There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

Polish Hackers Repaired Trains the Manufacturer Artificially Bricked. Now The Train Company Is Threatening Them

In one of the coolest and more outrageous repair stories in quite some time, three white-hat hackers helped a regional rail company in southwest Poland unbrick a train that had been artificially rendered inoperable by the train’s manufacturer after an independent maintenance company worked on it. The train’s manufacturer is now threatening to sue the hackers who were hired by the independent repair company to fix it.

After breaking trains simply because an independent repair shop had worked on them, NEWAG is now demanding that trains fixed by hackers be removed from service.

arc ,

Apparently there was some kind of gps geo fencing going on - that the software detected the train went into an uncertified repair yard and bricked the thing. So I assume the hackers just purged that info, or unset the flags that denoted the brick condition so as far as the train software was concerned it was operating normally.

It’s an interesting hack but there is a safety aspect to this too. A train is a complex machine that could go catastrophically wrong and kill a bunch of people. It’s not quite Boeing 737 levels of safety criticality but neither is it something that should be taken lightly with regards to service procedure or parts procurement. So the manufacturer were being dicks to brick the train. But the train operator using an unauthorised repairer who might not have access to, let alone follow the correct servicing procedures or parts is not good either.

KeenFlame ,

Spewing bs about how they can’t guarantee the safety and other outrageous shit pouring out their mouths as they provide clearly practiced lawyerspeak to squeeze money from public service into their owners pockets which will then be invested probably in war and killing children for profit.

But let’s discuss ethics and shit! Fuck faces need to be brought to moral justice for the evil they commit every day of their brainwashed miserable hateful lives where they pretend to not harm people because they don’t do it themselves but via money grabbing schemes. One day all of this shit will seem to be as stupid as hitting kids are these days

FangedWyvern42 ,
@FangedWyvern42@lemmy.world avatar

Most ethical vehicle manufacturer:

(This is a joke)

zockerr ,

Every time I read about this kerfuffle, I am astounded by the sheer stupidity of the manufacturer. Even if they may be technically in the right here(I don’t know, since the contracts they have with the operator aren’t public), they effectively shoot themselves in the foot with this PR Desaster. Especially the various national rail operators across Europe will think twice about buying NEWAG, since these operators usually have their own maintenance and repair centers, and expect to service their rolling stock there. And those national operators still make up the lion’s share of the European rail market.

DSTGU ,

This aint much of a problem. NEWAG operates almost exclusively on the internal market

maynarkh ,

I sure hope that they become a political talking point where the government loses votes if they contract with them again.

btr_fan87 ,

Artificially bricked?! Who the hell keeps giving Viagra to trains? Evil bastards.

xytaruka ,

Sir Toppam Hat

ShitOnABrick ,
@ShitOnABrick@lemmy.world avatar

Where did the independent repair shop and cracker smackers touch you on the doll NEWAG 14WE EMU

RememberTheApollo_ ,

If they required the trains to be serviced by manufacturer they should have written it into a mandatory service contract at time of sales.

Dio9sys ,

I like how, instead of recognizing that they got caught, now the train manufacturer is claiming this is some kind of dark PR strategy.

If it is, then please show the public that it’s a dark PR strategy by explaining the hidden unlock codes and the DRM code!

EdibleFriend ,
@EdibleFriend@lemmy.world avatar

I hate this fucking planet.

DuckOverload ,

I think this is pretty cool. Sure, capitalists are gonna capitalist, but here we have subversive moves in a positive direction.

EdibleFriend ,
@EdibleFriend@lemmy.world avatar

Oh yeah what the people did to get around this is fucking awesome I do love that side of this story don’t get me wrong.

simin ,

the world’s not one’s to fix, learn to protect yourself.

whoisearth ,
@whoisearth@lemmy.ca avatar

No the current model everywhere is to pay a vendor. I’m sure someone can get KPMG or Deloitte to fix the world.

Ruscal ,

badcyber.com/dieselgate-but-for-trains-some-heavy… link for very detailed description of this story, highly recommend the read!

SCB , (edited )

Thank you! Came here to ask if anyone had one source with the whole story. This keeps trickling out as it evolves.

Edit: this story is considerably weirder than I expected, and I was already expecting some weird shit.

Begs the question: How is any of this legal?

Ruscal ,

I would assume it is not, UE has some strict rules about fair competition, but the problem is to prove that in the court. Newag is arguing that the hacked and reverse engineered code is not the code they have. Probably in the meantime they run the cleaning protocol in the company…
But company’s public image will hopefully suffer from the story, maybe at least they loose in eyes of potential buyers.

vsh ,
@vsh@lemm.ee avatar

I thought white hat hackers only do their shitty CTF exercise everyday. Wouldn’t hacking a DRM’ed national train be a black hat interaction? I’d like to know if that company can press charges.

