Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dieselgate, but for trains – some heavyweight hardware hacking

badcyber.com

Post reply on HN
Print view View original

201–210 of 309 posts

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#201

Post by tensility »

danhor wrote: post #115
lqet wrote: post #28

My impression is that the quality of train firmware is generally not very good, and I hope that this scandal will lead to greater scrutiny. 3 years ago, Deutsche Bahn publicly complained of "grotesque" software problems with newly delivered Bombardier trains. For example, when train drivers changed the direction of travel, the train software would crash. It then took 1 hour to boot the train up again [0]. Switzerland…

That is also my impression as well. The softwareization of trains has led to deep regressions in both basic reliability and interoperability/flexilibity. Many modern trains suffer from software issues for basic driving [0] and delays when getting the software approved [1]. But the loss of compatability is in my opinion the worst regression. Modern EMUs basically only work together with other EMUs of the same batch. E…

Except that this isn't really a story about poorly written software; it's a story about corrupt management. Further, if we look at Boeing's recent issues with the 737Max, it's the same thing. In both of these cases, the bad software was almost certainly ordered to be written by management acting fraudulently for profit. The one error that has been discussed in the article was a stupid mistake, quite possibly due to the logic conditions being made overly complicated in order to enable the fraud, but the recurrent theme of all of the real underlying issues found was intentional design malfeasance, not incompetence.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#202

Post by ARandomerDude »

praptak wrote: post #127
mcv wrote: post #121

Earlier quoted context omitted.

Companies are made up of individuals. I'm all for holding everybody who contributed to this malware accountable.

I don't believe the Polish judicial systems has experience in dealing with corporate crime, especially of the tech-related kind. I'm a bit afraid of disappointment here.

Wait, what? You don’t think a country with a population of 41M has experience with corporate crime?

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#203

Post by blowski »

jakozaur wrote: post #195
toomuchtodo wrote: post #63

Earlier quoted context omitted.

If an individual did this, they'd go to prison.

Article 254a of the Polish Penal Code addresses the obstruction of railway operations and other critical infrastructure. Violating this law can result in a prison sentence ranging from 6 months to 8 years. It doesn't matter whether the act was committed as part of a company's operations or as an individual's private endeavour. To all software engineers: please refrain from engaging in criminal activities. If you are…

> Dear software engineers, please do not commit a crime

Yes, developers shouldn't knowingly write code to commit crime, but developers don't tend to receive instructions that directly. Unsurprisingly, the company doesn't mention to every employee that they are knowingly breaking the law.

Instead, developers receive a request to build a feature, and it typically won't be at all obvious that the intended use of that feature is to commit a crime. There might even be a legitimate use of the feature, and then someone finds it can be abused to commit a crime.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#204

Post by ffgjgf1 »

freedomben wrote: post #190

How is this different from companies like Apple or John Deere that DRM components and brick the device if repaired by "unauthorized" technicians? (I think both are equally egregious personally, but I know there's a lot of support here for Apple, so I'm curious how people reconcile these. I don't want to make this a religious war about Apple, but those practices in general regardless of which company is doing it). Is…

> Is it the secrecy that makes it different? i.e. if the train company were honest about it then it would be ok?

IMHO mainly that and clearly those trains are required to be designed in such a way that they could be repaired by a third party (either by law or by contract based on how the situation is described).

Apple provides (nor is required) no such guarantees. Also it has more or less legitimate reasons for its design decision (making it harder to reuse stolen parts).

> equally egregious

I certainly disagree almost completely. With Ape you know what you’re getting and can make an inform choice. Also it’s a completely different type of product. Trains have various regulatory, safety and maintenance requirements which are irrelevant for consumers devices. Screwing with the software controlling trains can literally kill people..

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#205

Post by tensility »

Tade0 wrote: post #80

Newag issued a statement since, denying all allegations and saying that it was their competition which "hired hackers to slander them". I've met q3k because we used to work at the same company and briefly on a project together. Not the kind of person I would suspect of participating in a conspiracy of this sort and Newag's statement generally reads like "we didn't think we would get caught".

