Email or username:

Password:

Forgot your password?
Top-level
q3k :blobcatcoffee:

@redford and @mrtick held an unrecorded talk a bout this at OhMyHack in Warsaw - I unfortunately couldn't make it because of Munich snow.

For now this is making the rounds in Polish-speaking sources, but we do have a talk scheduled about this at 37C3, in which we plan to do a deep dive into this and actually publish our findings.

@zaufanatrzeciastrona 's article about this: zaufanatrzeciastrona.pl/post/o

103 comments
OddOpinions5

@Ifrauding @q3k @redford @mrtick @zaufanatrzeciastrona

thank you
one thing you should learn as you leave your youthful days behind is that the world runs only cause of the incredible amount of work by volunteers, work on everything big and small, from your local library to big stuff like this

Potung Thul

@failedLyndonLaRouchite

+1 Agree. The economic impact of people who do things, not because of economics, but because they should be done, cannot be overstated.

Thank you!

@Ifrauding @q3k @redford @mrtick @zaufanatrzeciastrona

DELETED

@q3k @redford @mrtick @zaufanatrzeciastrona is anyone getting sued at least?

Because this is ridiculously anticompetitive behaviour.

Piiieps & Brummm

@AlgorithmWolf
I belive, this could be used by a competitor. Unless they do the same.

@q3k @redford @mrtick @zaufanatrzeciastrona

dukp

@AlgorithmWolf @q3k @redford @mrtick @zaufanatrzeciastrona unfortunately, it is usually the security expert detecting the issue, or the whistleblowers who get sued…

DELETED

@dukp @q3k @redford @mrtick @zaufanatrzeciastrona true indeed...

Hopefully the EU cripples this manufacturer somehow.

Ulrik Nyman ⬡

@AlgorithmWolf @dukp @q3k @redford @mrtick @zaufanatrzeciastrona Yes, the manufacturer should be excluded from EU contracts for the next 10 years.

Tom Andraszek

@UlrikNyman @AlgorithmWolf @dukp @q3k @redford @mrtick @zaufanatrzeciastrona - was Volkswagen crippled or excluded from the EU contracts after they cheated on pollution tests?

DELETED

@tom_andraszek @UlrikNyman @dukp @q3k @redford @mrtick @zaufanatrzeciastrona

Yes, actually nbcnews.com/business/autos/jud

The US also fined them.

In addition to this fine, they were forced to recall vehicles and fix them for free, which generates additional obvious costs while simultaneously undoing all the damage.

Maybe this manufacturer should be fined and forced to physically service every train unit for free to disable their DRM permanently. That would prevent them from having silly ideas in the future.

@tom_andraszek @UlrikNyman @dukp @q3k @redford @mrtick @zaufanatrzeciastrona

Yes, actually nbcnews.com/business/autos/jud

The US also fined them.

In addition to this fine, they were forced to recall vehicles and fix them for free, which generates additional obvious costs while simultaneously undoing all the damage.

Tom Andraszek

@AlgorithmWolf - the US fined Volkswagen, the EU did not "cripple" Volkswagen or exclude them from contracts, as far as I know.

Whoever did this at Newag needs to be charged and servicing companies and customers need to be compensated for the loss of revenue.

I wonder if making programmers go through certification/registration process like engineers would limit unethical behaviour. If a programmer was personally responsible for the damage their code does, through negligence or international.

DELETED replied to Tom

@tom_andraszek ft.com/content/0c594b02-6f91-4

Yes it did.

Do you not really think being forced to recall (and fix for free) potentially hundreds of thousands of cars is a punishment?

VW made zero money from it, and all their customers now have a less powerful engine.

