Dieselgate, but for trains – some heavyweight hardware hacking • Hacker News Board

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#191

Post by vlovich123 » Fri, Dec 08, 2023, 4:46 PM UTC

RecycledEle wrote: post #84

I wonder if the solution to all these screwy engine controls (tampering with emissions testing, preventing 3rd party repairs, etc.) is to standardize the interfaces to these systems so they can be replaced. Standardizing the outputs of the sensors would let us swap in and out various components to ensure the system is not cheating the regulators.

Or even just requiring the manufacturer to provide all source code to the customer and the tools to update/replace the software. Would be nice to get rid of the black holes that is firmware and allow for auditing.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#192

Post by tensility » Fri, Dec 08, 2023, 4:47 PM UTC

gunapologist99 wrote: post #133

aizyuval wrote: post #123

I'm solely consuming EN content. And if it's from another country, it's only whats leaked by big media. It make me wonder how much good content could be translated.

I think you're saying, how much other good content is out there that I'm missing out on because I only read English, and it's a good point. However, English has become the (now ironically named) lingua franca of, at least, the more educated parts of the world, and many people who are most comfortable in their native languages are still often translating their best work into English in order to see it more widely read…

Worldwide colonialism wasn't exactly a "gift", but I must admit it has been advantageous to me, personally, for English to be as relatively universal as it has become as a result. ;-)

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#193

Post by tensility » Fri, Dec 08, 2023, 4:53 PM UTC

galangalalgol wrote: post #42

lqet wrote: post #28

My impression is that the quality of train firmware is generally not very good, and I hope that this scandal will lead to greater scrutiny. 3 years ago, Deutsche Bahn publicly complained of "grotesque" software problems with newly delivered Bombardier trains. For example, when train drivers changed the direction of travel, the train software would crash. It then took 1 hour to boot the train up again [0]. Switzerland…

I think the compensation given to software developers by companies that view software as their product has drawn many of the skilled software developers away from jobs that would have once grabbed them because of the fun factor. Companies that make things that contain software are not in markets prepared to pay 2 and 3 times what they were for software. What you are left with is people who are willing to accept that…

Some of the problems here might have been logic problems by inept coders; however, the underlying theme of this scandal is corrupt management. Even the erroneous code was an explicit piece of fraud that almost certainly was done under order by someone in the management chain.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#194

Post by magicalhippo » Fri, Dec 08, 2023, 4:54 PM UTC

webel0 wrote: post #159

magicalhippo wrote: post #132

Earlier quoted context omitted.

F1 does this. All teams are required to run the same, approved, ECU[1]. They can change certain mapping tables and such but it's a sealed unit and they can't replace the firmware. [1]: https://wheelsports.co/formula-1s-standardised-ecu-explained...

This is quite interesting because you can imagine that lobbyists would argue that standardization would “stymie innovation.” If F1 does it why can’t you?

Indeed. Standardizing certain components may reduce some potential innovation, however I've long thought that the public sector would be better off buying modular systems with well-defined interfaces rather than the behemoths do-it-all oh-so-often fail.

At work we're a small team, providing a B2B application to perform a small, but very important task for our customers. We integrate with tons of other systems, at our largest customer we talk to 30 other systems. We're highly specialized and we rely on being good at exchanging data with other systems that are good at what they do.

This allows us to innovate and provide great value for our niche, while the other systems can focus on getting better at what they do, rather than implementing a half-assed solution because it's not their core focus.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#195

Post by jakozaur » Fri, Dec 08, 2023, 4:54 PM UTC

toomuchtodo wrote: post #63

dzdt wrote: post #62

Its insane how brazen this is. Code that 'bricks' the train locomotive if its gps coordinates remain with bounds of a competing repair facility for more than ten days! This is way beyond putting information barriers to repair, like undocumented interfaces or even crypto-signed firmware. This is actively malicious destruction of property. I don't know anything about the legal system in Poland, but I can't imagine how…

If an individual did this, they'd go to prison.

Article 254a of the Polish Penal Code addresses the obstruction of railway operations and other critical infrastructure. Violating this law can result in a prison sentence ranging from 6 months to 8 years.

