Slashdot Mirror
14-Year-Old Turns Tram System Into Personal Train Set
F-3582 writes "By modifying a TV remote a 14-year-old boy from Lodz, Poland, managed to gain control over the junctions of the tracks. According to The Register the boy had 'trespassed in tram depots to gather information needed to build the device. [...] Transport command and control systems are commonly designed by engineers with little exposure or knowledge about security using commodity electronics and a little native wit.' Four trams derailed in the process injuring a number of passengers. The boy is now looking at 'charges at a special juvenile court of endangering public safety.'"
I know some kids who are extremely bright, curious, and for lack of a better description, "like to experiment". Any one of these I think could have done the same thing, and with completely innocent (though mischievous) intent. For playing with such big toys in such a fashion there should be repercussions. But the kids I know who also could have done something like this would be much more on track with thinking about how they're moving switches than about what moving those switches implies.
However, I'm led to a different train of thought. What other systems are out there created in the same context, i.e., with little thought to external interference? I'm betting there are a "few". I wonder that in the process of designing something like this if we must pay more attention to the possibility of outsiders tinkering. I hope France's TGV has a bit more built in checks and balances than this. I hope the new Boeing 787 has more security built in than this.
I actually think (and hope) this kid's imagination and curiosity somehow gets channeled rather than squashed. He actually sounds like he could be a contributor. Of course, he's at least grounded for the next month.
It should be the enginners and their bosses that should be the ones facing criminal charges.
I have $20 that says at least one TV crime-drama-whatever show will have a plot where a bad guy tries to plot some train crash by messing with a TV remote, or better yet, video game controller.
This kid does deserve to get in trouble, though, big-time. You don't go around derailing trams, that's not cool.
I like basketball!!1!
Good thing he wasn't in the United States, where he'd be charged with terrorism, waterboarded, sodomized with a broom handle and thrown in Guantanamo Bay forever. The Department of Homeland Security would then increase the Train Flight Security Awareness Threat to Indigo, and the attorney general would trumpet the great work that the US Government is doing to prevent further Terrorist Train Derailments.
"What we elect to call imagination is mere combination of things not heretofore combined." - Frank Norris
Does it really take special security training for engineers to realize that controlling train junctions with TV remote controls (or close enough) might be a bad idea? Where's the whatcouldpossiblygowrong tag when you need it?
Here is the article in the Telegraph.
I particularly enjoyed the phrase:
As they then list two incedents since 1999 and the Boeing 787 concern.
A thistle is a fat salad for an ass's mouth...
Sounds like this kid was not adequately challenged by his school. At least that's what the story leads me to believe. If I was the judge I would let him off on the condition that he goes to a school where his curiosity will be encouraged but given enough direction so he doesn't get into more trouble.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Yeah, Poland is so backwards. In the US, we don't need teenagers to derail our trains.
Local authorities released this video capturing the culprits in their crime: http://www.youtube.com/watch?v=jiAk5vqvn3A
IANATE (I Am Not A Tram Expert), but if it was on RAILS, how or why would you STEER it?
Why is it that facility operators, be it trains, power plants, oil refineries, or anything have pathetic security, and when something does happen, they blame it totally on the perp who likely never had to confront even a single lock, much less a guard?
Makes me wonder if countries should have a special regulatory team whose job it is to attempt break ins on a regular basis to various areas, and levy fines to organizations failing compliance. Only problem is areas where people shoot to kill... telling a tiger team from a genuine trespasser/burglar/criminal before pulling the trigger.
This might be what gave him the idea in the first place.
In the US many places with newer traffic signal circuitry (at least on the west coast) have something called Signal Pre-Emption.
:).
This allows emergency vehicles to by-pass traffic lights by turning them green. It uses an IR transponder on vehicles, and an IR receiver on lights. When a certain frequency (pulse) is sent out from the vehicle and picked up by the receiver, the light turns green.
Before you try to build a device to do that I want to say 2 things:
1. Devices are available on the 'black market', and
2. Every time this signal gets sent, it gets recorded in a log. There have been cases of people getting caught using these and the fines are hefty.
The same system is used, called "Signal Priority" can be used by buses to hold the light green or trigger an early green in various circumstances. (Basically this involves sending out a frequency that's different from Emergency vehicles.
I bet that Lodz uses a similar technology for its trams, but maybe they thought nobody could figure it out, so they simply went with security via obscurity (or whatever the term for it is).
Czech Republic has a single system (as in same system type, not same transponders) in the entire country for its trams and trolley buses and uses something similar to your car key remote.
If anyone manages to figure out how the signal pre-emption works, please post details online
-Palal
Well, yes and no. Just give a bit of serious thought to the issue... I'm at work, have to AC.
It sounds as though the system worked of infrared pulse encoding, and that is why he could use a modified television remote. Imagine you are the one designing this (probably in the 1970's or 1980's...) It is generally desirable to keep things simple to ensure they actually *work* -- that is, having a rolling code that may be out of sync while having a signalling train hurtle toward the junction at 80 mph is not desirable -- you want a simple system that the train can activate if needed.
Anybody who has worked with security (my job) knows that the more layers you add, the harder (network) testing is, and the more ways something can go VERY wrong for a legitimate user.
If the train couldn't switch the junction box because it didn't have the right "password," you would also criticize the engineers.
