[HN Gopher] They have not been trained for this
___________________________________________________________________
They have not been trained for this
Author : hacka22
Score : 356 points
Date : 2024-12-27 18:19 UTC (4 hours ago)
(HTM) web link (www.ccc.de)
(TXT) w3m dump (www.ccc.de)
| sroussey wrote:
| I remember this story of "hackers" discovering that the train
| company disabled trains being serviced by competitors.
|
| It's a shame they are being sued.
|
| Hopefully, they raise enough to do painful and invasive
| discovery.
| aeontech wrote:
| Previous discussion, when it was first discovered - I am
| surprised there wasn't more:
| https://news.ycombinator.com/item?id=38893116
| lukan wrote:
| There is way more (see first comment)
|
| https://news.ycombinator.com/item?id=38788360
| terramex wrote:
| There was much, much more discussion here, e.g:
|
| https://news.ycombinator.com/item?id=38530885
|
| https://news.ycombinator.com/item?id=38567687
|
| https://news.ycombinator.com/item?id=38628635
|
| https://news.ycombinator.com/item?id=38788360
|
| & more
| dang wrote:
| Thanks! Macroexpanded:
|
| _Manufacturer 's Repair DRM Killed Train's Power, Broke
| Compressor_ - https://news.ycombinator.com/item?id=38893116 -
| Jan 2024 (2 comments)
|
| _Breaking "DRM" in Polish trains [video]_ -
| https://news.ycombinator.com/item?id=38788360 - Dec 2023 (51
| comments)
|
| _Polish DRMed trains stop as predicted due to date-based
| logic-bomb_ - https://news.ycombinator.com/item?id=38729035 -
| Dec 2023 (103 comments)
|
| _Trains were designed to break down after third-party
| repairs, hackers find_ -
| https://news.ycombinator.com/item?id=38638865 - Dec 2023 (233
| comments)
|
| _Polish Hackers that repaired DRM trains threatened by train
| company_ - https://news.ycombinator.com/item?id=38628635 -
| Dec 2023 (142 comments)
|
| _Polish train maker denies claims its software bricked
| competitor rolling stock_ -
| https://news.ycombinator.com/item?id=38570654 - Dec 2023 (2
| comments)
|
| _Dieselgate, but for trains - some heavyweight hardware
| hacking_ - https://news.ycombinator.com/item?id=38567687 -
| Dec 2023 (293 comments)
|
| _Polish trains lock up when serviced in third-party
| workshops_ - https://news.ycombinator.com/item?id=38530885 -
| Dec 2023 (360 comments)
| aeontech wrote:
| Ah! My search-fu failed me, I was looking for company name
| and for train hacking mentions, but didn't find all these!
| Thank you!
| jdiez17 wrote:
| I just donated 133,7EUR and will gladly do it again if further
| legal costs arise. Please consider also making a generous
| donation and post about it in this thread.
|
| What Newag is doing here is absolutely vile. They want to charge
| 20.000EUR per train to "reactivate" them after they have been
| serviced at third party workshops. We must not let them win and
| set a precedent.
|
| I highly encourage everyone to watch the previous presentation:
| https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra...
| SR2Z wrote:
| At 20k euros, would it not just be cheaper to hire some
| software people to jailbreak them?
|
| If companies that did this got jailbroken and blacklisted by
| the government, pretty much nobody would try this bullshit.
| None4U wrote:
| This ("software people to jailbreak them") is exactly the
| identity of the hackers who have been sued
| pantalaimon wrote:
| That's pretty much what happened and how this story came
| about
| kosma wrote:
| The company was a bit too much in bed with the government to
| begin with...
| atoav wrote:
| This isn't a software issue. This is a hackers-found-out-
| they-were-cheating-and-deactivated-their-train-DRM-and-now-
| these-hackers-are-getting-sued-issue.
|
| And getting sued by a train manifacturer is typically a
| asymmetrical battle for a private person. Consider watching
| the original talk (very entertaining and insightful, probably
| one of the best hacking related videos I watched in 2024),
| and if you like them toss them a tenner or so.
| trod1234 wrote:
| Rather than Cheating, don't you mean tortuous interference,
| followed by vexatious litigation?
|
| When you intentionally design systems with purpose to
| delay, but overall sabotage, you show malice and you
| defraud the purchaser (after-the-fact), you also interfere
| with their business with third-parties, and impose coercive
| costs that have never been acceptable.
|
| Coercion is generally not accepted by any civilized society
| that still follow its original founding principles, and
| coercion and corruption tend to go hand-in-hand.
| majke wrote:
| The firmware would need to be certified. They mentioned that
| in the q&a couple of minutes ago.
|
| Apparently its a critical component.