Pawlicker replied to DELETED
@AlgorithmWolf @tom_andraszek >less powerful
Slightly less power/mpg is nothing compared to the pages of "my dpf failed and the dealer wants $1,000 to replace it and also its on backorder" complaints on forums.
Which was a problem before the scandal even then because vw was trying to use a def free system, which is nowhere near as robust and is notorious for failures compared to the def systems competitors used. The fix really stressed it harder.
@AlgorithmWolf @tom_andraszek >less powerful
Slightly less power/mpg is nothing compared to the pages of "my dpf failed and the dealer wants $1,000 to replace it and also its on backorder" complaints on forums.
uis replied to Tom

It will only increase unethical behaviour since company can now threaten with revoking certification

Leszek Karlik

@AlgorithmWolf @q3k @redford @mrtick @zaufanatrzeciastrona

So far, the Polish Railway Transport Authority said that it is a matter for a civil dispute between the purchaser and the manufacturer and is washing its hands of it, but the news only broke, I really hope someone goes to jail pour encourager les autres.

tb

@Leszek_Karlik It feels a little bit like when VW had its cars detect whether they are on a test stand or not. I wonder if in this case the higher-ups will also pretend that they knew nothing about this code.

Moon
@AlgorithmWolf @q3k @redford @mrtick @zaufanatrzeciastrona it looks worse to me, it looks like they deliberately sabotaged the operation of public transportation vehicles. I hope it gets elevated to a criminal offense, this is worse than if a passenger got in a train and disabled it, which they would definitely go to jail for.
Dreit

@jomo @q3k @redford @mrtick @zaufanatrzeciastrona If not, I hope EU will focus on it during this decade

John Burns

@q3k @redford @mrtick @zaufanatrzeciastrona

Is that a hack... or something put in place by company or its contractors?

Your post said 3rd party? Is that to mean they were using cheaper service providers?

---
I can only imagine what riders experienced.

wikiyu

@JohnJBurnsIII "3rd party repair" it means mostly - independent from manufacturer but doing all stuff provided by law and using certified materials, parts and so on...

John Burns

@wikiyu

Thank you.

Still feels like it should not have been part of operational code in the system.

To easy to abuse.

Raven667

@JohnJBurnsIII @wikiyu I don't think there is any scenario where the described functionality isn't abuse, the only purpose for that code is abuse and I hope it's illegal, against the contract, and the purchaser can throw the law book at them and get real consequences including jail time for the executives who ordered this or knew about it.

I'm probably going to be disappointed in the outcome, but jeez that is some shit behavior when you already sold a fricken *train* at a profit

magsafe genitalia

@JohnJBurnsIII @q3k it reads to me as "DRM to ensure that orgs who bought the trains were only using maintenance contractors authorised by the manufacturer" and I'm pretty sure that there's regulation against that kind of thing in other vehicles (cars, say)

Adam Williamson :fedora:

@outie @JohnJBurnsIII @q3k yeah, I think you're missing the story here, John. It's the train manufacturer doing very sketchy stuff to try and prevent operators from having them maintained anywhere but their shops. Like if your car maker slipped some bogus code in that made your car refuse to start if you had it serviced at the local garage. Or your phone manufacturer doing the same, ahem, Apple.

John Burns

@adamw @outie @q3k

OH. OK. Yes... I did not pick up it was OEM code.

This sounds like HP locking down their printers to only use ORM replacement cartridges. Or Keurig doing similar for coffee pods.

M.S. Bellows, Jr.

@JohnJBurnsIII @adamw @outie @q3k Except this is like HP printers *pretending* they're out of ink when they're not, while warning you that only HP cartridges will work.

John Burns

@msbellows @adamw @outie @q3k

🤔

And given you can't really see into those cartridges - I think I would not be surprised that is not the case.

I dumped my not quite 2 year old OfficeJet in 2012 - for repeated error codes no matter how many OEM new cartridges I stuck in there. In the end... >$100 in unused cartridges.

Happily using Epson since then... so 11 years of use and no repairs needed. Does what I need (rarely print, but need it when I need it).

#NevermoreHP

just adrienne

@JohnJBurnsIII @adamw @outie @q3k Both of which are also terrible and should be illegal, but definitely not on the same scale of badness as being able to REMOTELY DISABLE A PASSENGER VEHICLE!

