago

SPS became desperate and Googled “Polish hackers” and came across a group called Dragon Sector, a reverse-engineering team made up of white hat hackers.

Hilarious. I hope 404 continues with this level of high quality journalism.

Dragon sector, who they hired, is a security capture the flag team.

https://dragonsector.pl/

source
- sukhmel@programming.dev ⁨11⁩ ⁨months⁩ ago
  TIL that security CTF is
  
  an exercise in which participants attempt to find text strings, called “flags”, which are secretly hidden in purposefully-vulnerable programs or websites
  
  Never heard of this and I may not be alone in that. Thanks for pointing this out.
  
  source
  - khannie@lemmy.world ⁨11⁩ ⁨months⁩ ago
    I did one before. They are SO MUCH FUN. Now I have too many children.
    
    sob
    
    source
- verity_kindle@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
  Finally, hackers with a cool name, like Bellingcat or Oryx. It’s all I’m asking for, but the Russian and North Korean hackers are so disappointing in so many ways.
  
  source
  - SnipingNinja@slrpnk.net ⁨11⁩ ⁨months⁩ ago
    When the government bankrolls you, you’re not allowed to have fun.
    
    source
yamanii@lemmy.world ⁨11⁩ ⁨months⁩ ago
The anti-circumvention clause is being abused for some years now, it’s disgusting.

source
- psud@aussie.zone ⁨11⁩ ⁨months⁩ ago
  This is the sort of case that can fix it
  
  source
- lolcatnip@reddthat.com ⁨11⁩ ⁨months⁩ ago
  Is it abuse, or is it working exactly as intended?
  
  source
  - KeenFlame@feddit.nu ⁨10⁩ ⁨months⁩ ago
    They mean it’s abusive in nature I guess
    
    source
- Aceticon@lemmy.world ⁨10⁩ ⁨months⁩ ago
  So which anti-circumvention clause do you mean?
  
  Remember, US law doesn’t apply in Europe and as much as I know there is nothing like that in the EU.
  
  source
Ruscal@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
badcyber.com/dieselgate-but-for-trains-some-heavy… link for very detailed description of this story, highly recommend the read!

source
- SCB@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Thank you! Came here to ask if anyone had one source with the whole story. This keeps trickling out as it evolves.
  
  source
  - Ruscal@sh.itjust.works ⁨10⁩ ⁨months⁩ ago
    I would assume it is not, UE has some strict rules about fair competition, but the problem is to prove that in the court. Newag is arguing that the hacked and reverse engineered code is not the code they have. Probably in the meantime they run the cleaning protocol in the company…
    But company’s public image will hopefully suffer from the story, maybe at least they loose in eyes of potential buyers.
    
    source
sanqueue@lemmy.world ⁨11⁩ ⁨months⁩ ago
This is good. Someone did that for printers too

source
- Lemminary@lemmy.world ⁨11⁩ ⁨months⁩ ago
  And American Weight (?) digital scales. The ones that brick themselves after 2,000 uses because how dare you only pay once.
  
  source
  - jucelc@lemmy.wtf ⁨11⁩ ⁨months⁩ ago
    Lol. Always suspected there was a scam there, but every time I bring it up in a conversation - people just call me a conspiracy theorist.
    
    This goes for pretty much everything though. Planned obsolescence is real, but people think it’s just the natural way of things.
    
    source
  - DeafeningDistance@feddit.ch ⁨11⁩ ⁨months⁩ ago
    is there an article about this? Would love to read about it
    
    source
    -> View More Comments
Dio9sys@lemmy.blahaj.zone ⁨11⁩ ⁨months⁩ ago
I like how, instead of recognizing that they got caught, now the train manufacturer is claiming this is some kind of dark PR strategy.

If it is, then please show the public that it’s a dark PR strategy by explaining the hidden unlock codes and the DRM code!

source
EdibleFriend@lemmy.world ⁨11⁩ ⁨months⁩ ago
I hate this fucking planet.

source
- DuckOverload@lemmy.world ⁨10⁩ ⁨months⁩ ago
  I think this is pretty cool. Sure, capitalists are gonna capitalist, but here we have subversive moves in a positive direction.
  
  source
  - EdibleFriend@lemmy.world ⁨10⁩ ⁨months⁩ ago
    Oh yeah what the people did to get around this is fucking awesome I do love that side of this story don’t get me wrong.
    