Unfortunately for Newag, other than in the court of public opinion, firmware deliveries count as written evidence.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#206

Post by masfuerte »

db48x wrote: post #173
toomuchtodo wrote: post #63

Earlier quoted context omitted.

If an individual did this, they'd go to prison.

No, they would not. It would be entirely a civil matter that would be resolved in litigation.

A contractor in the UK put a time-lock in the software he was contracted to write because he was concerned about non-payment. He didn't get paid and the software duly stopped working. He was successfully prosecuted under the Computer Misuse Act. He had some justification (unlike the Polish train manufacturer) but it didn't help him avoid prosecution. I've no idea what the law in Poland says.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#207

Post by tensility »

albumen wrote: post #17
korhojoa wrote: post #12

Earlier quoted context omitted.

There wasn't just one manufactured failure, but multiple different ones. Refusing to help would also point towards intentional malice. Why would you sell a product, then refuse to assist, unless you've intentionally designed the product to fail so only you would know how to make it work again?

The manufacturer lost the bidding process, so quite reasonably (if you look at it in a limited fashion) said "Fine, let SLS do the work, you're on your own". Arsehole-ish, but not illegal. All the hidden lockouts on the other hand....

The hidden lockouts containing GPS coordinates of competitors' repair facilities should be more than enough to establish criminal intent (in my armchair non-lawyer opinion).

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#208

Post by tensility »

greesil wrote: post #13
korhojoa wrote: post #12

Earlier quoted context omitted.

There wasn't just one manufactured failure, but multiple different ones. Refusing to help would also point towards intentional malice. Why would you sell a product, then refuse to assist, unless you've intentionally designed the product to fail so only you would know how to make it work again?

To what end? So they can sell more trains? That makes no sense.

Vendor lock-in for maintenance has massive financial incentive, as was relatively clear in the article, even going so far as to cite some explicit numbers that are relatively big money when projected across the scale of an entire fleet.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#209

Post by justinclift »

dzdt wrote: post #62

Its insane how brazen this is. Code that 'bricks' the train locomotive if its gps coordinates remain with bounds of a competing repair facility for more than ten days! This is way beyond putting information barriers to repair, like undocumented interfaces or even crypto-signed firmware. This is actively malicious destruction of property. I don't know anything about the legal system in Poland, but I can't imagine how…

> This is actively malicious destruction of property.

Seems more like malicious denial of service, with the goal of enriching the malicious actor.

A motivated legal team would likely be able to find Serious Charges that could apply. Especially if these specific trains / locomotives happen to be "Critical Infrastructure" (not guaranteed).

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#210

Post by upwardbound »

jakozaur wrote: post #195
toomuchtodo wrote: post #63

Earlier quoted context omitted.

If an individual did this, they'd go to prison.

Article 254a of the Polish Penal Code addresses the obstruction of railway operations and other critical infrastructure. Violating this law can result in a prison sentence ranging from 6 months to 8 years. It doesn't matter whether the act was committed as part of a company's operations or as an individual's private endeavour. To all software engineers: please refrain from engaging in criminal activities. If you are…

I think jakozaur is correct, and don't know why they're being downvoted. Here is the legal statute they are referencing:

    Art. 254a. Disruption of a network; damage. Anyone who takes, destroys, damages or renders unfit for use an element of a water supply, sewage, heating, electricity, gas or telecommunications network, or a railway, tramway, trolley bus or metro line, thereby causing a disturbance in the operation of all or part of such network or line, is liable to imprisonment for six months to eight years.
Source: https://supertrans2014.files.wordpress.com/2014/06/the-crimi... page 32

I certainly think that this malware meets the criteria set forth in that law: "renders unfit for use an element of ... a railway ... , thereby causing a disturbance in the operation of all or part of such network or line".

Seems pretty cut & dry to me. I hope some people face real jail time for this. As another comment mentioned, it will probably be a "fall guy" (perhaps a middle manager) but that will still deter future managers from authorizing such fraud, even if the orders come from above. Future managers might reject such orders since it's not worth jail time.

Post reply on HN