Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dieselgate, but for trains – some heavyweight hardware hacking

badcyber.com

Post reply on HN
Print view View original

271–280 of 309 posts

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#271

Post by jakub_g »

hulitu wrote: post #155
galangalalgol wrote: post #42

Earlier quoted context omitted.

I think the compensation given to software developers by companies that view software as their product has drawn many of the skilled software developers away from jobs that would have once grabbed them because of the fun factor. Companies that make things that contain software are not in markets prepared to pay 2 and 3 times what they were for software. What you are left with is people who are willing to accept that…

> Companies that make things that contain software are not in markets prepared to pay 2 and 3 times what they were for software The quality of SW has nothing to do with the pay. Notice that FAANG SW developers do not deliver safety critical SW. There are more things to SW development than writing code.

If I had a choice and had to choose between (1) high-pay, not-safety-critical at FAANG, vs. (2) low-pay, safety-critical, I can't imagine why I'd go for (2), outside of maybe hobby when I had too much money already.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#272

Post by TomaszZielinski »

Tade0 wrote: post #128
senkora wrote: post #107

Earlier quoted context omitted.

^I think this is being downvoted because of poor reading comprehension skills. Please note that the parent comment is in favor of the hacking group.

Thank you for pointing this out - I reread the post and can imagine now how someone would read it differently than I intended.

I read and reread it and IMHO it's perfectly clear.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#273

Post by applied_heat »

jtriangle wrote: post #186
RecycledEle wrote: post #84

I wonder if the solution to all these screwy engine controls (tampering with emissions testing, preventing 3rd party repairs, etc.) is to standardize the interfaces to these systems so they can be replaced. Standardizing the outputs of the sensors would let us swap in and out various components to ensure the system is not cheating the regulators.

There are devices for automobiles that intercept sensor data and feed back fake data to the ECU to bypass emissions controls. It's a fairly simple to do. I have a buddy with a WRX that absolutely should not pass smog, has no cats, big turbos, tune, etc, but it has no codes, passes every time without issue because the sensor data is synthetic that governs those things.

The government emmissions test doesn’t measure what comes out of the tail pipe?

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#274

Post by TomaszZielinski »

Tade0 wrote: post #235
tensility wrote: post #205

Earlier quoted context omitted.

Unfortunately for Newag, other than in the court of public opinion, firmware deliveries count as written evidence.

Part of their statement says(loosely translated): "No hacker can tell, based on the content of the digital record alone, who is the author of the digital record in question" Boy oh boy. Either they're not singing their firmware (which is a serious indictment in and of itself) or proving that it was them all along will be trivial, but the ones signing off this message are unaware of this. Overall they got caught with…

"Pants down" situation aside, if the firmware is not signed or verified in any way, then isn't it prone to "neutrino bit reversal", potentially causing Bad Things?

I have no idea how those systems work and what guarantees they provide, but this would be hair-raising...

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#275

Post by jakub_g »

TomaszZielinski wrote: post #268
leemailll wrote: post #111

Earlier quoted context omitted.

I don't think fixing the software failure will improve DB's punctuality

What if it's caused by random reboots lasting up to 1h? :) Of course I'm half joking, but I wouldn't be surprised if software problems contributed to the delays (which tend to chain, as trains need to wait for each other, etc).

Curiously, I was riding a TGV in France few weeks ago, and due to some track problems, we had to change the direction and go back to previous station (and then use different track to go forward again).

It took more than 1h to start going back, and I wonder how much of it was making sure the track is clear, and how much was "rebooting the train" or whatever else was necessary.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#276

Post by applied_heat »

mr337 wrote: post #153
Log_out_ wrote: post #64

Earlier quoted context omitted.