    source
RememberTheApollo_@lemmy.world ⁨10⁩ ⁨months⁩ ago
If they required the trains to be serviced by manufacturer they should have written it into a mandatory service contract at time of sales.

source
simin@lemmy.world ⁨11⁩ ⁨months⁩ ago
the world’s not one’s to fix, learn to protect yourself.

source
- whoisearth@lemmy.ca ⁨11⁩ ⁨months⁩ ago
  No the current model everywhere is to pay a vendor. I’m sure someone can get KPMG or Deloitte to fix the world.
  
  source
alphacyberranger@lemmy.world ⁨11⁩ ⁨months⁩ ago
If anybody wants to know more, they can watch it here www.youtube.com/watch?v=w8NqBXT6Kos

source
- YoorWeb@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Ah, Louis Rossmann, a real-life superhero. He did some great work in his career.
  
  source
btr_fan87@lemmy.world ⁨10⁩ ⁨months⁩ ago
Artificially bricked?! Who the hell keeps giving Viagra to trains? Evil bastards.

source
- ShitOnABrick@lemmy.world ⁨10⁩ ⁨months⁩ ago
  Where did the independent repair shop and cracker smackers touch you on the doll NEWAG 14WE EMU
  
  source
- xytaruka@lemmy.world ⁨10⁩ ⁨months⁩ ago
  Sir Toppam Hat
  
  source
KeenFlame@feddit.nu ⁨10⁩ ⁨months⁩ ago
Spewing bs about how they can’t guarantee the safety and other outrageous shit pouring out their mouths as they provide clearly practiced lawyerspeak to squeeze money from public service into their owners pockets which will then be invested probably in war and killing children for profit.

But let’s discuss ethics and shit! Fuck faces need to be brought to moral justice for the evil they commit every day of their brainwashed miserable hateful lives where they pretend to not harm people because they don’t do it themselves but via money grabbing schemes. One day all of this shit will seem to be as stupid as hitting kids are these days

source
zockerr@lemmy.world ⁨10⁩ ⁨months⁩ ago
Every time I read about this kerfuffle, I am astounded by the sheer stupidity of the manufacturer. Even if they may be technically in the right here(I don’t know, since the contracts they have with the operator aren’t public), they effectively shoot themselves in the foot with this PR Desaster. Especially the various national rail operators across Europe will think twice about buying NEWAG, since these operators usually have their own maintenance and repair centers, and expect to service their rolling stock there. And those national operators still make up the lion’s share of the European rail market.

source
- DSTGU@lemm.ee ⁨10⁩ ⁨months⁩ ago
  This aint much of a problem. NEWAG operates almost exclusively on the internal market
  
  source
FangedWyvern42@lemmy.world ⁨10⁩ ⁨months⁩ ago
Most ethical vehicle manufacturer:

(This is a joke)

source
vsh@lemm.ee ⁨11⁩ ⁨months⁩ ago
I thought white hat hackers only do their shitty CTF exercise everyday. Wouldn’t hacking a DRM’ed national train be a black hat interaction? I’d like to know if that company can press charges.

source
- Lev_Astov@lemmy.world ⁨11⁩ ⁨months⁩ ago
  If you RTFA, they were paid by the repair company who was paid by the private train operator to fix the train. In doing so, they reverse engineered the hardware/firmware and found the DRM added by the manufacturer to prevent the repair company from doing the repairs by bricking the train.
  
  source
- Adanisi@lemmy.zip ⁨11⁩ ⁨months⁩ ago
  Yes yes, how dare they unbrick public infrastructure.
  
  Fuck off.
  
  source
arc@lemm.ee ⁨10⁩ ⁨months⁩ ago
Apparently there was some kind of gps geo fencing going on - that the software detected the train went into an uncertified repair yard and bricked the thing. So I assume the hackers just purged that info, or unset the flags that denoted the brick condition so as far as the train software was concerned it was operating normally.

It’s an interesting hack but there is a safety aspect to this too. A train is a complex machine that could go catastrophically wrong and kill a bunch of people. It’s not quite Boeing 737 levels of safety criticality but neither is it something that should be taken lightly with regards to service procedure or parts procurement. So maybe the manufacturer were being dicks to brick the train. But the train operator using an unauthorised repairer who might not have access to, let alone follow the correct servicing procedures or parts is not good either.

source
rynzcycle@kbin.social ⁨11⁩ ⁨months⁩ ago
Is anyone else hearing Aquarela do Brasil or is it just me...

source