Jared Naude (140)
The team also found that if you open the cabin doors of the train and push the emergency button in the toilet. The train will unlock itself. #38c3
We've not been trained for this: life after the Newag DRM disclosure by Michał Kowalczyk (@redford), q3k, Jakub Stepniewicz #38c3
In the following meetings, they did not have a presentation slide so they bought paper slides.
DELAY. DEFLECT. DERAIL. 😂
This talk follows on from the talk last year about how trains have code that will detect servicing attempts. This was presented last year and this talk presents what happened afterwards. #38c3
The team reported the findings to the authorities. Deloitte also assisted with the audit. In December 2023, the team went public in Worsaw and then at 37c3 in Hamburg. #38c3
A journalist put out an erroneous article stating that the software was put on the trains by the hackers which is not true. Many other news sites repeated the false claims.
2 Lawsuits have been filed against the teams. The first lawsuit complains about software modification and that they broke the copyright, that they were incompetent. The first lawsuit is for 1.3 Million Euros. #38c3
It was found that trains were stopping at a certain train station that was close to a train workshop of the competitors. This was due to the GPS lock that was implemented. When they unplugged the GPS module, the issue went way. #38c3
The train should release the breaks and move forward when the throttle is pushed forward. However, once the servicing was done, only the brakes would release. After checking the cables and other parts, the company that was doing the servicing the trains knew that software was likely the issue and then contacted "hackers" to see if they could assist with the software issues. #38c3
It was found that the trains went through a software update before they went to servicing. Only the manufacturer could do the software update. There were several software locks and logic bombs that would detect if servicing was attempted.
It would detect inactivity if a train was not used for a certain period of time. It also checked serial numbers. It had geolocation locks and date checks. The trains also had secret key combinations to unlock the trains.