Because this software is not made by software engineers, it's made by plc programmers, electric circuit designers and whoever did drift into the field. Except for beckhoff to tc3 they haven't made it to object orientation yet, so the field is stuck as a whole in the blue screen mines of yore. Managing complexity with thin standard docs, no version control while the machines grow ever more complex sensor and actuator…

100% agree with this. IMO there are a few efforts to modernize PLC programming but I feel like they are still stuck in the 1990s software development. Take a look at Codesys, got Git support few years ago and in very bad shape. How do you test your code, in the field or buy another Codesys testing plugin....which is in rough shape. The issue is as machines get way more complex this issue gets worse. Also there are ge…

Ladder is a fine choice for visually animating Boolean logic

The fact is the unmodernized plc platforms deliver working machines and plants. The projects are built, commissioned, and unlike modern software they are finished and left to operate instead of constantly modified With no benefit to the end user

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#277

Post by jakub_g »

TeMPOraL wrote: post #117
foobarian wrote: post #113

Earlier quoted context omitted.

> No "boot times". They just worked Haha wait until you find out how TVs worked in the 70s and how fast it was to change the channel *sob*

Even in the 90s, you could just power it on and it would show image near-instantly. Warm-up time and channel switch time were all firmly under one second. With the exception of cable TV set-top boxes, which were separate devices and first to include the ridiculous boot times and delays, that still would seem blazingly fast compared to what we have today...

I used to have cable TV without box (direct stuff via analog cable) until mid-2000s, and man, 15-ish years forward, the order of magnitude slower channel zapping still bothers me as hell.

(To be fair though, nowadays we have UHD/4K channels, which need way more bandwidth than the SD TV quality from 2000s. I wonder if this could be fixed with a more powerful CPU in those boxes? maybe it could, but might increase power usage?).

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#278

Post by TomaszZielinski »

cstross wrote: post #196
freedomben wrote: post #190

How is this different from companies like Apple or John Deere that DRM components and brick the device if repaired by "unauthorized" technicians? (I think both are equally egregious personally, but I know there's a lot of support here for Apple, so I'm curious how people reconcile these. I don't want to make this a religious war about Apple, but those practices in general regardless of which company is doing it). Is…

An angle you may not have considered is passenger safety. Imagine if this happened to an airliner in flight: there'd be criminal charges for sure, not to mention huge damages and lawsuits from the families of the dead if some of the control systems locked up in mid-air. Trains are not quite as susceptible to disaster arising in the course of operations as airliners, but a Newag Impuls 45WE runs at up to 160km/h in se…

Thank you for putting it so clearly! I feel this angle got somewhat lost in the whole discussion.

For instance, has anyone really analyzed, what would happened if the trains were running at 160km/h at midnight, on Nov 21? I mean, they might have, I don't know. But that would be pretty funny--having documentation for what's very likely a tort (well, it's Polish counterpart), if not an outright criminal act.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#279

Post by TomaszZielinski »

jakub_g wrote: post #269
TomaszZielinski wrote: post #264

Earlier quoted context omitted.

OK, let's try how it goes: Hey Czesław, I cannot leave it flexible, because it's a train that can run over 100km/h with 500 passengers inside, so I need to know the details to perform the required safety analysis. All in all, my name will be in the commit log if someone runs... git blame.

Here's a fix for the git blame part: GIT_AUTHOR_NAME=Czeslaw GIT_AUTHOR_EMAIL=czeslaw@januszex.com git commit (obviously, just kidding)

For some reason I'm afraid to check if that website exists :)

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#280

Post by TomaszZielinski »

jakub_g wrote: post #275
TomaszZielinski wrote: post #268

Earlier quoted context omitted.

What if it's caused by random reboots lasting up to 1h? :) Of course I'm half joking, but I wouldn't be surprised if software problems contributed to the delays (which tend to chain, as trains need to wait for each other, etc).

Curiously, I was riding a TGV in France few weeks ago, and due to some track problems, we had to change the direction and go back to previous station (and then use different track to go forward again). It took more than 1h to start going back, and I wonder how much of it was making sure the track is clear, and how much was "rebooting the train" or whatever else was necessary.

I'm guessing that these days anything might need to be rebooted, including track themselves (I mean: there are misc detectors there).. Sometimes I'm in awe how strong the overarching duct tape is :)
Post reply on HN