| conartist6 wrote:
| I couldn't figure out how to donate from their website. Where
| did you donate to?
| jdiez17 wrote:
| The payment information is a bit obfuscated, being only a
| parenthesized sequence of letters and numbers in the OP.
|
| IBAN: DE41 2001 0020 0599 0902 01
|
| BIC: PBNKDEFFXXX
|
| Purpose: Lokomotive
|
| Payee: CCC eV
| boricj wrote:
| > I highly encourage everyone to watch the previous
| presentation:
| https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra...
|
| According to the schedule [1], there's a presentation from that
| team titled "We've not been trained for this: life after the
| Newag DRM disclosure" that will start at 23:00 local time (in
| about 30 minutes at the time of this writing) on this
| livestream [2].
|
| Edit: presentation's over and it was outstanding.
|
| [1] https://events.ccc.de/congress/2024/hub/en/event/we-ve-
| not-b...
|
| [2] https://streaming.media.ccc.de/38c3/eins/hls
| lupire wrote:
| Is no one suing the manufacturer for vandalizing the trains?
| terramex wrote:
| > It was also revealed that the Polish Internal Security Agency
| (ABW) had, in October 2022, submitted a case against Newag
| regarding the abovementioned software manipulation incidents to
| the prosecutor's office in Nowy Sacz, which initially
| downplayed the incident until said findings publicly came to
| light, after which, the investigation was taken over by the
| regional prosecutor's office in Krakow on suspicion of crimes
| committed under Article 269 SS1 and Article 286 SS1 of the
| Polish Penal Code.
|
| > The Sejm's [Sejm is "the lower house of the bicameral
| parliament of Poland"] Parliamentary Committee for Combating
| Transport Exclusion subsequently convened three hearings
| regarding the abovementioned allegations on 17 January, 27
| February and 26 March 2024, whose participants included
| representatives of the Dragon Sector team, Newag, railway
| operators and members of the Sejm.[19]
|
| https://en.wikipedia.org/wiki/Newag#2023_revelation_of_softw...
|
| I could not find any later updates in polish media.
| praptak wrote:
| The latest update I found is [0] but there aren't any
| substantial updates about the criminal part of the affair.
|
| https://kolejowyportal.pl/dragon-sector-newag-wprowadza-
| opin...
| intunderflow wrote:
| No, and frankly if the Polish government won't do anything with
| this overwhelming evidence then they've got the train
| manufacturer they deserve.
|
| You can lead a horse to water...
| ryandrake wrote:
| Looks like train manufacturers are taking a page out of the
| playbooks of many other companies today. The practice of
| manufacturers remotely disabling products after the time of
| purchase (for whatever reason) is becoming a scourge in many
| other product areas. The device's manufacturer should have no say
| about how a product is used once money is handed over in exchange
| for it. This really has to stop. Regulatory agencies around the
| world are asleep to this problem.
| notpushkin wrote:
| Copyright is the root of the problem. More regulation could be
| a solution, sure, but is it really what we want?
| duxup wrote:
| I have no problem with some wide ranging law about right to
| repair.
|
| If that's regulation, yes please.
| TheSpiffiest wrote:
| Yes? Unless we want to let manufacturers sell us a vehicle
| but license the code that makes it run.
| trod1234 wrote:
| If businesses are unable to regulate themselves, it must be
| done by law.
|
| If copyright is the root of the problem, it may be time to
| remove that protection; or at least revert it so it is more
| in-line with patent law expiration.
|
| No more author's life + 75. Lets try 15-20 once again, and no
| derivative protection, unless significantly different,
| receive protection.
| sixothree wrote:
| You say this as if regulation for companies is a bad thing.
| Your entire existence is governed by regulations. Why should
| theirs not be?
| pkkm wrote:
| In this case, probably? I'm not a fan of excessive
| regulation, for this particular problem, I don't see how it
| could be solved without some kind of "right to repair" law,
| or at least a "right to be thoroughly informed about
| repairability before buying" law. Even if copyright was
| scaled back to 20 years and explicit registration, that would
| still be long enough to screw customers. In fact, even if
| copyright didn't exist, the problem would still exist for
| devices that are hard to reverse-engineer.
| junga wrote:
| > This really has to stop.
|
| "We", the totally homogeneous group of software professionals
| could make this stop. "We" don't.
| josefritzishere wrote:
| The CCC are heroes and should be celebrated as such.
| DaSHacka wrote:
| Not sure I'd go that far, though their efforts on matters like
| these are certainly appreciated.
| pmarreck wrote:
| What happened to the old moral rule of "if you explain to your
| mom what you are doing and she is dismayed, you are doing things
| wrong"?
|
| Because what Newag is doing very clearly violates it.
