Case Of The Sabotaged Trains | Prime Reacts

[@Efim141]

In US it would be coded to break down after one million miles instead of kilometers. That’s why US trains are more reliable.

[@chigozie123]

😂 you win lol

[@TheIridescentFisherMan]

Actual Gold>

[@ped7g]

It's almost 61% kilometres more without breakage! This is the first time I see some advantage of imperial system...

[@TKDMwastaken]

After so many years... One advantage of imperial system over metric.

[@TricksterRad]

Inb4 they actually set it to half a million miles

[@maciekjedlinski1832]

The funny thing is, Newag has released a statement where they claim that their trains must have been hacked and tampered with, denying all the responsibility for the software locks. My theory is, they just do not want to admit that they lack the skills in constructing IF statements.

Similar to what VW did. Passing the blame... The engineers did it without consent from managers :))

[@Wlerin7]

"Newag also claimed there is no proof they are the author of the software and that claiming they are constitutes slander." Bloody hilarious.

[@TheNewton]

Regardless it needs to be international law for infrastructure systems to have redundant human control. Software locks disabling infrastructure shouldn't be a possibility in infrastructure without regulatory approval.

[@GonziHere]

@@TheNewton why infrastructure? why not everything? The trend of having more and more things that can be essentially bricked by your cloud account, or a service that closes down, etc. is very scary one to me. Your phone is marvelous piece of engineering, that you can basically throw away if google/apple closes down the shop. Your smart home might simply stop working because it's on a closed protocol and company doesn't support it anymore. Your car might have trouble with some validation and disable your extra features... Hell, recently, I was about to buy a router and I didn't, because it was configurable ONLY from an application. Not from a web interface, that will be working in 20 years... from an app that might not get the support and be unlaunchable 5 years from now... how is that ok is beyond me.

[@MindBlowerWTF]

@@GonziHererailway is classed as critical infrastructure in Poland, so anything done that harms it should be judged as sabotage of Polands defense system. I think this is a good starting point, we can get Google and automotive world later. But we probably won't looking at there is not much done against smallish train manufacturer.

[@ruannascimento5732]

18:26 > call the repair team because of a train malfunction > the repairman arrives > he enters the pilot's cabin and input the Konami code > refuses to elaborate > leaves > the train start running again

[@TonKcedua]

"Hey, I know it's an issue with a train part located in a completely different location than the cabin, but could you leave me in there alone for like, 5 minutes?" /5 minutes later/ "That'll be $10k for the repairs, thank you very much!"

[@ChrimleOfficial]

Spot on!

[@BudgiePanic]

These guys were scheming 🤑🤑🤑

[@SabbraCadabra11]

As a Pole, listening to Prime attempting to pronounce Polish names is absolutely hilarious

[@ihnatklimchuk1018]

I want him to pronounce all Wrocław street names. HILARIOUS!

[@etcher6841]

You go ahead and try to pronounce them then!

[@nexovec]

Pole...lol Nice to meet you pole get ready for a tough birdie to swallow in this video. (just kidding bad humor I know)

[@FufsowyFufs]

Can absolutely confirm, rewatching just for prenounciations

[@lukaszmatuszewski]

I want him to read Warsaw metro station names.

[@krzysztofrozbicki1776]

Just to add info - it is propably not the skill issue, nor the "bad if statement" but it was popably an illegal backdoor making the company to have monopoly for servicing the trains - now polish prosecutors are saying - quote: (translation) "Our findings indicate intentional interference with the software and the introduction of blockades that immobilized vehicles for many days" And if it weren`t for the Dragon Sector hackers propably all repair contracts with other companies would be broken (as it was supposed to be) and Newag (manufacturer) would get the repair deal $$$

[@TheNewton]

Intentional Sabotoge of Infrastructure that will get argued as legitimate DRM.

[@MindBlowerWTF]

to make it worse - one of these trains operated by different railway operator was fixed by Newag before all of this surfaced and Newag refused to let the operator know what was wrong that the train refused to run after replacing a part.

[@TDOBrandano]

To be fair, it's embedded code so you don't really get the benefit of stuff like datetime classes, but you should still have integer multiplication. So you could check if Year*10000+Month*100+Day is greater than 20211121. But if you are looking for coders that will agree to do something illegal you probably have to make do with what you can get.

[@harpoonstheman1559]

@@TDOBrandano Clever idea. I'll have to remember this one to avoid nesting IFs.

[@Nik6644]

@@TheNewton the trains were sold as "serviceable by third parties". that's why they provided a maintenance manual...