I defend the train design -- this should be treated as sabotage, and is more along the continuum of putting a penny on the tracks or mechanically interfering with a junction box, things that are also dangerous, illegal, and difficult to defend entirely against.
...heinously vulnerable systems are the ones who should get locked up in jail.
Yeah, Poland is so backwards.
I know. in fact, they call RPN just "notation" !
--
"It is now safe to switch off your computer."
Tram line 21 runs east to west.
Tram line 19 runs east to west on 21's tracks, then turns onto a north-south track heading south.
Driver of 19 sets his left-straight-right turn lever to broadcast "right".
Kid overrides with a left, lead car turns left.
Kid stops overriding, the junction again sees the signal on the tram to switch to turn right, and the second car goes right, causing a derailment.
In the US, most remote junction switches have a fail-safe that prevents the tracks from switching if there's a car over the junction, thus preventing driver error or malicious external elements from causing a derailment by making the train go in 2 directions at once. Apparently no such fail-safe is present on the systems in Lodz (pronounced 'woodj' in Polish).
Is this not the rationale for penetration testing?
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
And my guess is the conductor normally controls these switches with remote... not the kid outside of the train with a hacked TV remote.
The whole safety department of that tram line should be fired. A system hackable via a TV remote and unencyrpted signals subject to relay attacks should not be deployed ever. They should be sacked for having allowed it. Same goes for the "traffic light" systems here in the US with the same flaws. Course I didn't RTFA so maybe he even cracked the encryption. In which case only sack the designer of the encryption.
Long ago, when sailing ships ruled the sea, this captain and his crew were always in danger of being boarded by pirates from a pirate ship.
One day while they were sailing, they saw that a pirate ship had sent a boarding party to try and board their ship. The crew became worried, but the Captain was calm.
He bellowed to his First Mate, "Bring me my red shirt!"
The First Mate quickly got the Captain's red shirt, which the captain put on. Then he led his crew into battle against the mean pirates. Although there were some casualties among the crew, the pirates were defeated.
Later that day, the lookout screamed that there were two pirate vessels sending two boarding parties towards their ship. The crew was nervous, but the Captain, calm as ever, bellowed, "Bring me my red shirt!" And once again the battle was on!
The Captain and his crew fought off the boarding parties, though this time more casualties occurred.
Weary from the battles, the men sat around on deck that night recounting the day's events when an ensign looked at the Captain and asked, "Sir, why did you call for your red shirt before the battle?"
The Captain, giving the ensign a look that only a captain can give, explained, "If I am wounded in battle, the red shirt does not show the blood, so you men will continue to fight unafraid." The men sat in silence. They were amazed at the courage of such a man.
As dawn came the next morning, the lookout screamed that there were pirate ships, 10 of them, all with boarding parties on their way. The men became silent and looked to the Captain, their leader, for his usual command.
The Captain, calm as ever, bellowed, 'Bring me my brown pants!!!'
This is a street tram switching system similar to the Elektroline system. It's not a full signalling system with interlocking. The tram driver is in control, and has an RF transmitter which can control switches. The current generation, the "TRAMVYS 6K", is an RF transmitter on 433.9 or 868.35 MHz. Normal range is very short, about 2M, with the transmitter down on the front truck of the tram and the receiver buried in the road. But it could probably be triggered by someone at the side of the street with a suitable transmitter. This system is interlocked so that the switch can't change position underneath a tram.
That's current technology. Older systems are much dumber. Some of this stuff is at the garage-door-opener level of RF devices. The Lodz tram system dates from 1898, so they have lots of legacy trackwork.
Four trams derailed in the process injuring a number of passengers.
;)
I know he hacked this together out of a remote control, but that's a horribly inefficient process he created - surely it's possible to injure the passengers without derailing the trams!
Is this not the rationale for penetration testing? It's better to have your lack of security demonstrated to you by a relatively benign agent before a truly malevolent one.
Which sort is this 14 year old who derailed 4 trains and injured people again?
I'm not saying his punishment should be harsh but he *did* do wrong here and knew or should have known that he was doing wrong.
New punctuation update "~" (no quotes) at the end of a line to indicate sarcasm. ~
Tram switches (or turnouts) are not like railway switches which are controlled from a central point. A tram switch is controlled by the driver of the tram either by a electromagnetic contact between the rails or by radiowaves. All tram switches may also be operated manually.
Now, I'm all for people driving the speed limit, maybe a little more. But legally, the speed limit is an upper limit, not a lower limit. And people who drive like the speed limit is just a guideline tend, in my experience, to be more prone to road rage than those who actually obey it.
Maybe you should consider a class in anger management. Or take a deep breath and put on some jazz music when you get in heavy traffic.
!#@%*)anks for hanging up the phone, dear.
http://www.youtube.com/watch?v=Quld5950v6w
Alternate video - http://www.youtube.com/watch?v=3lSaYx6ttuE&feature=related
5 lies about Poland (try not to knock the spelling - check your own) - http://www.youtube.com/watch?v=p67IVwRUilc&feature=related
Here's the kernel of truth underlying all those Polish jokes - most people can't seem to pull themselves up, so they choose someone superior to pull down to make themselves feel better.
Best luck to you.
Pathological kinda promises Path + Logical - but instead, you get stuck with pathetic.