News for hackers. Stuff that matters.
Re:Polish railway system hacked, trains forced to stop by at... by jacquesm on Monday August 28, 2023 @06:18AM (#37291969)
That's not how safety systems work.

Ever walked around in a factory? Those big red mushroom buttons everywhere actually work. Absolutely nothing is going to stop you from hitting one of them. It's not unlike the social contract: the assumption is that you too are kept safe by others.

Abusing such systems is the lowest of the low, and will get you in serious trouble. As would be sabotaging fire fighting equipment, arson, bomb threats, throwing stuff onto the highway and so on. The fact that you can't see any reason means that you are probably not in charge of safety anywhere. The battle is so asymmetrical that you can't win unless people stick to the assumption that their lives are valuable too. If that is no longer the case you are technically at war.

This is why suicide bombers have an easy time of it: they have broken out of that social contract and are willing to give up their own lives to take the lives of others. You simply can not effectively defend against this unless you are willing to throw out the social contract and become a police state yourself (or suffer eventual loss of life).

The minimum level of competence to run an important system (to put a train in motion, for instance) is definitely there. But to stop an important system should need no competence, it should just require presence and action. Any other requirements are not going to be secure (because too many people need to have access to such systems, including all of the public) but will cause the critical part to fail just when it is needed.

Re:Polish railway system hacked, trains forced to stop by at... by mytailorisrich on Monday August 28, 2023 @06:24AM (#37292014)
Obviously in a factory people who are let in are vetted and authenticated to start with.

Here we're discussing a radio transmission (from what I understand) in the wild that can come from absolutely anyone and anywhere and stop a whole train. There is no reason for this not to be secured.

I didn't claim that there should be a special competence to remotely stop a train, and indeed we may want something as simple as a big red button. But not anyone should be able to push that button and there should obviously be competence to run the system behind the scene as per my previous comment.

Re:Polish railway system hacked, trains forced to stop by at... by jacquesm on Monday August 28, 2023 @06:34AM (#37292088)
> Obviously in a factory people who are let in are vetted and authenticated to start with.

Factory workers are not vetted beyond being able to perform some function on behalf of the factory owners / operators. That can be as much as having finished grade school. On your first day you have the run of the place.

> Here we're discussing a radio transmission (from what I understand) in the wild that can come from absolutely anyone and anywhere and stop a whole train.

Oh no! Such radio transmissions have been the norm for decades and plenty of such older systems are still in use all over the world. Abusing such systems is easy. Upgrading them properly is costly and carries risk so the default is to leave things as they are.

> There is no reason for this not to be secured.

Well, why don't you propose a system that is 'secured'? And then I'll show you fifty ways in which your so called secured system can be 'hacked'. For instance, pre-emptively by stealing some of the gear.

There are fall-backs for all of those and the final fall back is flares and hand signals which every railway man hopes to never see in their lives. Fucking with infra is easy. Creating systems that are still just as safe but that are secure isn't easy at all: it is impossible. As every hacked website proves. And even if you could: the next thing that would happen is that these jerks would derail the trains instead of stopping them because that too is stupidly easy.

At some point we all rely on each other not to do bad stuff.

Re:Polish railway system hacked, trains forced to stop by at... by mytailorisrich on Monday August 28, 2023 @06:42AM (#37292146)
We know that a lot of our critical infrastructure is vulnerable, as this article again shows. This may have been "the norm" for decades but this has to be fixed. Unfortunately it often takes a catastrophe for things to be fixed.

At least here there was no catastrophe but still enough noise at a sensitive enough time that, again, I am sure that those systems will be upgraded.

Also, we're discussing securing infrastructure against threats up to state actors. They don't care about harsh penalties unless these are painful counter-attacks.

Re:Polish railway system hacked, trains forced to stop by at... by jacquesm on Monday August 28, 2023 @06:50AM (#37292197)
As far as I'm concerned the system worked exactly as designed. Nobody died, all trains stopped safely for a minute or so. Props to whoever designed the system and to all of those involved for keeping their heads cool.

What will most likely happen is that we will see more such acts of sabotage, against these and other systems.

Some suspects (Polish nationals) have been arrested:

https://www.i24news.tv/en/news/international/europe/16931682...

Re:Polish railway system hacked, trains forced to stop by at... by CaptainZapp on Monday August 28, 2023 @11:10AM (#37295339)
Ok, here's a different example.

Defilibrators, strategically positioned at places where a lot of people congregate. Such as train stations or city centers.

Herearound those are not locked. There's nothing stopping you of taking it out and toss it into the river.

The social contract is such that you just don't fucking do it and frankly, I never heard of such a thing happening. And yes, we have our shares of assholes.

Contrast that to the UK, where they are under lock and code. You call an operator explaining the emergency and she may unlock it.

There are two problems that I can see (and probably more). The communication device adds another layer of potential failure. And those two minutes it takes to unlock the device may be the difference between life and death.

I, for one, know in which kind of society I prefer to live. Even given the very occasional asshole who breaks that contract and abuses the accessibility of that life saving device.

Re:Polish railway system hacked, trains forced to stop by at... by mytailorisrich on Monday August 28, 2023 @12:36PM (#37296792)
You cannot compare access to a small medical device in public places to being able to stop whole trains remotely...