14-Year-Old Turns Tram System Into Personal Train Set

F-3582 writes "By modifying a TV remote a 14-year-old boy from Lodz, Poland, managed to gain control over the junctions of the tracks. According to The Register the boy had 'trespassed in tram depots to gather information needed to build the device. [...] Transport command and control systems are commonly designed by engineers with little exposure or knowledge about security using commodity electronics and a little native wit.' Four trams derailed in the process injuring a number of passengers. The boy is now looking at 'charges at a special juvenile court of endangering public safety.'"

Comments

Other Similar Systems: Signal Pre-emption

[Palal]

In the US many places with newer traffic signal circuitry (at least on the west coast) have something called Signal Pre-Emption.

This allows emergency vehicles to by-pass traffic lights by turning them green. It uses an IR transponder on vehicles, and an IR receiver on lights. When a certain frequency (pulse) is sent out from the vehicle and picked up by the receiver, the light turns green.

Before you try to build a device to do that I want to say 2 things:
1. Devices are available on the 'black market', and
2. Every time this signal gets sent, it gets recorded in a log. There have been cases of people getting caught using these and the fines are hefty.


The same system is used, called "Signal Priority" can be used by buses to hold the light green or trigger an early green in various circumstances. (Basically this involves sending out a frequency that's different from Emergency vehicles.

I bet that Lodz uses a similar technology for its trams, but maybe they thought nobody could figure it out, so they simply went with security via obscurity (or whatever the term for it is).

Czech Republic has a single system (as in same system type, not same transponders) in the entire country for its trams and trolley buses and uses something similar to your car key remote.

If anyone manages to figure out how the signal pre-emption works, please post details online :).

Re:Other Similar Systems: Signal Pre-emption

[Daniel_Staal]

Some places have a more inteligent system: The signal turns the light Red (in all directions), and the emergency vechicles just go through the red lights.

Works just as well, and less suceptable to hacks. (Not impossible of course, but less chance of people doing it for their own benifit.)

Re:Other Similar Systems: Signal Pre-emption

[cp.tar]

The downside to that approach is that emergency vehicles encounter cars stopped at a red light at every intersection. Where I live, drivers panic when an emergency vehicle approaches, move their car six inches towards the side of the road, and don't realize they should go through a red light to clear the roadway.

I've heard emergency drivers say: "If you don't know what to do and where to go when you see/hear an emergency vehicle, simply stop. It's much easier to manage your way around a halted vehicle than around one whose driver is panicking."

Re:Other Similar Systems: Signal Pre-emption

[jonbrewer]

Lodz has had electric trams since 1898 - and while it's not likely any of the original track or switches are in use, the system is not new. Turning at too rapid a rate will cause derailment. I've seen a fair number of older generation trams derailed on similar Polish systems, especially around the old town of Krakow. Somehow I doubt that Lodz have a spanking new fleet of low-floor trams that have required system-wide track upgrades to run. I imagine the trams that derailed were built in the 1960s.

As for the engineers being "grossly incompetent", I really don't think so. I wouldn't be at all surprised if the system hacked was decades old, designed by folks who had no reason to think that anyone would ever have the means or desire to circumvent the system.

(FYI those 1960s electric trains are far better transport than any diesel bus I've ever been on, and the new low-floor trams are like something out of a sci-fi movie!)

Re:Other Similar Systems: Signal Pre-emption

[sn00ker]

The downside to that approach is that emergency vehicles encounter cars stopped at a red light at every intersection. Where I live, drivers panic when an emergency vehicle approaches, move their car six inches towards the side of the road, and don't realize they should go through a red light to clear the roadway.

I've heard emergency drivers say: "If you don't know what to do and where to go when you see/hear an emergency vehicle, simply stop. It's much easier to manage your way around a halted vehicle than around one whose driver is panicking."

I definitely agree with the "stop" rule. Unless the only way they can get around you without having to cross a traffic island is for you to move your car, just stay the hell still!
I'm not a trained emergency response driver, but when I was in the Fire Service here I rode as front-seat passenger more than a few times in vehicles responding as urgent traffic. Emergency drivers know the dimensions of their vehicle, and they know its maneuvering limitations. They can deal better with your car being a stationary obstacle than a moving one, especially since they cannot read the minds of other drivers.

The other thing to consider is that most jurisdictions will not give a waiver of liability to a driver who goes through a red light to allow an emergency vehicle through. If you're in a crash, you ran a red light. You might be able to escape prosecution for a minor crash, but your insurance company is still going to hold you liable.

Re:wtf

[eebly]

Many tram systems have operator-controlled switches. In the old days (and still in some places, like Prague) switches are set by an operator manually. This system appears to basically be the same thing through proximity IR control.
On railroads, switches are mostly controlled from a central dispatch office.

Re:OK, I have to ask

[ThreeGigs]

Tram line 21 runs east to west.
Tram line 19 runs east to west on 21's tracks, then turns onto a north-south track heading south.

Driver of 19 sets his left-straight-right turn lever to broadcast "right".
Kid overrides with a left, lead car turns left.
Kid stops overriding, the junction again sees the signal on the tram to switch to turn right, and the second car goes right, causing a derailment.

In the US, most remote junction switches have a fail-safe that prevents the tracks from switching if there's a car over the junction, thus preventing driver error or malicious external elements from causing a derailment by making the train go in 2 directions at once. Apparently no such fail-safe is present on the systems in Lodz (pronounced 'woodj' in Polish).

