11 ms·

This train DRM is crazy. At the beginning of the month they found geofences > We (@redford, @mrtick and I) have reverse engineered the PLC code of NEWAG Impuls

This train DRM is crazy. At the beginning of the month they found geofences > We (@redford, @mrtick and I) have reverse engineered the PLC code of NEWAG Impuls EMUs. These trains were locking up for arbitrary reasons after being serviced at third-party workshops. The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parties. > We found that the PLC code actually contained logic that would lock up the train with bogus error codes after some date, or if the train wasn't running for a given time. One version of the controller actually contained GPS coordinates to contain the behaviour to third party workshops. > It was also possible to unlock the trains by pressing a key combination in the cabin controls. None of this was documented. > The key unlock was deleted in newer PLC software versions, but the lock logic remained. > After a certain update by NEWAG, the cabin controls would also display scary messages about copyright violations if the HMI detected a subset of conditions that should've engaged the lock but the train was still operational. > The trains also had a GSM telemetry unit that was broadcasting lock conditions, and in some cases appeared to be able to lock the train remotely. https://social.hackerspace.pl/@q3k/111528162462505087 https://social.hackerspace.pl/@q3k/111528162462505087

luxuryballs 3y ago
am I correct to assume that none of this was in the manual?
- p_l 3y ago
  That's effectively the core of the accusations against NEWAG. The manual was supposed to allow comprehensive maintenance and repair, without requiring manufacturer's input.
- kbrosnan 3y ago
  The people investigating this claim that much of this is undocumented. I don't speak Polish nor have access to any of the primary documentation for the train. We may see more info next week as they are scheduled to present at the 37th CCC. https://events.ccc.de/congress/2023/infos/index.html https://events.ccc.de/congress/2023/infos/index.html Q3k is active here, https://news.ycombinator.com/threads?id=q3k https://news.ycombinator.com/threads?id=q3k
  - p_l 3y ago
    At least one of the trains had its DSU (Dokumentacja Systemu Utrzymania - Maintenance System Manual) linked online (it's specific to that one train). It should be enough to perform full maintenance. Nowhere in it any of the "lockouts" are documented.
- rcxdude 3y ago
  It's very hard to see what legitimate reason would be used to document such a check in the manual.
  - luxuryballs 3y ago
    the reason would be so you’re not being dishonest and selling a misleading product
klausa 3y ago
A tiny note: they found the geofences over a year ago, a month ago was when they went public.
sureglymop 3y ago
My question: Who wrote this software? Software engineers with 0 moral and ethical qualms or with an extreme incentive to get rich?
- thejazzman 3y ago
  Or heroes who simultaneously reported what they were hired to do Not saying they were -- but not a bad alternative to declining the work outright
  - klausa 3y ago
    If they did, none of the moths-long reverse engineering would have been required.
    - brokenmachine 3y ago
      Ever heard of parallel construction?
      - p_l 3y ago
        Yes, it's "Technique not appearing in this episode", to paraphrase.
  - brokenmachine 3y ago
    The heroes also wrote heroically bad date checking code.
  - p_l 3y ago
    If they had reported things... well, it wouldn't take over a year to deal with this.
- krisoft 3y ago
  > Software engineers with 0 moral and ethical qualms I would like to challenge this. The ethical problem comes from this two facts: they had code which disabled the vehicle in certain conditions AND this was not communicated in the manuals/contracts. The two together is what is extremely dubious. If you implement a time based expiry system, and tell about it to the customers that I think is fair. The customer might of course opt to not buy the equipment under those terms, or only pay a significantly reduced fee, but that is just business. And it might be good business for both participants if everything is well documented and transparent, and these restrictions are reflected in the price, and everyone enters into the agreement with full knowledge and consent. Why does this matter: Look at it from the developer’s perspective. Imagine that they are told by their bosses that they need to implement technological measures to disable the product when the licence expires. Would developing that be unethical? I don’t think so. It becomes unethical at the later point when the train operator is not told about this. How much of that is in or out of the view of the developers is an other question. I’m not saying this is what happened. Clearly the gps based lockdown is not consistent with this story even under the most charitable interpretation. Something is fishy here and needs investigating. (The kind of investigation where the police with a warrant takes the repo and the communications of the company, and interviews everyone separately to figure out who did what and when, and who known what and when.) But while the overall conduct of the company appears to be unethical, it is not necessarily true that the software engineers in question were also unethical. It depends on what they did know, and what they were asked to deliver.
SenAnder 3y ago
> The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parties. So libel on top of computer sabotage.

