They have not been trained for this

https://www.ccc.de/en/updates/2024/das-ist-vollig-entgleist

by hacka22 • 2 years ago

645 155 2 years ago

ccc.de

sroussey• 2 years ago

I remember this story of “hackers” discovering that the train company disabled trains being serviced by competitors.

It’s a shame they are being sued.

Hopefully, they raise enough to do painful and invasive discovery.

scotty79• 2 years ago

It's a shame that the company wasn't charged with sabotage and possibly treason.

Attacking trains, even the ones you manufactured is an attack on nationally crucial infrastructure.

aeontech2• 2 years ago

Previous discussion, when it was first discovered - I am surprised there wasn't more: https://news.ycombinator.com/item?id=38893116

lukan• 2 years ago

There is way more (see first comment)

https://news.ycombinator.com/item?id=38788360

terramex2• 2 years ago

There was much, much more discussion here, e.g:

https://news.ycombinator.com/item?id=38530885

https://news.ycombinator.com/item?id=38567687

https://news.ycombinator.com/item?id=38628635

https://news.ycombinator.com/item?id=38788360

& more

dang2• 2 years ago

Thanks! Macroexpanded:

Manufacturer's Repair DRM Killed Train's Power, Broke Compressor - https://news.ycombinator.com/item?id=38893116 - Jan 2024 (2 comments)

Breaking "DRM" in Polish trains [video] - https://news.ycombinator.com/item?id=38788360 - Dec 2023 (51 comments)

Polish DRMed trains stop as predicted due to date-based logic-bomb - https://news.ycombinator.com/item?id=38729035 - Dec 2023 (103 comments)

Trains were designed to break down after third-party repairs, hackers find - https://news.ycombinator.com/item?id=38638865 - Dec 2023 (233 comments)

Polish Hackers that repaired DRM trains threatened by train company - https://news.ycombinator.com/item?id=38628635 - Dec 2023 (142 comments)

Polish train maker denies claims its software bricked competitor rolling stock - https://news.ycombinator.com/item?id=38570654 - Dec 2023 (2 comments)

Dieselgate, but for trains – some heavyweight hardware hacking - https://news.ycombinator.com/item?id=38567687 - Dec 2023 (293 comments)

Polish trains lock up when serviced in third-party workshops - https://news.ycombinator.com/item?id=38530885 - Dec 2023 (360 comments)

aeontech2• 2 years ago

Ah! My search-fu failed me, I was looking for company name and for train hacking mentions, but didn't find all these! Thank you!

jdiez176• 2 years ago

I just donated 133,7€ and will gladly do it again if further legal costs arise. Please consider also making a generous donation and post about it in this thread.

What Newag is doing here is absolutely vile. They want to charge 20.000€ per train to “reactivate” them after they have been serviced at third party workshops. We must not let them win and set a precedent.

I highly encourage everyone to watch the previous presentation: https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra...

SR2Z• 2 years ago

At 20k euros, would it not just be cheaper to hire some software people to jailbreak them?

If companies that did this got jailbroken and blacklisted by the government, pretty much nobody would try this bullshit.

None4U• 2 years ago

This ("software people to jailbreak them") is exactly the identity of the hackers who have been sued

pantalaimon• 2 years ago

That’s pretty much what happened and how this story came about

kosma• 2 years ago

The company was a bit too much in bed with the government to begin with...

atoav2• 2 years ago

This isn't a software issue. This is a hackers-found-out-they-were-cheating-and-deactivated-their-train-DRM-and-now-these-hackers-are-getting-sued-issue.

And getting sued by a train manifacturer is typically a asymmetrical battle for a private person. Consider watching the original talk (very entertaining and insightful, probably one of the best hacking related videos I watched in 2024), and if you like them toss them a tenner or so.

majke• 2 years ago

The firmware would need to be certified. They mentioned that in the q&a couple of minutes ago.

Apparently its a critical component.

conartist6• 2 years ago

I couldn't figure out how to donate from their website. Where did you donate to?

jdiez176• 2 years ago

The payment information is a bit obfuscated, being only a parenthesized sequence of letters and numbers in the OP.

IBAN: DE41 2001 0020 0599 0902 01

BIC: PBNKDEFFXXX

Purpose: Lokomotive

Payee: CCC eV

boricj• 2 years ago

I highly encourage everyone to watch the previous presentation: https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra...

According to the schedule [1], there's a presentation from that team titled "We've not been trained for this: life after the Newag DRM disclosure" that will start at 23:00 local time (in about 30 minutes at the time of this writing) on this livestream [2].

Edit: presentation's over and it was outstanding.

[1] https://events.ccc.de/congress/2024/hub/en/event/we-ve-not-b...

