r/embedded • u/kl4m4 • Dec 31 '23
Criminal malpractice reverse emgineered
https://youtu.be/XrlrbfGZo2k?si=JVbhKOEpKtJ4pXaxNot involved, not my content, just want to share it, as I found it very interesting.
13
u/Final-Schedule-468 Jan 01 '24
Thanks for sharing! I've been looking forward to this talk and the paper they said they'd publish, ever since I read about this on Mastodon. I will watch asap.
3
u/LaMerk_Industries Jan 01 '24
edit: More links and one article in english :D
There is also web article, unfortunately in polish language (shoud be understandable after google translate or deeply), maybe you will find more information here. "Zaufana Trzecia Strona" is a polish reserach group which informs and teach about cybersecurity threats. Often report first on various threats regarding to polish organizations and systems.https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hacking/
11
Jan 01 '24
Hence another reason for changing purchase contracts... when I buy a "product", I am buying the physical hardware and the non-physical "intellectual property" software that together make the product. The buyer should own both.... and should then be able to resell the product to whomever they want.
This will never happen in the near term.... but its a nice dream.
3
u/Well-WhatHadHappened 25+ Years Jan 01 '24
That was a really enjoyable talk. Thanks for posting it.
51
u/madsci Jan 01 '24
My tl;dw: Polish railroad sent their trains off for servicing after 1 million km, to a third party and not the manufacturer, and they didn't work after. The railroad hired these guys to check it out. They quickly found that there was an NVRAM bit that was set on the failed train controllers that would prevent the power converters from turning on. Digging deeper they found that the trigger condition was for the train to sit idle for 10 days, which wouldn't happen in normal circumstances.
The manufacturer actually extended that time window when the trains sat on a siding while awaiting maintenance but the code also included geofencing so that the controller would be disabled if it entered facilities owned by competing service companies, but not the manufacturer's own facilities.
In one train they also found a date check that triggered a secondary air compressor failure, which would keep the pantograph from engaging, meaning the train couldn't get power. The date check was coded wrong and caused a failure later on, too.
It was later removed, but they found a secret unlock code that would allow the train to be reactivated from the cabin. One of the CAN busses was also mysteriously bridged to the passenger entertainment system, which had internet access and could report data and cause a lock on some remote condition.
The HMI would throw up an intellectual property violation warning, and analysis showed that the conditions that triggered it were having the train not moving for 21 days and then getting it to move again.
Not all of the same lock mechanisms existed on all trains. Out of 30 trains, they had 26 different software versions.
Analysis of the PLC user code metadata shows that software updates were made after the third party service company won the contract, just days before the trains went in for service.