News for hackers. Stuff that matters.
Re:Polish railway system hacked, trains forced to stop by at... by jacquesm on Monday August 28, 2023 @06:34AM (#37292088)
> Obviously in a factory people who are let in are vetted and authenticated to start with.

Factory workers are not vetted beyond being able to perform some function on behalf of the factory owners / operators. That can be as much as having finished grade school. On your first day you have the run of the place.

> Here we're discussing a radio transmission (from what I understand) in the wild that can come from absolutely anyone and anywhere and stop a whole train.

Oh no! Such radio transmissions have been the norm for decades and plenty of such older systems are still in use all over the world. Abusing such systems is easy. Upgrading them properly is costly and carries risk so the default is to leave things as they are.

> There is no reason for this not to be secured.

Well, why don't you propose a system that is 'secured'? And then I'll show you fifty ways in which your so called secured system can be 'hacked'. For instance, pre-emptively by stealing some of the gear.

There are fall-backs for all of those and the final fall back is flares and hand signals which every railway man hopes to never see in their lives. Fucking with infra is easy. Creating systems that are still just as safe but that are secure isn't easy at all: it is impossible. As every hacked website proves. And even if you could: the next thing that would happen is that these jerks would derail the trains instead of stopping them because that too is stupidly easy.

At some point we all rely on each other not to do bad stuff.

Re:Polish railway system hacked, trains forced to stop by at... by mytailorisrich on Monday August 28, 2023 @06:42AM (#37292146)
We know that a lot of our critical infrastructure is vulnerable, as this article again shows. This may have been "the norm" for decades but this has to be fixed. Unfortunately it often takes a catastrophe for things to be fixed.

At least here there was no catastrophe but still enough noise at a sensitive enough time that, again, I am sure that those systems will be upgraded.

Also, we're discussing securing infrastructure against threats up to state actors. They don't care about harsh penalties unless these are painful counter-attacks.

Re:Polish railway system hacked, trains forced to stop by at... by jacquesm on Monday August 28, 2023 @06:50AM (#37292197)
As far as I'm concerned the system worked exactly as designed. Nobody died, all trains stopped safely for a minute or so. Props to whoever designed the system and to all of those involved for keeping their heads cool.

What will most likely happen is that we will see more such acts of sabotage, against these and other systems.

Some suspects (Polish nationals) have been arrested:

https://www.i24news.tv/en/news/international/europe/16931682...