[2] https://streaming.media.ccc.de/38c3/eins/hls

kaszanka• 2 years ago

Here's the live recording link for those who missed it and are too impatient to wait for the cleaned-up one: https://streaming.media.ccc.de/38c3/relive/233cb1d4-4833-538...

masklinn4• 2 years ago

Was going to sling an even 100, but yours is funnier so did the same, thanks.

anovikov• 2 years ago

Precedent isn't as big a concern as many might think, most of Europe does not operate under a precedent-based justice system: it doesn't matter what were the previous decisions of courts on similar cases, the law is the only thing that matters.

etruong42• 2 years ago

Can you elaborate? I'm not a lawyer, but my understanding of the value of precedent is to have courts rule on matters in a manner that is consistent with past rulings. Are you suggesting that courts can interpret the law completely differently from how past courts have ruled? Do you feel like that makes court decisions unpredictable?

To be clear, the law changes over time, so newer laws have less precedence, and I expect courts to respect new laws even though no courts have made ruling based on such a law before.

silexia• 2 years ago

We need to fight for the Right to Repair to be in legislation for ALL products! If we buy a product, we should have full access to all software and have the ability to fix it!

lupire• 2 years ago

Is no one suing the manufacturer for vandalizing the trains?

terramex2• 2 years ago

It was also revealed that the Polish Internal Security Agency (ABW) had, in October 2022, submitted a case against Newag regarding the abovementioned software manipulation incidents to the prosecutor's office in Nowy Sącz, which initially downplayed the incident until said findings publicly came to light, after which, the investigation was taken over by the regional prosecutor's office in Kraków on suspicion of crimes committed under Article 269 §1 and Article 286 §1 of the Polish Penal Code.
The Sejm's [Sejm is "the lower house of the bicameral parliament of Poland"] Parliamentary Committee for Combating Transport Exclusion subsequently convened three hearings regarding the abovementioned allegations on 17 January, 27 February and 26 March 2024, whose participants included representatives of the Dragon Sector team, Newag, railway operators and members of the Sejm.[19]

https://en.wikipedia.org/wiki/Newag#2023_revelation_of_softw...

I could not find any later updates in polish media.

praptak• 2 years ago

The latest update I found is [0] but there aren't any substantial updates about the criminal part of the affair.

https://kolejowyportal.pl/dragon-sector-newag-wprowadza-opin...

intunderflow• 2 years ago

No, and frankly if the Polish government won't do anything with this overwhelming evidence then they've got the train manufacturer they deserve.

You can lead a horse to water...

nicce2• 2 years ago

If that will happen, maybe it is time to start following that money.

pkkm2• 2 years ago

They are being investigated, the Polish government is just slow.

1oooqooq• 2 years ago

instead of a defense fund for the hackers, they should start an ETF to sue the manufacturer for profits:)

ryandrake2• 2 years ago

Looks like train manufacturers are taking a page out of the playbooks of many other companies today. The practice of manufacturers remotely disabling products after the time of purchase (for whatever reason) is becoming a scourge in many other product areas. The device's manufacturer should have no say about how a product is used once money is handed over in exchange for it. This really has to stop. Regulatory agencies around the world are asleep to this problem.

notpushkin2• 2 years ago

duxup• 2 years ago

I have no problem with some wide ranging law about right to repair.

If that's regulation, yes please.

TheSpiffiest• 2 years ago

Yes? Unless we want to let manufacturers sell us a vehicle but license the code that makes it run.

trod12344• 2 years ago

If businesses are unable to regulate themselves, it must be done by law.

If copyright is the root of the problem, it may be time to remove that protection; or at least revert it so it is more in-line with patent law expiration.

No more author's life + 75. Lets try 15-20 once again, and no derivative protection, unless significantly different, receive protection.

sixothree2• 2 years ago

You say this as if regulation for companies is a bad thing. Your entire existence is governed by regulations. Why should theirs not be?

pkkm2• 2 years ago

In this case, probably? I'm not a fan of excessive regulation, for this particular problem, I don't see how it could be solved without some kind of "right to repair" law, or at least a "right to be thoroughly informed about repairability before buying" law. Even if copyright was scaled back to 20 years and explicit registration, that still would be long enough to screw customers. In fact, even if copyright didn't exist, the problem would still exist for devices that are hard to reverse-engineer.

timewizard• 2 years ago

but is it really what we want?

What we want is results. Whatever mechanism is most efficient at producing those results should be used.

Copyright is the root of the problem.

If you sell me a device that relies on copyrighted software for operation then you must also grant me a limited non-transferable license tied to that specific device to modify that software however I please. Perhaps DMCAs anti tampering provisions are really the issue here.

actionfromafar• 2 years ago

The device/train could be bricked with or without copyright.

junga• 2 years ago

This really has to stop.