It doesn't matter whether the act was committed as part of a company's operations or as an individual's private endeavour.

To all software engineers: please refrain from engaging in criminal activities. If you are instructed to do something illegal, it is important to report it to the relevant authorities.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#196

Post by cstross » Fri, Dec 08, 2023, 4:56 PM UTC

freedomben wrote: post #190

How is this different from companies like Apple or John Deere that DRM components and brick the device if repaired by "unauthorized" technicians? (I think both are equally egregious personally, but I know there's a lot of support here for Apple, so I'm curious how people reconcile these. I don't want to make this a religious war about Apple, but those practices in general regardless of which company is doing it). Is…

An angle you may not have considered is passenger safety.

Imagine if this happened to an airliner in flight: there'd be criminal charges for sure, not to mention huge damages and lawsuits from the families of the dead if some of the control systems locked up in mid-air.

Trains are not quite as susceptible to disaster arising in the course of operations as airliners, but a Newag Impuls 45WE runs at up to 160km/h in service with up to 218 people on board. (Their speed record is considerably higher.) A sudden breakdown in service is at a minimum going to cause timetable havoc and knock-on delays for other trains and at worse could lead to a mass casualty accident.

(John Deere tractors don't usually carry 200+ passengers and Apple computers don't usually get deployed in safety critical situations. So, different!)

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#197

Post by [deleted] » Fri, Dec 08, 2023, 4:57 PM UTC

galangalalgol wrote: post #42

lqet wrote: post #28

My impression is that the quality of train firmware is generally not very good, and I hope that this scandal will lead to greater scrutiny. 3 years ago, Deutsche Bahn publicly complained of "grotesque" software problems with newly delivered Bombardier trains. For example, when train drivers changed the direction of travel, the train software would crash. It then took 1 hour to boot the train up again [0]. Switzerland…

I think the compensation given to software developers by companies that view software as their product has drawn many of the skilled software developers away from jobs that would have once grabbed them because of the fun factor. Companies that make things that contain software are not in markets prepared to pay 2 and 3 times what they were for software. What you are left with is people who are willing to accept that…

[deleted]

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#198

Post by konschubert » Fri, Dec 08, 2023, 4:59 PM UTC

waffleiron wrote: post #165

konschubert wrote: post #161

Earlier quoted context omitted.

Because corruption is when state power is abused. When private companies do illegal shit it’s just a crime.

There is no requirement for it to be "state" power, please look up the definition.

Okay, whatever. Pretty sure they private sector corruption isn’t worse in the west than in other parts of the world but if you want to disagree I won’t be able to change your mind

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#199

Post by jakozaur » Fri, Dec 08, 2023, 5:00 PM UTC

HackerThemAll wrote: post #24

In a properly functioning country the responsible persons should already be imprisoned. Some governmental agencies were aware of that for at least half a year, but failed to act. The fact that source code was not immediately dumped and analyzed is the evidence of malevolence, corruption and intentionally putting people's lives at risk. Welcome to the dark side of Poland - where citizens don't matter.

Well, justice takes time and this is a complex novel case. I would rather have a system that is right than prematurely put innocent behind bars. However, if the allegations turn out to be true, which seems to have a decent probability, they could charge them with a criminal offence.

There is Article 254a in the Polish Penal Code. If you obstruct critical elements of infrastructure such as trains, you can face between 6 months to 8 years in prison.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#200

Post by johncalvinyoung » Fri, Dec 08, 2023, 5:01 PM UTC

freedomben wrote: post #190

How is this different from companies like Apple or John Deere that DRM components and brick the device if repaired by "unauthorized" technicians? (I think both are equally egregious personally, but I know there's a lot of support here for Apple, so I'm curious how people reconcile these. I don't want to make this a religious war about Apple, but those practices in general regardless of which company is doing it). Is…

I'm not a fan of Apple's practices, but there's some aggravating elements to this. Apple doesn't brick your device if it it spends time at a repair location, for instance. Apple also doesn't simulate failures on synthetic dates to force repair.