Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dieselgate, but for trains – some heavyweight hardware hacking

badcyber.com

Post reply on HN
Print view View original

281–290 of 309 posts

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#281

Post by db48x »

masfuerte wrote: post #206
db48x wrote: post #173

Earlier quoted context omitted.

No, they would not. It would be entirely a civil matter that would be resolved in litigation.

A contractor in the UK put a time-lock in the software he was contracted to write because he was concerned about non-payment. He didn't get paid and the software duly stopped working. He was successfully prosecuted under the Computer Misuse Act. He had some justification (unlike the Polish train manufacturer) but it didn't help him avoid prosecution. I've no idea what the law in Poland says.

That’s pretty ridiculous.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#282

Post by Kim_Bruning »

applied_heat wrote: post #276
mr337 wrote: post #153

Earlier quoted context omitted.

100% agree with this. IMO there are a few efforts to modernize PLC programming but I feel like they are still stuck in the 1990s software development. Take a look at Codesys, got Git support few years ago and in very bad shape. How do you test your code, in the field or buy another Codesys testing plugin....which is in rough shape. The issue is as machines get way more complex this issue gets worse. Also there are ge…

Ladder is a fine choice for visually animating Boolean logic The fact is the unmodernized plc platforms deliver working machines and plants. The projects are built, commissioned, and unlike modern software they are finished and left to operate instead of constantly modified With no benefit to the end user

... sort of. Past a certain level of complexity you get into trouble with just PLC programmers alone.

Don't get me wrong. tend to also have electrical skills and some are pretty good at their jobs, and you can learn a lot from them!

But ... they're not programmer programmers. It's a different skill-set with only so much overlap.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#283

Post by applied_heat »

Kim_Bruning wrote: post #282
applied_heat wrote: post #276

Earlier quoted context omitted.

Ladder is a fine choice for visually animating Boolean logic The fact is the unmodernized plc platforms deliver working machines and plants. The projects are built, commissioned, and unlike modern software they are finished and left to operate instead of constantly modified With no benefit to the end user

... sort of. Past a certain level of complexity you get into trouble with just PLC programmers alone. Don't get me wrong. tend to also have electrical skills and some are pretty good at their jobs, and you can learn a lot from them! But ... they're not programmer programmers. It's a different skill-set with only so much overlap.

The ladder paradigm has its place, as does function block diagrams, as does what the plc vendors call ‘structured text’.

controlling physical processes like oil refineries, power generation, or sawmills is different from most computer programs as are the consequences of bugs or errors so it makes sense that it takes different people with different interests and skills.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#284

Post by sdfhbdf »

upwardbound wrote: post #210
jakozaur wrote: post #195

Earlier quoted context omitted.

Article 254a of the Polish Penal Code addresses the obstruction of railway operations and other critical infrastructure. Violating this law can result in a prison sentence ranging from 6 months to 8 years. It doesn't matter whether the act was committed as part of a company's operations or as an individual's private endeavour. To all software engineers: please refrain from engaging in criminal activities. If you are…

I think jakozaur is correct, and don't know why they're being downvoted. Here is the legal statute they are referencing: Art. 254a. Disruption of a network; damage. Anyone who takes, destroys, damages or renders unfit for use an element of a water supply, sewage, heating, electricity, gas or telecommunications network, or a railway, tramway, trolley bus or metro line, thereby causing a disturbance in the operation of…

As a person very familiar with Polish legal system and code I would be far from saying it's a cut & dry case.

What we have in this case is a company doing something that is wrong, not an individual. To sentence somebody with the statute you and the parent are referring to you need to have a case against an individual, not a company. Secondly, except for this specific statute you have to take into consideration the general rules of the penal code (Zasady odpowiedzialności karnej) and in this case you have to assign blame, find out that the intent, the knowledge of what they were doing etc.

In general, in best case this will be a breach of contract, a civil case, there probably won't be jail time. Don't get your hopes up.

Don't get me wrong, what they did is nefarious, but at the same time I don't think there should be Jail time, just huge fines and some scrutiny (maybe NIK, ABW, CBA etc. - other polish three later agencies) on Newag, maybe barring them from some future deals.