"We", the totally homogeneous group of software professionals could make this stop. "We" don't.

ryandrake2• 2 years ago

Yea, every time I read one of these articles, I can’t help but think: “A software engineer sat down and wrote this remote kill switch." We, as a profession are responsible for this shit, or at the very least, complicit. Regulation is one thing, but also, software engineering as a profession is in dire need of ethical standards. Just because we can code something doesn’t mean we should.

immibis13• 2 years ago

I am physically there at C3 right now and one of the prevalent themes this year is "being nice didn't work". You can see it in this year's tagline: "illegal instructions"

teeray• 2 years ago

“We” is an amorphous blob, not a guild. The company will just shop the job around until they find someone to do it.

jasdi• 2 years ago

If you want to have a say in how software works, then you have to control how companies run.

If Technical folk are not on the Boards or have controlling share in an org, or don't know how to get into such positions then they have very little to no say in how anything works.

There are countless examples were technical people object and get replaced, sidelined or fired, cuz they are totally unprepared in how to win such age old political and financial fights. If Oppenheimer, Engelbart and the Google brainiacs who protested recently got pushed aside, then its beyond obvious how the story will end for anyone else.

The lesson from history for anyone serious about this stuff is - develop business+finance acumen, or develop alliances with business+finance power.

tempodox• 2 years ago

The bottomless pits of greed that opened up in the software industry with subscription models are also attracting hardware manufacturers. Effectively, you don't buy their stuff any more, you only rent it. If “the market” accepts this BS, regulatory agencies will do nothing.

charlieyu12• 2 years ago

Today? My first PC had a “do not open or lose warranty” seal.

josefritzishere• 2 years ago

The CCC are heroes and should be celebrated as such.

DaSHacka• 2 years ago

Not sure I'd go that far, though their efforts on matters like these are certainly appreciated.

immibis13• 2 years ago

Note that the CCC is more-or-less just a container organization for people who actually do stuff individually. These particular hackers are heroes. Even things like the Congress are run by some people who more-or-less decided to run the Congress each year. There substantial inertia in how things like that are done, of course.

pmarreck• 2 years ago

What happened to the old moral rule of "if you explain to your mom what you are doing and she is dismayed, you are doing things wrong"?

Because what Newag is doing very clearly violates it.

shermantanktop• 2 years ago

Presumably that rule isn’t profitable to follow, and so the prime directive (maximize money in any legal or quasi legal way possible) takes precedence.

the_gipsy• 2 years ago

"to have a fiscal obligation (to your shareholders)" or something like that.

joe_the_user• 2 years ago

That rule is essentially about "what will get you in trouble politically". But today you have a fair number of large and monopolistic operations that just ignore such effects - the press is underfunded and corrupt and politicians are simply corrupt (in a broad sense).

charlieyu12• 2 years ago

People seldom tell the truth to their families and there is always some way to distort a bit to convince yourself

atoav2• 2 years ago

Newag is acting like the mafia here: "Wouldn't it be a shame if your trains stopped working..?"

Not that I want to tell the Polish how to do things (I don't), but a satisfying outcome would be one where they found out precisely who gave the order to program Newag trains like that and then jail them. Add to their jailtime for each train that is found running the software and force Newag to do free maintenance on those trains.

If Poland wants to show a hard stance on how to deal with people trying to fuck over the public to earn money that's as good as its gonna get. If Poland wants to tell everybody that fucking the polish public pays off even if there is overwhelming evidence that you did it — ok.

trod12344• 2 years ago

NewAg is clearly acting with malice and sabotage in mind (as well as extortion), and when it comes to trains and railways this is not just a business matter, it becomes a strategic national security issue.

"Wouldn't it be a shame if the trains filled with perishable food stuffs stopped working in route..., and the harvests rot"

Do you know of any country where food security doesn't impact the government's ability to keep order?

If any non-service operator, did this, like a third-party, they would reasonably be considered a terrorist organization, and the members of such a cohort should be treated as such.

Even if the claim is made its only for small specific things which you had to agree to, its an inserted vulnerability into the supply chain that is both non-essential for regular function, which has been designed to be essential.

At a bare minimum, they pave the way for such groups even if they don't act on it themselves.

randunel• 2 years ago

If more than the € 30,000 required to date is donated, if the legal costs are lower or if court costs are repaid, all payments received in excess will be used for the statutory purposes of the Chaos Computer Club e.V.. Please note that the CCC e.V. is not formally recognised as a non-profit organisation.