[@QrchackOfficial]

The best part, the train broke again on Dec 21, only to fix itself magically on Jan 1, because of the if statements skill issue. It breaks precisely from Nov 21 to Dec 1, and Dec 21 to Jan 1, every year.

[@LordPhobos6502]

International Compressor Failure day strikes every year :P

[@U-D13]

The guys also gave a presentation at 37C3, what I gather is the German rival to DEF CON 31, with more salient details and answers to audience questions: kzbin.info/www/bejne/jqPPo5WcfL-iaM0

[@tubeincompetence]

Thanks. My first thought was "I saw a presentation about this yesterday". :)

[@overdev1993]

this, what a great talk

[@LorenzoLeonardini]

This talk is really great. (CCC is 10 years older than DEF CON, and having been to both this year I can say they are extremely different)

[@NithinJune]

this was a _reaallyyy_ good talk

[@BundesNachrichtenDavid]

DEF CON is a rival to the CCC, not the other way around ;-)

[@anj000]

29:35 this one is CLEARLY malicious as well. He completely missed the fact that software was programmed to artificially report a fault on a specific date, even when hardware was perfectly fine. Like, idk, if iPhone would artificially lower your battery life after exactly 3 years? The problem was not that the if statement was badly written, but that such condition was created in the first place.

[@Takyodor2]

These European "bugs" may or may not be "inspired" by "features" found in American phones.

[@blindfsh6093]

​@@Takyodor2imagine being this delusional

[@Takyodor2]

@@blindfsh6093 Who are you calling delusional; me? OP? Prime? The train company/Apple thinking they could get away with it? Consumers of Apple products?

[@thekwoka4707]

I think you didn't understand the jokes being made. The attack was malicious, but also it didn't work correctly because the developer was bad at dates/if statements. (unless the goal was to have it break down every year from november to january.

[@anj000]

@@thekwoka4707 I didn't negate anything about bad date comparison. Yes, he was making jokes, but he was also hesitant to call this part malicious, thinking that this was just an accidental bug.

[@mervstar]

I think the EU's right to repair laws are applicable here. This should be very illegal by the train manufacturer.

[@catcatcatcatcatcatcatcatcatca]

It actually might not be, because older laws of market regulations would be applicable. This could be argued to be similar to just paying someone to go out and actually sabotage the trains during night, or to beat up employees of your competitors. Conspiring to directly cause malfunctions, and conspiring to sabotage the work of your competitors has always been illegal. They never disclosed that they will remotely disable the train if service is attempted by any other entity when selling the train. That would be a right to repair issue. Just like you can’t hire saboteurs to enforce your vendor lock, you can’t cause failures in the facilities of your market competition.

[@DMSBrian24]

EU laws don't even matter here, this breaks probably at least a dozen of Polish laws already (in addition to violating the original contract in the first place), some suggest this might even be domestic terrorism. The prosecutors are already on their ass and they're not getting out of this easily.

[@NickSteffen]

I think a big one is something called tortious interference. If you interfere with someone else’s contract you can be liable for damages. Another would be various forms of fraud. As in your selling a train that is explicitly required to be maintainable by third parties but you’ve secretly attempted to make that impossible. Another clear case of fraud would be the reporting that a part is broken when it isn’t in attempt to get repair money. There’s probably like a hundred different laws broken here. That’s before we get to anything involving harming competition.

[@martenkahr3365]

@@NickSteffen Keep in mind that Poland is not in the most peaceful region of the world and has one particularly hostile neighbour. What happens in wartime, if these "safety features" cause Newag trains to remain broken down in maintenance facilities other than their own despite not having nothing mechanically wrong with them? That sounds like an express journey to treason or sabotage charges for a lot of well-paid people in Newag, at a time where the courts tolerance for delusional legalese interpretations of the facts will be at an all-time low.

[@Eugensson]

As part of the tender Newag must have provided ALL documentation needed to run and maintain the trains to the train operator. They clearly didn't.

[@Innengelaender]

I think you missed the point of the date-skill issue. That was absolutely sabotage. The train was clearly intended to break down on the day it was scheduled for its next maintenance and it only materialize exactly one year late due to a skill issue of the programmer (not accounting for all cases when comparing dates).

[@ElTodoGrande]

That date seems very close to the beginning of russian invasion of Ukraine

[@pirat87pl]

Update: This train broke down AGAIN on 21.12 😂 Exactly as expected.

[@NeunEinser]

@@pirat87pl It's the national compressor failure day in Poland.

