Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German rail operator says train disruption caused by sabotage

dw.com

Post reply on HN
Print view View original

41–50 of 103 posts

Re: German rail operator says train disruption caused by sabotage

#41

Post by ajross »

chiefalchemist wrote: post #29
DoingIsLearning wrote: post #4

Maybe I am tinfoiling too hard... In February this year there was an attack against Vodafone Portugal that brought down their whole mobile networks, 4G, 5G, and fiber, taking them several days to bring everything back up [0]. It also very clearly was a state actor, no threats, no ransom, sophisticated. Taking down pipelines, taking down comms, taking down transport infrastructure. All within a few months. Always on N…

How is this tinfoiling? The tinfoiler would think it's an inside (NATO) job. That these things are being done to maintain the fear, to increase the military budgets (i.e., money that could be spent on social programs), to increase the us v them unity, etc. Like 1984? But perhaps The MIC qualifies as a state actor? As it's said...follow the money. There are so many entities that benefit from such things it's difficult…

> That these things are being done to maintain the fear, to increase the military budgets

Somehow I think the shooting war in Europe right now is doing that just fine without the need for tinfoil.

If there's anything that does not need to be further incentivized among European populations and governments right now, it's NATO coordination.

Re: German rail operator says train disruption caused by sabotage

#42

Post by locallost »

What's peculiar is that the railway itself used the word "sabotage". Interruptions happen all the time and the description is usually just a specific thing that happened - damage to the grid, snow, suicide... In comparison, sabotage has very strong implications, as if they want people to assume something.

Re: German rail operator says train disruption caused by sabotage

#43

Post by dividedbyzero »

captainmuon wrote: post #19
DoingIsLearning wrote: post #4

Maybe I am tinfoiling too hard... In February this year there was an attack against Vodafone Portugal that brought down their whole mobile networks, 4G, 5G, and fiber, taking them several days to bring everything back up [0]. It also very clearly was a state actor, no threats, no ransom, sophisticated. Taking down pipelines, taking down comms, taking down transport infrastructure. All within a few months. Always on N…

Yeah but I would assume the same attack is not going to be successfully against the same target a second time. So they are essentially providing free pentesting. And creating a climate that allows governments to introduce much stronger security measures. Without creating much actual damage. Also I wonder if it was a physical oder purely software attack? If it was a physical attack on a critical system, it could have…

The German security landscape in general is in a pretty bad shape, hence such pentesting isn't all that valuable. Patch one vector, dozens or hundreds left open, and there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades old, fully analog, built without any security considerations at all, and falling apart on its own. IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law), but physical security often as not turns out to be a sturdy closet with a hardware store combination padlock, even for things that would be considered critical and protected much better in other places.

I think this is about sending a message (we're aware of that situation + able and willing to take advantage of it) and to do it in a way that can't be kept under wraps. I guess this won't make it any easier for Chancellor Scholz to send the tanks Ukraine requested.

Re: German rail operator says train disruption caused by sabotage

#44

Post by baybal2 »

DoingIsLearning wrote: post #4

Maybe I am tinfoiling too hard... In February this year there was an attack against Vodafone Portugal that brought down their whole mobile networks, 4G, 5G, and fiber, taking them several days to bring everything back up [0]. It also very clearly was a state actor, no threats, no ransom, sophisticated. Taking down pipelines, taking down comms, taking down transport infrastructure. All within a few months. Always on N…

No post body was provided.

Re: German rail operator says train disruption caused by sabotage

#45

Post by bombcar »

dathinab wrote: post #36
jaza wrote: post #25

Earlier quoted context omitted.

German rail not known for its reliability... really?! Perhaps not in Germany. But in most other countries, German rail is perceived to be very reliable. And compared to rail in most other countries, German rail is very reliable!

Compared to e.g. Japan and some other countries long distance trains in Germany are _very_ unreliable. Compared to some other countries it is extremely reliable. Local train service reliability differs quite a bit depending on region and sometimes in region which exact train you take. And perception of reliability can differ from reality, e.g. Berlin people always complain about how unreliable their public transporta…

Amusingly a transit system has to be pretty decent to be bad - if it is actually horribly bad people don’t treat it at all reliable so they don’t really notice late trains, because getting a train at all is a miracle.