Source: I might be a lawyer...

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#285

Post by jtriangle »

applied_heat wrote: post #273
jtriangle wrote: post #186

Earlier quoted context omitted.

There are devices for automobiles that intercept sensor data and feed back fake data to the ECU to bypass emissions controls. It's a fairly simple to do. I have a buddy with a WRX that absolutely should not pass smog, has no cats, big turbos, tune, etc, but it has no codes, passes every time without issue because the sensor data is synthetic that governs those things.

The government emmissions test doesn’t measure what comes out of the tail pipe?

Nope, relies on the ECU to communicate over the OBDII port the emissions status.

There are visual inspections, but, they're not terribly thorough, and they don't disassemble anything.

That's for normal cars mind, for diesel semis/lori's they also have a measure of how much smoke comes out of the stacks at a given load, and how long it lingers in the air, so even if the ECU reads clean, if it's running dirty like that it'll still fail.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#286

Post by [deleted] »

jakub_g wrote: post #269
TomaszZielinski wrote: post #264

Earlier quoted context omitted.

OK, let's try how it goes: Hey Czesław, I cannot leave it flexible, because it's a train that can run over 100km/h with 500 passengers inside, so I need to know the details to perform the required safety analysis. All in all, my name will be in the commit log if someone runs... git blame.

Here's a fix for the git blame part: GIT_AUTHOR_NAME=Czeslaw GIT_AUTHOR_EMAIL=czeslaw@januszex.com git commit (obviously, just kidding)

[deleted]

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#287

Post by anticensor »

TomaszZielinski wrote: post #279
jakub_g wrote: post #269

Earlier quoted context omitted.

Here's a fix for the git blame part: GIT_AUTHOR_NAME=Czeslaw GIT_AUTHOR_EMAIL=czeslaw@januszex.com git commit (obviously, just kidding)

For some reason I'm afraid to check if that website exists :)

Yes, a real website. I actually bothered to check.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#288

Post by Log_out_ »

Xelbair wrote: post #149
dzdt wrote: post #62

Its insane how brazen this is. Code that 'bricks' the train locomotive if its gps coordinates remain with bounds of a competing repair facility for more than ten days! This is way beyond putting information barriers to repair, like undocumented interfaces or even crypto-signed firmware. This is actively malicious destruction of property. I don't know anything about the legal system in Poland, but I can't imagine how…

It will be stuck in legal hell due to conflicts of interests. Trains already exist, and they need to work - but maintenance/repair companies cannot legally modify software of them due to copyrights. It's a catch22 situation. I honestly hope that company will be fined to the oblivion, and for criminal charges for that, but i doubt it will happen.

We will see firmware wars were open source train software wind.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#289

Post by Log_out_ »

applied_heat wrote: post #276
mr337 wrote: post #153

Earlier quoted context omitted.

100% agree with this. IMO there are a few efforts to modernize PLC programming but I feel like they are still stuck in the 1990s software development. Take a look at Codesys, got Git support few years ago and in very bad shape. How do you test your code, in the field or buy another Codesys testing plugin....which is in rough shape. The issue is as machines get way more complex this issue gets worse. Also there are ge…

Ladder is a fine choice for visually animating Boolean logic The fact is the unmodernized plc platforms deliver working machines and plants. The projects are built, commissioned, and unlike modern software they are finished and left to operate instead of constantly modified With no benefit to the end user

Then why is nobody using assembler for modern software projects?

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#290

Post by krisoft »

jakub_g wrote: post #266
o11c wrote: post #245

Earlier quoted context omitted.

Performing a task for someone, whether directly or as a third party contract, generally doesn't invoke copyright.

As a CEO of a railway company, not sure I'd want folks to patch the binaries on my trains. Pretty sure an insurance company wouldn't like that in case shit happens. Rather, the companies with botched trains should demand from Newag to remove their locks, for free, and on the side sue them.

> Rather, the companies with botched trains should demand from Newag to remove their locks, for free, and on the side sue them.

This is the way.

Post reply on HN