Skip to main content

I can finally reveal some research I've been involved with over the past year or so.

We (@redford, @mrtick and I) have reverse engineered the PLC code of NEWAG Impuls EMUs. These trains were locking up for arbitrary reasons after being serviced at third-party workshops. The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parti
es.

1/4

@Michał Kowalczyk @mrtick
in reply to q3k :blobcatcoffee:

q3k :blobcatcoffee:
q3k :blobcatcoffee:
• •

We found that the PLC code actually contained logic that would lock up the train with bogus error codes after some date, or if the train wasn't running for a given time. One version of the controller actually contained GPS coordinates to contain the behaviour to third party workshops.

It was also possible to unlock the trains by pressing a key combination in the cabin controls. None of this was documented.

2/4

A Selectron CPU831 TCMS/PLC on a workbench, being probed and programmed.
Coordinates of a third-party workshop extracted from PLC, overlaid on a map.
This entry was edited (5 months ago)
in reply to q3k :blobcatcoffee:

q3k :blobcatcoffee:
q3k :blobcatcoffee:
• •

The key unlock was deleted in newer PLC software versions, but the lock logic remained.

After a certain update by NEWAG, the cabin controls would also display scary messages about copyright violations if the HMI detected a subset of conditions that should've engaged the lock but the train was still operational.

The trains also had a GSM telemetry unit that was broadcasting lock conditions, and in some cases appeared to be able to lock the train remotely.

3/4

This entry was edited (5 months ago)
in reply to q3k :blobcatcoffee:

q3k :blobcatcoffee:
q3k :blobcatcoffee:
• •

and @mrtick held an unrecorded talk a bout this at OhMyHack in Warsaw - I unfortunately couldn't make it because of Munich snow.

For now this is making the rounds in Polish-speaking sources, but we do have a talk scheduled about this at 37C3, in which we plan to do a deep dive into this and actually publish our findings.

@zaufanatrzeciastrona 's article about this: https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/

O trzech takich, co zhakowali prawdziwy pociąg – a nawet 30 pociągów | Zaufana Trzecia Strona

Adam Haertle (Zaufana Trzecia Strona)
@ZaufanaTrzeciaStrona.pl @mrtick
in reply to q3k :blobcatcoffee:

Kevin Karhan :verified:
Kevin Karhan :verified:
• •

Does any regulator know of this #Sabotage of #CriticalInfrastructure by the #Manufacturer?

I'm shure these trains ain't exclusive to to one country and regulators from @BNetzA and @kartellamt@social.bund.de to @EU_Commission will likely be very interested in such deliberate acts of #AntiCompetiton, #AntiRepair and basically attacks on #PublicTransport #infrastructure done by #NEWAG to fleece customers!

I mean, this is next-level assholeism and makes #JohnDeere and #Apple look like #RightToRepair fans.

#infrastructure #apple #RightToRepair #sabotage #PublicTransport #JohnDeere #criticalinfrastructure #manufacturer #antirepair #newag #anticompetiton @European Commission @Bundesnetzagentur
in reply to q3k :blobcatcoffee:

bob.php :veritrek_gold:
bob.php :veritrek_gold:
• •
oi, if i extrapolate the level of fuckery happening here to an american train, i can only assume our train drivers aren't actually driving the train but just pushing a 99c button over and over and over to keep it moving.
⇧