Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dieselgate, but for trains – some heavyweight hardware hacking

badcyber.com

Post reply on HN
Print view View original

91–100 of 309 posts

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#91

Post by robertlagrant »

terminous wrote: post #57
verisimi wrote: post #36

[flagged]

It is clear you haven't even clicked on the article. Shame on you. This deserves a ban from HN. Just reading the headlines and contributing to a discussion about that article as if you actually read it is deceptive and wrong. It's killing our ability to meaningfully discuss content when people just read the headlines. If you don't want to read articles and instead post about what you think the articles must be based…

> Shame on you.

This is not appropriate.

> It's killing our ability to meaningfully discuss content

Hyperbole doesn't help discussion either. As my sibling comment says, just downvote and move on.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#92

Post by mordae »

bmacho wrote: post #83
rlpb wrote: post #67

Earlier quoted context omitted.

An organisation that is prepared to write "sabotage" software would have no problem deploying software that is different to the software they submit.

Compile the code yourself?

Right. Mandate that the software is delivered with CI pipeline running in the client's environment with 100% reproducible builds and verify checksums.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#93

Post by H8crilA »

konschubert wrote: post #48
yard2010 wrote: post #27

Earlier quoted context omitted.

Corruption is not just the dark side of Poland, but the entire west IMHO

The west is the least corrupt part of the world. https://en.wikipedia.org/wiki/Corruption_Perceptions_Index#/...

It baffles me that people don't realize just how bad it is in non democratic countries. Russia has FSB extorting shop owners for protection money, and even an occasional assassination is nothing particularly interesting there. Chinese companies have party cells in management. Venezuela or many African countries need to hire foreign contractors (sometimes Western :) ) so that their heads of state and other VIPs do not get killed by their coworkers. The Red Sea has actual pirates. Lebanon failed to remove kilotons of explosive ammonia nitrate for years, until it eventually blew up the capital. I could go on and on, but you can see how this compares to "train company bricked a train and it's a major scandal".

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#94

Post by mordae »

2rsf wrote: post #65
ZeroGravitas wrote: post #30

Great advert for free and open source software. As with dieselgate, this suggests you basically cannot trust anything containing software. Can't trust it to follow regulations. Can't trust it to do its job. Can't trust the software. Can't trust the institutions that write the software. All very "late stage capitalist software development".

I'm all for free and open source software, but what would you suggest here? That train operators will download code from the internet and install it on their trains?

Yes. Once it's signed by somebody accredited to review it for safe train use.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#95

Post by achileas »

2rsf wrote: post #65
ZeroGravitas wrote: post #30

Great advert for free and open source software. As with dieselgate, this suggests you basically cannot trust anything containing software. Can't trust it to follow regulations. Can't trust it to do its job. Can't trust the software. Can't trust the institutions that write the software. All very "late stage capitalist software development".

I'm all for free and open source software, but what would you suggest here? That train operators will download code from the internet and install it on their trains?

Open source means just that - it doesn’t imply one sort of distribution mechanism over others.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#96

Post by ponector »

h2odragon wrote: post #46
HackerThemAll wrote: post #24

In a properly functioning country the responsible persons should already be imprisoned. Some governmental agencies were aware of that for at least half a year, but failed to act. The fact that source code was not immediately dumped and analyzed is the evidence of malevolence, corruption and intentionally putting people's lives at risk. Welcome to the dark side of Poland - where citizens don't matter.

"the responsible persons" ... hmmm. Who would that be? The programmer who implemented the code? Do you think they thunk these tricks up? They was just following orders. The manager of the programming team, who set these tricks as things that needed to be implemented? Again, just following orders. The "Cxx" Title people who directed that there be "some protection" in some way that got implemented as what we see? Did t…

Everyone in FTX except SBF should be innocents then. They was just following orders.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#97

Post by yetihehe »

93po wrote: post #75
albumen wrote: post #17

Earlier quoted context omitted.

The manufacturer lost the bidding process, so quite reasonably (if you look at it in a limited fashion) said "Fine, let SLS do the work, you're on your own". Arsehole-ish, but not illegal. All the hidden lockouts on the other hand....

I don't think it's assholeish for someone who's not getting compensated in any way to not help out. It's a business. They have an active incentive to NOT help.

It's not about "not wanting to help". It's about placing logic bombs of "if vehicle is at this gps coordinates of a competitor, engage self-destruct". Hackers actually did extract such coordinates from train firmware.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#98

Post by goodpoint »

galangalalgol wrote: post #42
lqet wrote: post #28

My impression is that the quality of train firmware is generally not very good, and I hope that this scandal will lead to greater scrutiny. 3 years ago, Deutsche Bahn publicly complained of "grotesque" software problems with newly delivered Bombardier trains. For example, when train drivers changed the direction of travel, the train software would crash. It then took 1 hour to boot the train up again [0]. Switzerland…

I think the compensation given to software developers by companies that view software as their product has drawn many of the skilled software developers away from jobs that would have once grabbed them because of the fun factor. Companies that make things that contain software are not in markets prepared to pay 2 and 3 times what they were for software. What you are left with is people who are willing to accept that…

Facebook, Amazon, Netflix, Google, Twitter are not selling software but they are able to attract a lot of skilled developers

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#99

Post by aneutron »

Tade0 wrote: post #80

Newag issued a statement since, denying all allegations and saying that it was their competition which "hired hackers to slander them". I've met q3k because we used to work at the same company and briefly on a project together. Not the kind of person I would suspect of participating in a conspiracy of this sort and Newag's statement generally reads like "we didn't think we would get caught".

While I haven't met the guys in this case, I am familiar with their work.

Additionally, I am fairly certain they are not stupid enough to not have kept detailed, forensic-quality records of their actions and whatever they dumped. Sure it may not stand up in court as evidence but it will be more than enough to show that they didn't pull this out of nowhere

Post reply on HN