[@sciencedude22]

@@NeunEinser *International compressor failure day.* Newag sells trains outside of Poland. 😬

[@NeunEinser]

@@sciencedude22 As far as I know, only a single train has the software version that fails the compressor on those two days, which happens to be a Polish one. But I could be wrong.

[@10produz90]

The train running for a whole extra year because of an IF statement skill-issue and lucky timing is just so funny

[@fledi2]

The article doesn't mention it, but the way the ifs are written it actually broke down on November 21 as well as on December 21 which was definitely not intentional

[@TricksterRad]

@@fledi2 well the intent was for it to not work after Nov 21 2021, but the way the check was written, it would only not work on Nov 21-30 and Dec 21-31 since year 2021, but it would run fine for the rest of the year.

[@jus4795]

@@fledi2 And were good to go on their own by the end of those months ;)

[@snooks5607]

29:02 whatever excuse you could come up for needing to lock the train doesn't matter -> the manufacturer never told anyone about the conditions, even while this was going on and in the national news, thus it was obvious intentional sabotage

[@ChamplooMusashi]

just to add one more tidbit: this should be a serious security concern for governments. imagine if this were reverse engineered by hostile governments in wartime and a remote signal set the time in the internal system to the killswitch time? this is why we can't have remote killswitches in anything as critical as a car or train

[@thewhitefalcon8539]

Your car not only has a remote killswitch, it also figures out who you're having sex with. The EULA says so.

[@goraxe01]

It's not just governments check out the wanna cry killswitch... And the story of what happened to the dude that found it. Stuxnet is also pretty wild. There's also asymmetric capabilities ie N. Korea pwning Sony while the country only has a single class c ip range so has miniscule attack surface. Iot devices have laughable security as well, who knows how much spam has been routed through your light bulb...

[@Midaspl]

Well, it was not a killswitch you can send, but rather planned failure. Anyways, all new trains have remote killswitch called radiostop and russians have been sending it in Poland constantly since the start of the war in Ukraine.

[@Emil_96]

"What's the millimeter, is that like an inch?" - that statement shook me to my core

[@RIP212]

He obviously joking :)

[@januszlepionko]

I wonder if that guy knows that US imperial units are defined in terms of SI units.

[@gonun69]

Come on he's only off by a factor of 24.5

[@stubb1qaz]

Trains are critical infrastructure so under Polish law incapacitating trains is legally considered treason. One of the highest crimes.

[@cprn.]

Not trains. Railway tracks only. It's article 254a of Polish penalty code.

[@krzysztofmeler]

Trains are also includded in this article of penalty code.@@cprn.

[@delayed_control]

"What's a millimetre, is that like an inch?" American education system at its finest...

[@chigozie123]

Well, when your smallest unit of measuring length is inches, it kinda makes sense 😂

[@katrinabryce]

@@chigozie123 They have the point. There's 72 of them in an inch, so 1 point = 0.35277... mm. It is quite commonly used for measuring text size. 72 point text is 1 inch high, measuring all the space the text takes from the lowest to highest point of the entire character set.

[@Reydriel]

@@katrinabryce Who is the person that decided to subdivide things by such a random ass number like 72 lmao, whyyyy

[@katrinabryce]

@@Reydriel Francesco Torniella da Novara, in 1517.

[@FufsowyFufs]

In europe we have specific laws that prohibit monopolistic behaviour, I'm sure they can find grounds for a lawsuit.

[@vytah]

A likely lawsuit will be about failing to fulfil the contract, and/or sabotaging critical rail infrastructure, the latter with potential prison sentences.

[@pirat87pl]

This is not even going to be a lawsuit - it's now a criminal case due to trains being critical infrastructure.

[@_MB_93]

Finding the root cause of this is truly a miracle... I'd just quit programming if I'm to investigate this monstrosity

[@_MB_93]

I mean 10 years is just too short, I usually just set the date variable to 2099 and hope everything is dead by then

[@krzysztofmeler]

Follow up: in PL parliament there is a commission responsible for investigation of this case of Newags' breaking trains. DS created ~50 minutes presentation about this case for commission, Newag created counter presentation. Their representatives were talking for ~1,5h about third-party servicing companies not cleaning toilets properly and did not provide the answer on how GPS checking statements appeared in trains' software. Commission members were clearly pissed off by Newag representatives.

[@blenderpanzi]

Now the train manufacturer is sueing the hackers. Absurd.

[@Rockyzach88]

It's all part of business. Corporations/businesses have gas lit regular people into thinking that collecting on damages is bad and yet everyday businesses do it constantly.