Matěj Cepl 🇪🇺 🇨🇿 🇺🇦

@adamw @outie @JohnJBurnsIII @q3k And now let's see what @EU_Commission will do about that. It's good to mention, that for the anticompetitive behaviour (and worse) they can fine the manufacturer up to 10% of their worldwide turnover (not profit, turnover).

Pepita Pepito

@adamw @outie @JohnJBurnsIII @q3k checking against a blacklist of the GPS coordinates of third party repair shops is really out there compared to previously known hardware DRM shenanigans. what were the managers who authorised that thinking?! let's hope such examples lead to vigorous change in legislation. never thought we'd need "right to repair" for effing trains!

Al

@outie @JohnJBurnsIII @q3k
I wouldn't be too sure about that. When your car phones home for update the corp can put anything they want in it. Just wait till you get a speeding ticket based on the recorded speeds of your car.

Dazzling Urbanite

@mral @outie @JohnJBurnsIII @q3k

Hold yer horses there buckaroo.

Don't try to threaten me with the one GOOD outcome scenario...

Al

@apressler @outie @JohnJBurnsIII @q3k
I'm not sure what I said that was good. do you really want a ticket everytime you speed up to safely pass another car. There are a lot of times when your doing 55 and the guy ahead is doing 54 so you speed up to pass without taking a mile.

Till O'Rly :v8rified:

@mral @apressler @outie @JohnJBurnsIII @q3k I'm sure there are ways to detect if you was just passing somebody or if you were speeding.

Dazzling Urbanite

@mral @outie @JohnJBurnsIII @q3k

Such a method as proposed is frankly stupid since it only punishes after the fact and preventing speeding is the desirable goal. A mandatory geo-gated speed limiter on all motor vehicles would be much more efficient and effective solution. But if fines after the fact are all that are on offer, then yes. Give it to me.

But not for you, of course. You are special and deserve to be treated as such. I think you should be given lights and a siren.

SuperMoosie

@outie
There might also be good reasons why its there.

Contract of purchase that maintenance has to be proformed by train manufacturer. Ie they might have paid less upfront as the profit is from the later maintenance over x years of contract.

Critical safety systems such as Automatic Train Control that should only be touched by suitably qualified staff. Mess with this and the safety certification goes, which might mean the train isn't allowed to run on the network, not have insurance or mass fatalities.

@JohnJBurnsIII @q3k

@outie
There might also be good reasons why its there.

Contract of purchase that maintenance has to be proformed by train manufacturer. Ie they might have paid less upfront as the profit is from the later maintenance over x years of contract.

Critical safety systems such as Automatic Train Control that should only be touched by suitably qualified staff. Mess with this and the safety certification goes, which might mean the train isn't allowed to run on the network, not have insurance or mass fatalities.

Palanix :linux:

@SuperMoosie
This makes no sense. If this is put in place because of contract violations, the manufacturer can simply sue.

If the 3rd party workshop is unequipped to deal with the safety systems, which might mean loosing safety certification, then that is for actual authorities to decide and enforce

Niall in Raglan :laserkiwi:

@SuperMoosie @outie @JohnJBurnsIII @q3k this not some random dude servicing the train. It's a train service yard with huge infrastructure and a huge contract. In this story they describe going through the huge maintenance manual and finding no mention of these things. If it's a certification thing then it should clearly state this.
badcyber.com/dieselgate-but-fo

Cats Who Draw

@q3k That's terrifying! Thank you for sharing (once it was declassified!) 🙀 @redford @mrtick @zaufanatrzeciastrona

Phil M0OFX

@q3k @redford @mrtick @zaufanatrzeciastrona Wow. That's a talk I'll be looking out for on media.c3! Sounds like they were taking a leaves out of John Deere and Apple's books. Hopefully it leads to a harsh lesson for NEWAG.

qwertyoruiopz

@q3k @redford @mrtick @zaufanatrzeciastrona At what point do people call this kind of stuff a protection racket?

Central Illumination Agency

@q3k @redford @mrtick @zaufanatrzeciastrona Very impressive work. Congratulations!