Lev_Astov ,
@Lev_Astov@lemmy.world avatar

If you RTFA, they were paid by the repair company who was paid by the private train operator to fix the train. In doing so, they reverse engineered the hardware/firmware and found the DRM added by the manufacturer to prevent the repair company from doing the repairs by bricking the train.

vext01 ,
@vext01@lemmy.sdf.org avatar

Depends on your definition of “ethical”

Adanisi ,
@Adanisi@lemmy.zip avatar

Yes yes, how dare they unbrick public transportation infrastructure.

Fuck off.

firefly , (edited )

@btp

If anything perhaps everyone involved should sue the train manufacturer for bricking the train with their DRM nonsense.

"Dragon Sector" is an OG name for a hacker firm.

"we discovered a ‘workshop-detection’ system built into the train software, which bricked the trains after some conditions were met (two of the trains even used a list of precise GPS coordinates of competitors' workshops)."

That is an anti-trust violation du jure. I wonder what kind of anti-trust laws Poland has.

Aceticon ,

If the train owner allowed it, it’s just maintenance that happens to affect software.

Hacking would be if it was not authorized by the owner.

Any maintenance not authorized by the train maker entitles them at most to suspend the Warranty.

sanqueue ,

This is good. Someone did that for printers too

Lemminary ,

And American Weight (?) digital scales. The ones that brick themselves after 2,000 uses because how dare you only pay once.

jucelc ,

Lol. Always suspected there was a scam there, but every time I bring it up in a conversation - people just call me a conspiracy theorist.

This goes for pretty much everything though. Planned obsolescence is real, but people think it’s just the natural way of things.

DeafeningDistance ,

is there an article about this? Would love to read about it

Lemminary ,

There is no article that I could find, so I guess you take my word for it. But I’ll fill you in on why I said it from what I remember. You can make up your mind on this:

I was looking for a digital scale during the pandemic and naturally went on Amazon. I found some within my budget (I live outside the US) but most of them had multiple reviews complaining about a weird error that they couldn’t fix. I did some digging around, yet nobody seemed to know what the error really was that was showing up after some time of prolonged use without signs of wear. Eventually, I got to a thread on some technical forum that said it was a software error that strongly hinted at planned obsolescence after so many uses.

The weird thing is that I can’t find any of the models that had this on Amazon anymore but it doesn’t surprise me after some of the shit I’ve seen on there with people manipulating reviews on other products I’ve bought. So I guess it could go either way for someone review-bombing the product or it being a real issue, but that doesn’t explain the error showing up on other sites. I wish I could remember what the error code was.

If anybody knows anything more about this, I’d love to hear it. It certainly was a strange surprise that ended up costing me a bit more than I was planning to spend. But I guess bullet dodged?

helenslunch ,
@helenslunch@feddit.nl avatar

This reminds me of the hacked McDonalds ice cream machines. Except the shitty manufacturers won that one.

damirK ,

Sadly they will probably win this as well. Some claim there could safety concerns and it isn’t certified or could damage their brand… time for people’s manufacturing of products? Hehe

Burn_The_Right ,

But if the people controlled the means of production… that would be…

WallEx ,

I’m not firm in polish law, do they have the same laws as in the USA? Because that’s what you’re comparing right?

Aceticon ,

As far as I know, there is no such thing as DMCA provisions against working around software protection mechanisms in the EU and in fact at an EU level the direction is to increase ownership rights, not decrease them.

However depending on the contract the train company might not legally own those trains (for example, it’s structured as a Lease), but if the hackers can show proof that the train company authorized them to do those changes it would be a case against the train company, not the hackers.

psud ,

I think this one might go well. Company preventing a country’s trains from being serviced by a third party. I expect that train builder has already tanked their business, but it would be an interesting one to be litigated, the sort of case that can get the law changed

Aceticon ,

This is an EU country, not the US.

Things like the DMCA provisions forbidding working around IP protection mechanisms (and software is copyrighted) don’t apply here.

IANAL (so take this it with a pinch), unless the trains are legally theirs rather than the train company’s, it’s not hacking, it’s just “software maintenance” and the only right this company has here is to withdraw product warranties because of “unauthorized changes”.