[@complexity5545]

Really? This can't be true. LoL

[@blenderpanzi]

​@@complexity5545 That's what always happens, sadly.

[@ElektrykFlaaj]

they are suing them, but will lose the case, i can guarantee

[@marsjaninzmarsa]

​@@complexity5545yeah, with the claims that decompiling software was "an EULA violation"… 😂😂😂 But sorry, bro, reverse engineering properly owned tech is PERFECTLY LEGAL :DDDD

[@litium1337]

Two options: Either this lock was put in as a weak safeguard of the software IP, so it stops working if a competitor gets its hands on it for "too long", but I kind of doubt this. Or more likely to maliciously get rid of competition for the service and maintenance contracts, which often has way better margins compared to manufacturing and delivering the actual hardware. Source: work with similar stuff, but on water instead of rails.

[@Nik6644]

wtf is wrong with chat trying to defend this behavior "if you dont get maintenance, people might get hurt" - the trains broke when they tried to maintain them. the train was basically sabotaged to break when it was being maintained... like how does that make sense?

[@ChamplooMusashi]

out of all the places they could put them, they put the intern on the secret sabotage code

[@alexaneals8194]

You have deniable plausibility. They just didn't know what they were doing.

[@U-D13]

That code nerfs the secondary air compressor for the pantograph, only relevant when the primary one has been powered down for an extended period (as when the train has been offline for repairs). Secondary, hence, "meh, let the noob do this one".

[@thekwoka4707]

@@alexaneals8194 Hey, could you write up a test case where when the Km is over 1million we say the compressor is bad, to make sure the odometer system works correctly? Thanks. *merge*

[@devdanielrs]

At least their try/catch skills are better than their IFs. They tried, and got caught.

[@gregoriodia]

Lock after 10 days means lock if maintenance is happening. It will always take more than 10 days due to nature of work performed and multiple 3rd parties involved.

[@kenny-kvibe]

"Imagine you are so bad at constructing IF statements that the police got called" made me laugh so hard hahahaha

[@diegolikescode]

Funny seeing americans seeing other's country measurement standards. Showing the good ol' "WTF IS A KILOMETERR" vibes right now.

[@Rockyzach88]

Plenty of Americans use the metric system, just not the general pop. It's times like these the distinction between computer "scientists"/software engineers and other STEM professionals becomes very apparent. In natural sciences like chemistry and physics we use the metric system all the time.

[@LukeWatts85]

SNL did a great skit on this about a month ago kzbin.info/www/bejne/gIrUl4l7Ysusoc0

[@januszj444]

@@andyk2181 but you should add, that proper kilo, not 1024 :)

[@Draggeta]

​@@januszj444that is officially now a kibi, kilo is reserved only for 1000 and nothing else

[@colemichae]

It's 100 carriages don't you know :)

[@jovialcupid9687]

And to add % that they did it, here few things u missed: - they changed codes (this one in control room where u pushed buttons in right sequence like in gta) after ppl discovered it - code isn't possible to download from board - if somebody would change assembly it would leave SO MANY trails and none was found - a lot of "bad things" didn't found place on 20K book (it was too short!) - if somebody would change this things (externally but while having source code) he wouldn't made such easy mistakes like writing GPS coordinates without encryption (it's littelary 3 lines of code) - all of changes were in favour of producent of code And idea that is was just a mistake/old parts of firmware is so dumb i don't even will give any argument against it.

[@Bravo-oo9vd]

There was a a parliamentary hearing about this matter, and NEWAG's layers didn't respond to this evidence at all. Instead, they've shown a presentation with pictures of badly done train maintainance saying "these are our trains serviced in third party repair shops". There were a few pictures of messy clean interiors, and a few of dirty and open toilets. The only thing they've said about these if conditions that break the trains was "train software was illegally interfered with, and it wasn't done by us, we've informed the law enforcement". What's funny is that there was one train that one train operator actually brought to NEWAG for maintenance, but its software was earlier dumped by the researchers, and after NEWAG given back the train they dumped the software again and found NEWAG did a software update which included additional train lock conditions. They're not getting out of this one.

