The situation is a heavy machinery example of something that happens across most categories of electronics, from phones, laptops, health devices, and wearables to tractors and, apparently, trains. In this case, NEWAG, the manufacturer of the Impuls family of trains, put code in the train’s control systems that prevented them from running if a GPS tracker detected that it spent a certain number of days in an independent repair company’s maintenance center, and also prevented it from running if certain components had been replaced without a manufacturer-approved serial number.
The problem was so bad that an infrastructure trade publication in Poland called Rynek Kolejowy picked up on the mysterious issues over the summer, and said that the lack of working trains was beginning to impact service: “Four vehicles after level P3-2 repair cannot be started. At this moment, it is not known what caused the failure. The lack of units is a serious problem for the carrier and passengers, because shorter trains are sent on routes.”
Very good article, I’d recommend reading it. I hope the court rules against NEWAG and sets a precedent for right to repair.
You must log in or # to comment.
deleted by creator
The word hacker doesn’t mean criminal. Hacking is not a crime unless you do something illegal with the skillset you have. They are just coders and reverse engineers. A hack usually means a quick fix.
In this case, if it is illegal, it definitely shouldn’t be.
deleted by creator
Then why’d you call them criminals
deleted by creator
Moron, note the air quotes. They’re using the term in a way to make fun of how the media consistently uses the word.
I have to wonder how long until society collapses
We’ll just hack it back into working order.
deleted by creator
I hope this NEWAG gets raked over the coals for this.
It’s outrageous to hold public infrastructure at ransom because the equipment spent X days in an independent repair shop - and pretty invasive to have DRM monitoring the train’s GPS location, and in some cases live reporting these back to the manufacturer to facilitate a remote lockdown.
Not to mention pushing an update to flag up a copyright warning on a screen in the drivers’ cab while the train is running 🤦♂️
I commend the engineer at the independent repair facility that had the idea to have hackers pick apart the train’s control unit, and the rest of the team for agreeing to it.
The mere fact that the manufacturer had a remote kill switch is the safety issue that should have a big spotlight.(edit: this is not the case - see the reply below) What if a malicious hacker decides to trigger that kill switch while the train is loaded with people and at a sensitive moment (e.g. on bridge/cliff with a huge drop).If the kill switch were in place for dealing with hi-jackers, perhaps fair enough. But having it for the purpose of business protectionism is an entirely reckless safety risk.
There’s an overlooked failure here: why doesn’t the Polish transport authority have a clause in their procurement contracts that bans trains with remote-control kill switches that are not under user control? And why wasn’t the code reviewed to catch that in advance? The hackers say they did not alter the code, which somewhat implies that the source code might have been available for inspection.
The GPS coordinates are especially damning. Also funny that the manufacturer is claiming they made the trains unsafe, since obviously once they uncovered the unlock code they can just use it on unmodified trains.
They did say the manufacturer removed the override key combination
It’s ridiculous, not only the manufacturers egregious behavior, but also the fact that there is software required to operate a vehicle without a mechanical override. If and when I am forced to own a car with such technology my first move will be to disconnect the entire module and install a proper starting and control system.
Man, just go back to normal trains and now computers with attached trains. Can’t hack or remotely kill what doesn’t have a computer in it.
Erm… There’s a lot going on inside an electrically powered train. Even a diesel engine has a computer managing fuel flow and diagnostics.
More importantly, you need networked computers to handle automatic train safety systems, a requirement in the EU from what I understand, after several notable rail crashes up to the 70’s.