There might or not be a case against the train company (for example, if the contract forbade this or the train company tried to sell those trains onwards as if they were original) but not against the people who did the software changes on the trains when authorized by the owners of said trains.

damirK ,

I assume EU has safety regulations and if a train suddenly loses its brakes they would be liable wouldn’t they? Now they can say someone has “hacked the train” and they can’t guarantee the brakes will work. I am not sure where the USA argument came from

Aceticon , (edited )

The responsability of circulating with a vehicle that abides by safety regulations is of the owners, not the makers.

You’ll notice that even in the consumer auto segment (which, since run-of-the-mill consumers are not expected to be “experts”, has lots of of ways to make sure that brand new cars are sold already pre-certified “road-worthy” because normal consumers don’t have the know-how to make sure of it themselves), the actual car owners still have the responsability of having a periodic inspection done to the car and repair those things that stop it from being road-worthy and they cannot circulate with it in a public road if it’s not compliant (at least that is the case in Europe).

Outside the consumer segment, I expect that the rules for trains are pretty similar to those for commercial aviation: the manufacturer has no responsability beyond a contractual one (i.e. the purchasing entity probably demands contractually that the vehicles they get comply with regulations, the parts they buy obbey certain specifications and maintenance done by a manufacturer-certified shop delivers a compliant vehicle) and all the regulatory responsability is in the hands of the owner (more specifically the “operator”, as for example for leased planes the airline doesn’t actually own them but they do operate them hence they’re the ones with regulatory responsabilities).

The USA argument comes from the anti-circunvention legislation for software being part of the DMCA law, said legislation giving rights to the makers of the software to stop changes to it even in devices they do not own. Where such legislation does not apply there is no law forbidding somebody doing whatever changes they want to software as long as they own the device containing said software or have the authorization of the owner of the device whose software they are changing - the only applicable legislation here is Copyright and that only limits the distribution of the software, not the changing of it.

It’s not at all unusual for Americans to argue that people can’t legally circumvent software protections even in devices they own, because that is indeed the case in their country thanks to the DMCA, but expecting that to be the case in Poland doesn’t make sense as the laws there are not at all the same as in the US.

damirK ,

That’s a whole lot of energy spent based on completely incorrect assumptions about me or what I was saying so your argument can work. But sure whatever makes you feel like you are right.

Aceticon ,

That’s a very weird take.

You don’t know me and went all weirdly personal full of assumptions about me and without making an actual argument.

Whatever is going on there, it’s all in your head.

DacoTaco , (edited )
@DacoTaco@lemmy.world avatar

The person is doing a talk about it in hamburg, germany (37c3) next week. Its on my to watch list because that sounds hella interresting.

Edit : 37c3 list of talks : halfnarp.events.ccc.de/…

khannie ,
@khannie@lemmy.world avatar

That actually does sound hella interesting. I’m saving your comment to try to remember but actually look it up in about two years when I scroll back though my saved posts.

verity_kindle ,

Same, same.

YoorWeb ,

youtube.com/

Holyginz ,

Went to subscribe to it until I remembered i don’t speak German lol

example ,

nearly all talks are either in English or have English translations. not sure if they’re available on YouTube but you should be able to find everything on media.ccc.de

isVeryLoud ,

Time to learn!

helenslunch ,
@helenslunch@feddit.nl avatar

I’m saving your comment to try to remember their comment to try to remember to watch that.

DacoTaco ,
@DacoTaco@lemmy.world avatar

Consider this a reminder :p

foyrkopp ,

C3 talks are available online for quite some time after the actual event, so you might still be able to watch it then.

barsoap ,

Where “quite some time” is “indefinite”. Proper archives go back to 2002, 19c3.

Takes some time for stuff to show up in the archives though as start+end get cut manually, while the congress is running there’s always an archive of raw steam dumps maybe that’s the one you mean.

threelonmusketeers ,

Does Lemmy not have a “remind me” bot yet?

pwalker ,

It’s 37c3, but thx for the hint. The talk is called Breaking “DRM” in Polish trains by Redford, q3k, MrTick

I will try to watch it on stage, unfortunately still no final schedule available

DacoTaco ,
@DacoTaco@lemmy.world avatar

Fixed the edition number. I always forget what number we are at haha. I will not be on site, but i saved it in my planner : halfnarp.events.ccc.de/…

barsoap ,

The numbering got a bit messed up as there weren’t chaos covid congresses.

NeoNachtwaechter ,

Nowadays satire can never be as good as reality is.

Hamartiogonic ,
@Hamartiogonic@sopuli.xyz avatar

Trump and the whole Brexit circus have set a very high bar, but somehow someone still manages to produce quality comedy.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •