Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dieselgate, but for trains – some heavyweight hardware hacking

badcyber.com

Post reply on HN
Print view View original

251–260 of 309 posts

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#251

Post by fcsp »

p0w3n3d wrote: post #172

Title is a bit misleading, because this *gate is not about faking ecology, and trying to pass certification in artificial conditions, as dieselgate was, but simulating fake failures instead. The company hardcoded algorithms that would report failures of parts that work correctly (like a compressor), if it detected that train has been repaired by another company (based on location readings), and stop the train from ru…

> The company hardcoded algorithms that would report failures of parts that work correctly (like a compressor), if it detected that train has been repaired by another company (based on location readings), and stop the train from running

This isn't correct by my understanding - there's actually two separate things here:

- The company made their trains stop functioning after spending 10 days at competing maintenance locations, based on GPS

- In one firmware, they hardcoded to pretend a compressor failure a few days after the next scheduled maintenance for the train

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#252

Post by Nasrudith »

TeMPOraL wrote: post #122
twisteriffic wrote: post #33

Earlier quoted context omitted.

Bad software is a symptom, not the cause.

Here it's more like the software - any software - is a problem . I agree with GP, and my experience confirms that adding software to something that used to work without it almost universally makes it worse in every aspect, understandability and repairability being just two major ones. On top of that, taking anything that run on old-school industrial/embedded firmware and replacing that with software using modern prac…

The conversion is pretty much fundamentally corner-cutting of some sort or another. The digital equivalent is usually a micro-controller worth a few cents replacing dollars of bespoke-by-comparison (due to smaller economies of scale) hardware cost. The goal for the exercise is almost always "good enough" instead of trying to best the existing State Of The Art. Power usage I think tends to be one of the few aspects usually improved via digitization.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#253

Post by upwardbound »

mike_hock wrote: post #246
upwardbound wrote: post #210

Earlier quoted context omitted.

I think jakozaur is correct, and don't know why they're being downvoted. Here is the legal statute they are referencing: Art. 254a. Disruption of a network; damage. Anyone who takes, destroys, damages or renders unfit for use an element of a water supply, sewage, heating, electricity, gas or telecommunications network, or a railway, tramway, trolley bus or metro line, thereby causing a disturbance in the operation of…

Deter middle managers from what? Implementing shady business practices that skirt the edge of legality? That's day-to-day business, the only way to avoid that would be to quit. Sure, no one would commit this exact offense again, but (a) the practice will (would, if any conviction actually happens, big if) be changed just enough to make it legally ambiguous again, and (b) the law would probably be changed to make it l…

There's a third option, which is: to not quit, but fight back against legal-but-immoral practices from within the corporation.

Have you seen The Incredibles (pixar film). This scene is exactly what I'm talking about:

https://www.youtube.com/watch?v=O_VMXa9k5KU

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#254

Post by magnat »

dn3500 wrote: post #240
db48x wrote: post #171

Earlier quoted context omitted.

Of course laws vary, and Polish copyright law might be completely crazy, but around here copyright only covers distribution of copies. It does not make it illegal to modify software that you own. It only limits distribution of copies of that software, modified or otherwise. If the owner of the train wants to modify the software then there is probably nothing stopping them.

I don't know anything about Polish law either, but in the US, copyright law (DMCA in particular) makes it illegal to modify the software in a device you own, if it requires circumventing protection code or devices. Which it probably would in this case.

According to the Polish copyright law, by default one can reverse engineer and modify licensed software without author's permission to ensure interoperability with other software and for fixing bugs. Such right can be explicitly denied by the copyright owner, though.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#255

Post by mike_hock »

upwardbound wrote: post #253
mike_hock wrote: post #246

Earlier quoted context omitted.

Deter middle managers from what? Implementing shady business practices that skirt the edge of legality? That's day-to-day business, the only way to avoid that would be to quit. Sure, no one would commit this exact offense again, but (a) the practice will (would, if any conviction actually happens, big if) be changed just enough to make it legally ambiguous again, and (b) the law would probably be changed to make it l…

There's a third option, which is: to not quit , but fight back against legal-but-immoral practices from within the corporation. Have you seen The Incredibles (pixar film). This scene is exactly what I'm talking about: https://www.youtube.com/watch?v=O_VMXa9k5KU

Yes, you might get the odd Schindler every now and then who tries to do just that, but most are probably in it for the money and not to fight some uphill battle.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#256

Post by upwardbound »

mike_hock wrote: post #255
upwardbound wrote: post #253

Earlier quoted context omitted.

There's a third option, which is: to not quit , but fight back against legal-but-immoral practices from within the corporation. Have you seen The Incredibles (pixar film). This scene is exactly what I'm talking about: https://www.youtube.com/watch?v=O_VMXa9k5KU

Yes, you might get the odd Schindler every now and then who tries to do just that, but most are probably in it for the money and not to fight some uphill battle.

https://en.wikipedia.org/wiki/Oskar_Schindler

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#257

Post by miki123211 »

danhor wrote: post #136
Log_out_ wrote: post #64

Earlier quoted context omitted.

Because this software is not made by software engineers, it's made by plc programmers, electric circuit designers and whoever did drift into the field. Except for beckhoff to tc3 they haven't made it to object orientation yet, so the field is stuck as a whole in the blue screen mines of yore. Managing complexity with thin standard docs, no version control while the machines grow ever more complex sensor and actuator…

I'm not sure if you've ever used modern software. It's sometimes amazing just how unreliable it is. Web browsers crash every few weeks, windows is known for regularly needing a reboot, evince regularly crashes on me, you can't call 911 with some of cell phones, ... . This reminds me of https://danluu.com/everything-is-broken/ . The clearest example of the difference of reliability is looking at public digital signage…

There are trains (Polish ones, funnily enough) that will happily show you the "choose the location of this network" dialog from Windows7 on their passenger information screen.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#258

Post by 93po »

metadat wrote: post #135
93po wrote: post #106

Earlier quoted context omitted.

i wouldnt be surprised if this info was somewhere in those 20k pages, and perhaps if the procedures were actually followed, stuff like GPS based lockouts wouldn't happen

The article covers this, and says the information about the lockouts was not in the manufacturer provided manuals.

According to who?

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#259

Post by 93po »

korhojoa wrote: post #225
93po wrote: post #109

Earlier quoted context omitted.

unless we have the entirety of the context for this code and the 20,000 pages of service manuals, i do not accept at face value that it's this simple

Considering that the situation this was named after had _very_ specific timing, state and sensor values coded in a defeat device, I'd say that having the mapped the gps coordinates of your competitors im the firmware of your product is pretty damning. Nevermind the poorly executed "if day => 21, month => 11, year => 2021", which was conveniently setting a failure which wasn't actually present. It'a probably not that…

There’s literally a hundred reasons why code like that could exist. My point is there is probably another hundred thousand lines of code and we have no idea how the few lines we see are being used.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#260

Post by metadat »

93po wrote: post #258
metadat wrote: post #135

Earlier quoted context omitted.

The article covers this, and says the information about the lockouts was not in the manufacturer provided manuals.

According to who?

Directly in TFA, matey:

  > Newag explains that the train were
  > blocked by a “safety system” – but in
  > the 20,000 pages of  instructions, it
  > is in vain to  find even a mention
  > of it.
No mention whatsoever in the maintenance documents. It then becomes prudent to question the intentions and fitness of the company behind such a product.

This episode puts even John Deere to shame. I'm imagine JD are enjoying themselves right now on this Friday afternoon.

Post reply on HN