That is one sure way to make people not donate to the cause. I want to support the people, but I don't want my money to go elsewhere, and there is no way of knowing how much has been raised to date or guarantees to get the funds back when the legal costs eventually get covered by Newag. The only guarantee stated is that they will definitely use money for something else. Not OK.

lionkor• 2 years ago

an e.V. is by its very nature very non-profit-y. I am not an expert, so I encourage you to look up e.V. aka "eingetragener Verein", but basically, its similar to a nonprofit and a lot of rules and laws apply. Its not formally a non-profit in any country because e.V. is a specific German thing. You can, however, rely on that being very rock solid and not for-profit.

jdiez176• 2 years ago

That’s a fair point and I had to re-read that sentence multiple times to understand what they are saying. They should indeed say how much money towards this cause has been received.

saaaaaam• 2 years ago

I’m assuming they have to say this from a legal perspective. In reality what they are saying is “we don’t know how much the legal fees will come to, could be less, could be more. However, once we have proper accounting, if there is money left over this will support CCC”

I’m not familiar with German governance for quasi not for profits, but I suspect the idea that funds are conditional for one specific purpose probably breaches governance, and returning funds to donors if certain conditions are/are not met could be problematic from a tax point of view. I know this would be the case in other European jurisdictions with which I am more familiar.

And here (from another HN link I just browsed) is other work CCC is doing, his time exposing a major security flaw in VW Audi Group security policies: https://cyberinsider.com/vw-suffers-major-breach-exposing-lo...

mschuster912• 2 years ago

The "Please note that the CCC e.V. is not formally recognised as a non-profit organisation" part is a bad translation - this one is related to the German tax code.

To put it short: there are two different kinds of NPOs, first "regular" e.V. and then those e.V. that fulfill exclusively "aims for the common good" ("gemeinnützige Zwecke", the full list is in §52 AO [1]) - they carry a special benefit: donations can be deducted from your income for tax purposes.

The CCC is a non-profit organization, but since it (among other things) engages in taking political stances while at the same time not being a political party, it is not seen as a "gemeinnützig" organization - a fate that hit quite a few organizations in the last years [2] or is looming over their head [3].

[1] https://www.gesetze-im-internet.de/ao_1977/__52.html

[2] https://www.campact.de/ueber-campact/der-verein/

[3] https://www.mdr.de/nachrichten/deutschland/politik/brandbrie...

ocschwar2• 2 years ago

I kind of envy Germany's large array of possible corporate charters for non-profits, for-profits and kinda-sorta-nonprofits. I wish America had the same menu to pick fro.

immibis13• 2 years ago

The CCC is a good organization to support anyway.

datavirtue2• 2 years ago

This is almost universal. If manufacturers are not already doing this they are planning it.

There is a lot of anxiety around the business model because a lot of the world is advancing and manufacturers are popping up everywhere with cheaper machines on offer. The moats are disappearing and durable goods manufacturers are clamoring for the next wave in the business model: subscription services for maintenance and support.

Ford has a connected fleet service offering that is picking up steam and could prove very lucrative in the commercial vehicle space.

A lot of this is rooted in an eroding labor pool that is lacking in bodies, training and experience.

This train fiasco is definitely bordering on criminal but it isn't far off from the wave of "progress" that is taking place.

niepiekm• 2 years ago

Newag is also after the Chairwoman of the Parliamentary Team for Combating Transport Exclusion, MP Paulina Matysiak and filed for revoking her immunity. She's been looking into the matter since the news broke last year.

https://transinfo-pl.translate.goog/inforail/jest-wniosek-o-...

devwastaken2• 2 years ago

we live in a post intellectual property age. its about manufacturing and resources now. it is overwhelmingly used to suppress upstarts and remove diverse competition in the market before they can get their legs. regulators go on to work for the companies they regulated. The conflicts of interest create an oligopoly that is more about lawyers than about engineering.

its time we repealed it all. no one gets to own an idea of the universe. especially not a faceless org created for tax purposes.

userbinator• 2 years ago

Sadly, I suspect discoveries like this will only cause other companies to learn from it --- by making it even more difficult to discover their "plausible-deniability" tricks, and hiding them under the guise of "security". Big Tech has been playing that game for a while:

https://news.ycombinator.com/item?id=36926276

https://news.ycombinator.com/item?id=24955071

neilv• 2 years ago

Can someone please summarize (for those of us who don't know the full story) why the government(s) that bought these trojaned trains isn't ripping the train vendor a new orifice, and pinning medals on the hackers who exposed this?

immibis13• 2 years ago

The governments are very capitalist and believe big companies should be allowed to do whatever they want.

sizzle3• 2 years ago

Is there a reason they aren’t slapping up a Bitcoin or ethereum or even monero wallet address for crypto donations?!

Seems like they are taking a stance against crypto? Why else not use this perfect new decentralized medium for financial support?

Dkuku• 2 years ago

I wonder why there are no lawsuits from the companies that had to pay to unlock the trains and did not get any documentation what was fixed/replaced to get it running (in 10min) especially that it was not a single train that had to be unlocked. It's like having ransomware on the plc.

They have not been trained for this

Related Stories