Dieselgate, but for trains – some heavyweight hardware hacking

Post by redman25 » Fri, Dec 08, 2023, 2:47 PM UTC

rlpb wrote: post #67

kibwen wrote: post #32

Earlier quoted context omitted.

Hell, even if governments are squeamish about requiring code to be fully open and public, they can still require the manufacturers to privately submit to the government all code that powers public infrastructure (like trains), to be made available to any relevant party upon request.

An organisation that is prepared to write "sabotage" software would have no problem deploying software that is different to the software they submit.

Post by yetihehe » Fri, Dec 08, 2023, 2:47 PM UTC

93po wrote: post #77

HPsquared wrote: post #7

Earlier quoted context omitted.

If the manufacturer did it, doesn't it still fit the definition? It's something like "deliberately causing something to fail", regardless of who does it.

While I believe intentions were malicious, it's very easy to argue that 1. it's not failing, it's disabling 2. it's a safety feature - "SPS can't safely maintain these trains, so we have a safety lock out if they attempt it" 3. there is a ton of stuff that works this way - even Harley Davidson motorcycles require authorized maintenance and the bike's computer won't accept repairs unless a proprietary tool is used

Post by tremon » Fri, Dec 08, 2023, 2:49 PM UTC

goodpoint wrote: post #102

kibwen wrote: post #32

Earlier quoted context omitted.

Hell, even if governments are squeamish about requiring code to be fully open and public, they can still require the manufacturers to privately submit to the government all code that powers public infrastructure (like trains), to be made available to any relevant party upon request.

That would work only on paper. The financial interests involved are huge.

Post by senkora » Fri, Dec 08, 2023, 2:50 PM UTC

Tade0 wrote: post #80

Newag issued a statement since, denying all allegations and saying that it was their competition which "hired hackers to slander them". I've met q3k because we used to work at the same company and briefly on a project together. Not the kind of person I would suspect of participating in a conspiracy of this sort and Newag's statement generally reads like "we didn't think we would get caught".

Post by 93po » Fri, Dec 08, 2023, 2:51 PM UTC

yetihehe wrote: post #97

93po wrote: post #75

Earlier quoted context omitted.

I don't think it's assholeish for someone who's not getting compensated in any way to not help out. It's a business. They have an active incentive to NOT help.

It's not about "not wanting to help". It's about placing logic bombs of "if vehicle is at this gps coordinates of a competitor, engage self-destruct". Hackers actually did extract such coordinates from train firmware.