Re:OK, I have to answer

[MistrBlank]

And my guess is the conductor normally controls these switches with remote... not the kid outside of the train with a hacked TV remote.

Yes, there's an RF remote for the thing

[Animats]

This is a street tram switching system similar to the Elektroline system. It's not a full signalling system with interlocking. The tram driver is in control, and has an RF transmitter which can control switches. The current generation, the "TRAMVYS 6K", is an RF transmitter on 433.9 or 868.35 MHz. Normal range is very short, about 2M, with the transmitter down on the front truck of the tram and the receiver buried in the road. But it could probably be triggered by someone at the side of the street with a suitable transmitter. This system is interlocked so that the switch can't change position underneath a tram.

That's current technology. Older systems are much dumber. Some of this stuff is at the garage-door-opener level of RF devices. The Lodz tram system dates from 1898, so they have lots of legacy trackwork.

Re:wtf

[imbaczek]

I live in Poland; news sources say that they indeed are under investigation.

Re:OK, I have to ask

[Hymer]

Tram switches (or turnouts) are not like railway switches which are controlled from a central point. A tram switch is controlled by the driver of the tram either by a electromagnetic contact between the rails or by radiowaves. All tram switches may also be operated manually.

Re:New terrorist plot for TV

[joebok]

Have you never had a train set? A switch will have one pair of rails on one side, and two pairs of rails on the other. If you are coming to the switch from the side with one pair, you won't get derailed - you'll just go to one or the other output tracks. But if you are on the other side of the switch it has to be set right to get your train back to the single pair side. If the switch is set to route traffic from the other side rail then you would derail if you didn't stop.

I'm sure there are visual indicators if you are heading into a situation where the track ahead isn't switched correctly (my train set had red and green lights), but it is easy to see how there could have been derailments if somebody was running amok with the switches.

Re:how many other "systems" like this?

[TamCaP]

I read on one of the Polish websites about this guy, and he contacted the local public transportation club and was asking way too many questions (either during a meeting or on a webforum). As he didn't join the club / pay the fees and he disappeared immediately, it seemed a bit awkward. When the trams started behaving strangely, the authorities suspected outside interference and contacted the club leader for any information. The club leader recalled this strange guy asking too many questions, and the rest is history.

Re:Leave it to the Polish!

[earlymon]

And not that I have anything aginst the Polish... No, of course you don't. Rather than flame, I'll try education. The original was taken down, these will have to do.

http://www.youtube.com/watch?v=Quld5950v6w
Alternate video - http://www.youtube.com/watch?v=3lSaYx6ttuE&feature=related
5 lies about Poland (try not to knock the spelling - check your own) - http://www.youtube.com/watch?v=p67IVwRUilc&feature=related

Here's the kernel of truth underlying all those Polish jokes - most people can't seem to pull themselves up, so they choose someone superior to pull down to make themselves feel better.

Best luck to you.

Re:Special security training?

[khobba]

As a Polish engineering student I feel strong urge to rotfl after reading this post...wait a minute...
...
...Done.

"good engineering practices" from the rest of the world??? Please mind, that good engineering practices usually develop when other parts of a good design and construction are limited or unavailable (e.g. money, materials, pre-made designs), so the engineers really have to think everything over to avoid excessive material loss. All of my professors say that when Poland was firmly behind the Iron Curtain engineers have been much better (aaah, those good old days...).
When someone was constructing, let's say, microwave transceiver, he could not use ready ICs from West Germany and newly designed MCX connectors from France or anywhere else due to embargo on modern technology and had to find his own way. That's why Polish electronic engineers were sometimes praised for their skills: if you've had access only to uA741 you've just had to be a good engineer to make anything of it (I mean designing any device using only operation amplifiers). Of course, in fact, they've had access to many kinds of electronic elements, not just opamps ;-) .
Some technologies, like, for example, production of HgCdTe detectors with epitaxial growth were developed in Poland (in 1980's) and became very popular across the world thanks to their low cost, because they were designed by people with constant lack of funds but with many ideas.
IMO, the poorer the country, the smarter the engineers and scientists. Poland has nothing to export but minds :-)

Perhaps security was a guard with a gun. - oh man, I won't even comment this...

after the collapse of the Soviet Union, there may not have been any money or drive to update the system. - I don't know how much of geography and history have you been taught where you live (if you're from US you may not even know the difference between Italy and France ;-) ), but it was Soviet Union that used to be draining goods and money from their satellite countries not the other way. Just think about it - what is the purpose of having a satellite country if you have to pump money to them not to your people?

P.S. Sorry for my English, I hope that you won't try to find corellation between my language skills and Polish engineers' "good engineering" capability.

And one other thing: weren't the early remote car alarm systems (from the same time that Lodz trams' automatic switching system was designed) easily hackable too?

Re:how many other "systems" like this?

[TamCaP]

Sure, they are quite popular in Poland (where I was born, and where it happened). Especially the more sophisticated ones (planes & rails) get lots of attention, however buses have a couple of fans too.
Bunch of guys renovated a little steam-train with their own funds and now are running it on an unused piece of track that they have fixed a bit by themselves too. All non-profit and stuff. Same goes for renovation of old trams or buses. I guess the price of any "cool" and relatively "old" plane (and subsequent maintenance) is prohibitive, because I haven't heard of any.

The rail enthusiast's website (the English version is very poor though).
Another one (Polish only).
Warsaw public transport enthusiasts website.

They guys there are very often people who did related stuff before but had to change profession due to transformation, or just plain enthusiasts.