Re: German rail operator says train disruption caused by sabotage

#46

Post by luckylion »

jaza wrote: post #25
tastroder wrote: post #15

Earlier quoted context omitted.

It's not, especially on the weekend. The freight delays might be somewhat of an issue over the next few days but on the passenger side it's a mild inconvenience at best. It disrupted the rail network country-wide to some degree but the public rail infrastructure in Germany isn't really known for it's reliability anyway.

German rail not known for its reliability... really?! Perhaps not in Germany. But in most other countries, German rail is perceived to be very reliable. And compared to rail in most other countries, German rail is very reliable!

That's why you should hire the PR companies they're using, not the train companies themselves.

Partially joking, I think the image stems from the past, but the system degrades when it's not maintained appropriately.

There was an entertaining talk at a CCC event a few years back which looked at DB reliability and accuracy (in German): https://www.youtube.com/watch?v=0rb9CfOvojk

Re: German rail operator says train disruption caused by sabotage

#47

Post by archi42 »

blumomo wrote: post #38

Coincidentally there are very big demonstrations scheduled for today in Berlin. Trains not running to Berlin is definitely reducing the amount of participants joining these events. Just saying.

There is probably also at least one police or military or intelligence training camp happening right now in northern Germany. Just saying.

Re: German rail operator says train disruption caused by sabotage

#48

Post by formerly_proven »

dividedbyzero wrote: post #43
captainmuon wrote: post #19

Earlier quoted context omitted.

Yeah but I would assume the same attack is not going to be successfully against the same target a second time. So they are essentially providing free pentesting. And creating a climate that allows governments to introduce much stronger security measures. Without creating much actual damage. Also I wonder if it was a physical oder purely software attack? If it was a physical attack on a critical system, it could have…

The German security landscape in general is in a pretty bad shape, hence such pentesting isn't all that valuable. Patch one vector, dozens or hundreds left open, and there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades old, fully analog, built without any security considerations at all, and falling apart on its own. IT securi…

> IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law)

To chime in on this, if you're in Germany and report a security vulnerability to a vendor there's a very good chance you'll get a criminal investigation, house searched, computers/phones seized for a long time etc. in return. Often in combination with a cease and desist or civil charges.

It's not a good idea to approach vendors directly with findings in general, but in Germany doing that can seriously screw your life up.

I wouldn't do security research in Germany at all. If you have talents in the area, just go to the US.

Re: German rail operator says train disruption caused by sabotage

#50

Post by tetha »

dividedbyzero wrote: post #43
captainmuon wrote: post #19

Earlier quoted context omitted.

Yeah but I would assume the same attack is not going to be successfully against the same target a second time. So they are essentially providing free pentesting. And creating a climate that allows governments to introduce much stronger security measures. Without creating much actual damage. Also I wonder if it was a physical oder purely software attack? If it was a physical attack on a critical system, it could have…

The German security landscape in general is in a pretty bad shape, hence such pentesting isn't all that valuable. Patch one vector, dozens or hundreds left open, and there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades old, fully analog, built without any security considerations at all, and falling apart on its own. IT securi…

> there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades

Honestly, there is the opposite of a strong security mindset over here. Just a year ago, a security expert found an app of a major party leaking data of thousands of private persons - it was basically a web application without authorization. She tried to disclose this responsibly and naturally got sued due to unauthorized access to computer systems. Lilith Wittman is the person if you want to look further into it.

That's the standard here for security topics.

And if you keep digging into prosecution of cyber criminality, or at least actions of the state to increase cyber security, or at least actions to increase competency in cyber topics, it just gets worse. For example, they are looking for cyber security experts to join the police and state departments, but because they'd be working in various kinds of police jobs... they have to go through the same fitness and endurance tests as all police officers. Casual things like 12 minute runs, obstacle courses under pressure. Things IT-Nerds are good at.

I might have been interested some time ago, but currently that's just a recipe for criminal charges and disappointment.

Post reply on HN