| shermantanktop wrote:
| Presumably that rule isn't profitable to follow, and so the
| prime directive (maximize money in any legal or quasi legal way
| possible) takes precedence.
| the_gipsy wrote:
| "to have a fiscal obligation (to your shareholders)" or
| something like that.
| atoav wrote:
| Newag is acting like the mafia here: "Wouldn't it be a shame if
| your trains stopped working..?"
|
| Not that I want to tell the Polish how to do things (I don't),
| but a satisfying outcome would be one where they found out
| precisely who gave the order to program Newag trains like that
| and then jail them. Add to their jailtime for each train that is
| found running the software and force Newag to do free maintenance
| on those trains.
|
| If Poland wants to show a hard stance on how to deal with people
| trying to fuck over the public to earn money that's as good as
| its gonna get. If Poland wants to tell everybody that fucking the
| polish public pays off even if there is overwhelming evidence
| that you did it -- ok.
| trod1234 wrote:
| NewAg is clearly acting with malice and sabotage in mind (as
| well as extortion), and when it comes to trains and railways
| this is not just a business matter, it becomes a strategic
| national security issue.
|
| "Wouldn't it be a shame if the trains filled with perishable
| food stuffs stopped working in route..., and the harvests rot"
|
| Do you know of any country where food security doesn't impact
| the government's ability to keep order?
|
| If any non-service operator, did this, like a third-party, they
| would reasonably be considered a terrorist organization, and
| the members of such a cohort should be treated as such.
|
| Even if the claim is made its only for small specific things
| which you had to agree to, its an inserted vulnerability into
| the supply chain that is both non-essential for regular
| function, which has been designed to be essential.
|
| At a bare minimum, they pave the way for such groups even if
| they don't act on it themselves.
| randunel wrote:
| > If more than the EUR 30,000 required to date is donated, if the
| legal costs are lower or if court costs are repaid, all payments
| received in excess will be used for the statutory purposes of the
| Chaos Computer Club e.V.. Please note that the CCC e.V. is not
| formally recognised as a non-profit organisation.
|
| That is one sure way to make people not donate to the cause. I
| want to support the people, but I don't want my money to go
| elsewhere, and there is no way of knowing how much has been
| raised to date or guarantees to get the funds back when the legal
| costs eventually get covered by Newag. The only guarantee stated
| is that they will definitely use money for something else. Not
| OK.
| lionkor wrote:
| an e.V. is by its very nature very non-profit-y. I am not an
| expert, so I encourage you to look up e.V. aka "eingetragener
| Verein", but basically, its similar to a nonprofit and a lot of
| rules and laws apply. Its not formally a non-profit in any
| country because e.V. is a specific German thing. You can,
| however, rely on that being very rock solid and not for-profit.
| jdiez17 wrote:
| That's a fair point and I had to re-read that sentence multiple
| times to understand what they are saying. They should indeed
| say how much money towards this cause has been received.
| saaaaaam wrote:
| I'm assuming they have to say this from a legal perspective. In
| reality what they are saying is "we don't know how much the
| legal fees will come to, could be less, could be more. However,
| once we have proper accounting, if there is money left over
| this will support CCC"
|
| I'm not familiar with German governance for quasi not for
| profits, but I suspect the idea that funds are conditional for
| one specific purpose probably breaches governance, and
| returning funds to donors if certain conditions are/are not met
| could be problematic from a tax point of view. I know this
| would be the case in other European jurisdictions with which I
| am more familiar.
|
| And here (from another HN link I just browsed) is other work
| CCC is doing, his time exposing a major security flaw in VW
| Audi Group security policies: https://cyberinsider.com/vw-
| suffers-major-breach-exposing-lo...
| mschuster91 wrote:
| The "Please note that the CCC e.V. is not formally recognised
| as a non-profit organisation" part is a bad translation - this
| one is related to the German tax code.
|
| To put it short: there are two different kinds of NPOs, first
| "regular" e.V. and then those e.V. that fulfill _exclusively_
| "aims for the common good" ("gemeinnutzige Zwecke", the full
| list is in SS52 AO [1]) - they carry a special benefit:
| donations can be deducted from your income for tax purposes.
|
| The CCC is a non-profit organization, but since it (among other
| things) engages in taking political stances while at the same
| time not being a political party, it is not seen as a
| "gemeinnutzig" organization - a fate that hit quite a few
| organizations in the last years [2] or is looming over their
| head [3].
|
| [1] https://www.gesetze-im-internet.de/ao_1977/__52.html
|
| [2] https://www.campact.de/ueber-campact/der-verein/
|
| [3]
| https://www.mdr.de/nachrichten/deutschland/politik/brandbrie...
___________________________________________________________________
(page generated 2024-12-27 23:00 UTC)