site banner
Obsidian  2yr ago (badcyber.com)   Edited 2yr ago   2458 thread views

The latest in industrial sabotage: geofenced passenger trains that fail when repaired in competitors' yards

badcyber.com

Some were also rigged to fail after a certain date or beyond a certain mileage.

20
Top Bottom Old Controversial Comments
Jump in the discussion.

No email address required.

The hackers have now presented at CCC.

With what is presented here, the fact that in some cases it was sneakier false failures of the secondary compressor component, the hidden nature of the faults, and the specific geofencing around opponents yards, I'd disagree with /u/Ioper and say there isn't much of a chance of it not being malicious. Trains are a strategic industry and I expect europe in general to come down like a pile of bricks.

This is the sort of stuff which grinds my gears. Newag should be sued until they collapse and the company has to be sold off completely to someone else, who will hopefully be less shitty.

I would be satisfied with responsible people being hit by large fines and maybe spending some time in prison (though not expecting this).

Yeah, to align incentives you do have to make the money come out of the people who made the criminal decisions.

Ideally also from companies who employed them (one can dream).

Prison time would also work, I guess, but overall in such case "you are losing 50% of your wealth, guess you are selling your flat and going back to renting" seems a good penalty to me.

(not that such outcome is likely)

The amount of losses incurred by this would be large enough that 50% might not actually even cover it. And going full-damages isn't unwarranted as a punitive measure either; this was nearly not caught, so any punitive measure has to massively exceed ill-gotten gains in order for it to be rendered clearly-negative-EV for the fraudster.

Sadly, courts in Poland love to give sentences like "you have stolen 2 million? 2 months of prison, without requiring to give defrauded money back".

I would take spending 2 months in Polish prison for 2 million.

special "command movement to slip in the back door"

Me to my patients when it's time to do a PR

The repair stuff could make sense if they are liable for something like catastrophic failures

this contract was intentionally constructed to decouple servicing overhaul and train construction, with manufacturer obligated to provide full servicing documentation

they lied, sabotaged train and tried to sabotage companies competing for servicing overhaul tender

they were caught by hackers hired by one such sabotaged company (with first hard proof delivered 43 minutes before servicing contract would be broken by train company)

Newag continues to lie and try to blame others.

but it could also be at least partially a mistake or ineptitude on the part of Newag

Yes, and there are indicators of this. But none of them reduce that all this is nefarious and hopefully illegal.

Trains were programmed to falsely report being broken down after specific date, or after specific number of mileage or after being repaired at repair yards run by competition.

This was not documented, Newag lied about it when asked and continues to lie.

Newag was nefariously sabotaging competition.

Is this a generalised system or tailor-made for each train/competitor?

Newag claims that this system does not exist, and if exist it was added by competition and it is not their fault.

Obviously, competition sabotaging repair service done not be Newag seems quite unlikely. Not sure why they went with this idea.

That might be possible but it's not stated anywhere in the article.

it was in some later articles, including some Polish ones and their PR releases

https://www.newag.pl/wp-content/uploads/2023/12/Oswiadczenie-NEWAG-06.12.2023.pdf

They are claiming they never introduced software that simulated failures and if it existed it was added by competition.

They demand withdrawal from service trains that were analysed, threaten legal action against SPS and people who analysed software.

they failed to communicate what this security system was

it was a not a security system

https://youtube.com/watch?v=XrlrbfGZo2k CCC publication is making situation quite clear, even if they do not take final step (because it is not fully 100% provable and they will likely end as witnesses in court cases, and what is clearly provable is damming anyway)

spicier bits include Newag making software changes to specific trains, two/three days before being send to be repaired at workshop of their competition ( https://youtube.com/watch?v=XrlrbfGZo2k&t=2369 ), not mentioning software updates in paperwork, train predicted to break down at specific date (due to bug in sabotage code) and then doing this...

overall great presentation, though quite technical (presented at hacking conference)

There's no plausible explanation for having data on the locations of repair shops.

"illicit" repairs at normal repair businesses? Might as well shut down the train if it's at the newag yard, could be some illicit activity going on there too.

This contract was intentionally constructed to decouple servicing overhaul and train construction, with manufacturer obligated to provide full servicing documentation.

Repairs done at repair yards of competition were NOT illicit, Newag lost bid for overhaul.

The repair stuff could make sense if they are liable for something like catastrophic failures, you really wouldn't want a someone else cheaping our on a repair in that case.

This can be rectified by entering a clause in the contract that if the train ever gets repaired by someone else they then become liable for all future failures etc., it's not even a big issue as the tender for repairs can include a term that the repairer takes upon themselves liability if any of the parts they repair later malfunctions and they bidders can price in the cost of this liability into their bids.

I want to understand more about what you're working with/where you're coming from.

shoddy black market repairs

As someone born in Poland with dual citizenship and spends 3 months of the year there on average, Poles execute the finest black market repairs in the world. There is a very high level of technical education left over from the communist era with a healthy disrespect for authority, also left over from the communist era. If I was going to have anything illegally repaired, I'd do it in Poland. (until recently Ukraine would have been #2, now I think its Czechia, maybe Slovenia)

The communist era ended 34 years in the past, mind you.

In six years, eastern Europeans will have lived without communism for as long as they've lived with it.

This contract was intentionally constructed to decouple servicing overhaul and train construction, with manufacturer obligated to provide full servicing documentation.

Repairs done at repair yards of competition were NOT illicit, Newag lost bid for overhaul.

What is this place?

This website is a place for people who want to move past shady thinking and test their ideas in a court of people who don't all share the same biases. Our goal is to optimize for light, not heat; this is a group effort, and all commentators are asked to do their part.

The weekly Culture War threads host the most controversial topics and are the most visible aspect of The Motte. However, many other topics are appropriate here. We encourage people to post anything related to science, politics, or philosophy; if in doubt, post!

Check out The Vault for an archive of old quality posts. You are encouraged to crosspost these elsewhere.


Why are you called The Motte?

A motte is a stone keep on a raised earthwork common in early medieval fortifications. More pertinently, it's an element in a rhetorical move called a "Motte-and-Bailey", originally identified by philosopher Nicholas Shackel. It describes the tendency in discourse for people to move from a controversial but high value claim to a defensible but less exciting one upon any resistance to the former. He likens this to the medieval fortification, where a desirable land (the bailey) is abandoned when in danger for the more easily defended motte. In Shackel's words, "The Motte represents the defensible but undesired propositions to which one retreats when hard pressed."

On The Motte, always attempt to remain inside your defensible territory, even if you are not being pressed.


New post guidelines

If you're posting something that isn't related to the culture war, we encourage you to post a thread for it. A submission statement is highly appreciated, but isn't necessary for text posts or links to largely-text posts such as blogs or news articles; if we're unsure of the value of your post, we might remove it until you add a submission statement. A submission statement is required for non-text sources (videos, podcasts, images).

Culture war posts go in the culture war thread; all links must either include a submission statement or significant commentary. Bare links without those will be removed.

If in doubt, please post it!


Rules


Recommended Posts And Communities

Recommended Realtime Chats