luxuryballs 3y ago

am I correct to assume that none of this was in the manual?

p_l 3y ago
That's effectively the core of the accusations against NEWAG. The manual was supposed to allow comprehensive maintenance and repair, without requiring manufacturer's input.
kbrosnan 3y ago
The people investigating this claim that much of this is undocumented. I don't speak Polish nor have access to any of the primary documentation for the train. We may see more info next week as they are scheduled to present at the 37th CCC. https://events.ccc.de/congress/2023/infos/index.html https://events.ccc.de/congress/2023/infos/index.html Q3k is active here, https://news.ycombinator.com/threads?id=q3k https://news.ycombinator.com/threads?id=q3k
- p_l 3y ago
  At least one of the trains had its DSU (Dokumentacja Systemu Utrzymania - Maintenance System Manual) linked online (it's specific to that one train). It should be enough to perform full maintenance. Nowhere in it any of the "lockouts" are documented.
rcxdude 3y ago
It's very hard to see what legitimate reason would be used to document such a check in the manual.
- luxuryballs 3y ago
  the reason would be so you’re not being dishonest and selling a misleading product

klausa 3y ago

A tiny note: they found the geofences over a year ago, a month ago was when they went public.

sureglymop 3y ago

My question: Who wrote this software? Software engineers with 0 moral and ethical qualms or with an extreme incentive to get rich?

thejazzman 3y ago
Or heroes who simultaneously reported what they were hired to do Not saying they were -- but not a bad alternative to declining the work outright
- klausa 3y ago
  If they did, none of the moths-long reverse engineering would have been required.
  - brokenmachine 3y ago
    Ever heard of parallel construction?
    - p_l 3y ago
      Yes, it's "Technique not appearing in this episode", to paraphrase.
- brokenmachine 3y ago
  The heroes also wrote heroically bad date checking code.
- p_l 3y ago
  If they had reported things... well, it wouldn't take over a year to deal with this.
krisoft 3y ago
> Software engineers with 0 moral and ethical qualms I would like to challenge this. The ethical problem comes from this two facts: they had code which disabled the vehicle in certain conditions AND this was not communicated in the manuals/contracts. The two together is what is extremely dubious. If you implement a time based expiry system, and tell about it to the customers that I think is fair. The customer might of course opt to not buy the equipment under those terms, or only pay a significantly reduced fee, but that is just business. And it might be good business for both participants if everything is well documented and transparent, and these restrictions are reflected in the price, and everyone enters into the agreement with full knowledge and consent. Why does this matter: Look at it from the developer’s perspective. Imagine that they are told by their bosses that they need to implement technological measures to disable the product when the licence expires. Would developing that be unethical? I don’t think so. It becomes unethical at the later point when the train operator is not told about this. How much of that is in or out of the view of the developers is an other question. I’m not saying this is what happened. Clearly the gps based lockdown is not consistent with this story even under the most charitable interpretation. Something is fishy here and needs investigating. (The kind of investigation where the police with a warrant takes the repo and the communications of the company, and interviews everyone separately to figure out who did what and when, and who known what and when.) But while the overall conduct of the company appears to be unethical, it is not necessarily true that the software engineers in question were also unethical. It depends on what they did know, and what they were asked to deliver.

SenAnder 3y ago

> The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parties. So libel on top of computer sabotage.