I understand there´s no write-up of this available in English at this point? That would be great...

q3k :blobcatcoffee:

@slothrop @redford @mrtick @zaufanatrzeciastrona

We'll release a full writeup as part of our 37C3 talk. It's a lot of work to gather all the data :).

AURonline 🏡

@slothrop @q3k @redford @mrtick @zaufanatrzeciastrona I let Edge translate the Polish article to English and it was very readable (machine translation has come a long way...). DeepL or Google Translate will most likely also work very well.

rugk

@AUROnline sidenote: Firefox translations has a privacy-first local translation feature which works in your browser and works quite good, so you can use that too.

DELETED

@gudenau @q3k @redford @mrtick @zaufanatrzeciastrona

Throwing bogus error codes after a hard-coded date sounds extremely suspect to me.

gudenau

@beekir @q3k @redford @mrtick @zaufanatrzeciastrona I was more talking about the geofencing thing but timers are a legitimate thing for some maintenance items. That one really depends on the specific details.

Michał Kowalczyk

@gudenau @beekir @q3k @mrtick @zaufanatrzeciastrona

>

timers are a legitimate thing for some maintenance items

Not if they don't reset after that maintenance ;)

noodlejetski :verified_gay:

@q3k @redford @mrtick @zaufanatrzeciastrona

> Niestety pociąg, którym badacz podąża do serwisu, spóźnia się.

Luke

@q3k @redford @mrtick @zaufanatrzeciastrona Holymoly! 😮​ I am really looking forward to this talk now! 🚃​🔒​

Felix B. Ohmann

@q3k

well done. companies should not be able to get away with this.

stansobczyk

@q3k did you update the software to rerun the train on your own or Newag was forced to do it ?

Michał Kowalczyk

@stansobczyk @q3k No, we found a way to reset the locks without modifying the software :)

Irenes (many)

@q3k @redford @mrtick @zaufanatrzeciastrona wow!!!! amazing to have caught them doing this. GOOD JOB on the research.

rugk

@q3k @redford @mrtick @zaufanatrzeciastrona wow cool, is not that anti-competitive behaviour somehow and likely illegal? I hope it is…

I mean did you somehow report it or so?

NiceMicro

@q3k It seems like public transit is not really public as long as the trains are running on proprietary garbage.

The time has come for Free Software Urbanism.

#FreeSoftware #Urbanism

Markus Schlichting

Sounds a lot like I found the first first entry to my #37c3 schedule! Looking forward to it 🤩@q3k @redford @mrtick @zaufanatrzeciastrona

Claus Cramon Houmann

@q3k @redford @mrtick @zaufanatrzeciastrona impressive research, good job. And scary that someone would actually code this into a train system.....

uis

It seems EU will have field day on rails. Polish police/security service maybe will have field day too: isn't NEWAG related to russian oligarchs or FSB, what if Putin himself will lock trains. Fun begins.

Peter Brown

@q3k @redford @mrtick @zaufanatrzeciastrona some gas boilers are programmed to stop working. If you don’t have them maintained every six months.
The installer can activate the program or not, but if they do, they are guaranteed two service callouts per year.

Elfi, :verifiedtransbian: cute moth

@q3k Thank you for doing good work exposing this awful practice, I hope Newag and other manufacturers who try to pull this stunt go under

DELETED

@q3k @redford @mrtick @zaufanatrzeciastrona

Well this is some next level shitty behavior... I can't imagine any rail operator buying from this company ever again... Such behavior should be punished with market impact that threatens the company doing it, otherwise it will only grow.

Can't wait to see the talk!

tjhowse

@q3k @redford @mrtick @zaufanatrzeciastrona

Absolutely astounding work. Top stuff. If your talk at 37C3 is recorded, uploaded and (selfishly) in english, please toot about it! I'm keen to hear the details.

Zahrdie

You're famous now 😁 someone mentions about that "case" in YouTube video.

Im proud that someone(you and your friends I guess) gives them(a Polish National company) a middle finger.

Go Up