[@josh3771]

The directors of Newag need to be arrested and made to face trial. This is criminal on so many levels

[@PLwitcher222]

Update from janurary 2024 : polish parliament itself started an investigation, Newag stock is took a 10% hit (and it just started)

[@WojtekPoroslo]

Prime pronouncing "Polska" is everything

[@12crenshaw]

That's a beauty of government contracting. You can't scam polish government without having uncle there because they'll contract whomever gives lower price and you already know we have those nerdy basement guys that will fix anything for a dime and a half

[@PointlessMuffin]

"There is extra thing hanging out of e" 🤣

[@mrrolandlawrence]

train maintenance is like aeroplane maintenance. you have schedules for parts checking / replacements. you dont wait for them to fail.

[@uni-pl]

Polska ogląda Primeagena

[@uis246]

Россия присоединяется

[@bary450]

polska gurom 🇮🇩

[@streettrialsandstuff]

The way he butchered the names is priceless 😂

[@SlipperyShinobi]

They had a panel/talk on C3 2024. Its called hacking polish train drm i think

[@Ticklestein]

You're still missing the context that the first trains to break down had Over The Air firmware updates days after the Lower Silesian Railway - SPS maintenance contract was signed...

[@nightspicer]

Gotta love how my country is one of those that get mentioned only when something insane has happened, or WW2 is brought up

[@szonmcmiszon557]

As a person from Poland i love watching people from other countries try to read polish names of citis or names or surnames.

[@yuris10101]

the way he read "Wroclaw" made my day 🤣

[@radomaj]

War claw

[@diabel44]

We polish find it really funny to listen to foreigners trying to pronounce polish names :D

[@kon-jakub]

Just imagine another skill issue kicking in during full speed ride on one of the Newag trains. It just f-ing dangerous. Authorities should make this case an examplary one for other companies, just to warn them. But we all know nothing like that happens in the foreseeable future.

[@moonasha]

I imagine Louis Rossman would have a conniption fit if he read this article. Boy is that dystopian

[@yjlom]

oh he did

[@katrinabryce]

Not sure if it was this specific article he read, but he did a video about it on 6th December (UK time zone, may be a day either side in your time zone).

[@benbowles]

As someone who loves trains and computer science, this is the perfect article that tickles my brain.

[@VinceOfAllTrades]

There's also some really scummy stuff with HP locking out printers for a variety of ridiculous reasons.

[@Reydriel]

I can't believe how long they've been (and still are) getting away with that BS. Trying to use my own fucking HP printer is a bigger hassle than just going to the local stationery store to do it (and is probably cheaper too!) lmao

[@zebraforceone]

These are clearly back door kill switches lol Based on the statement that all the trains had slightly different software, I expect the date check is a "custom" build where they just slapped in a date they felt like it should come in for "repairs" $$$$$

[@goraxe01]

If they get fancy they might start using TPMs to verify the rom image preventing loading moded firmware. Sounds like main hurdle for these guys was dumping the firmware, then getting docs for the instructionset to write disam tools, then standard reveng in Gihdra (open source reverse engineering tool from the NSA) stackoveride (yt channel) has some good intro vids, $20 ~ $40 for a jtag / swd tool probably less than $100 for an oscilloscope over USB for signal capture for wire level decoding... Couple of $4 ~$10 SBC boards to practice dumping firmware on (most chips outside of x86 are not to hard to get your head around)... Main issue is having the time and patience to read docs and scratch head until the eureka moment

[@mloskot]

"American mind can not even comprehend this" - haha! The Wild West was not where you think it was Mr @ThePrimeAgen The Wild West was, is and will be to the East from NY

[@TheFreeSpiritKID]

The name is the PooSeeTheStroy-agen

[@The1RandomFool]

I've heard of other companies like Apple and John Deere that do things like this, too. Although not to this extent. They will disable your product if you attempt to repair it with 3rd party parts. Or if 3rd party tools are used.

[@thekwoka4707]

This is true. John Deere lost the cases on it, but it also was part of the initial sales contracts. Apple's is a bit sketchier as to whether it would totally be allowed. Mostly they just argue it's to dissuade amateurs from trying to do home upgrades and breaking the devices. But bricking them is hard to defend. Voiding the manufacturers warranty is still generally allowed (to a point where specific component defect can't be pointed to), which does make sense. If you tear open your macbook, and slap some other stuff in there, and then something goes wrong, it's reasonable to say that you'd need to pay for the repairs, or at least the diagnoses.

[@Midaspl]

The difference is, tractors and macbooks are not considered critical infrastructure like trains are.

[@NikolaNevenov86]

Honesly, the only reason we learn of this, is because the train manufacturer, went all out. If they didn't block the trains, when serviced at ALL possible alternative repair shops, no one would had learned thar there is code for planned failure.

[@thekwoka4707]

It seems like it wasn't all of them. The article seems to imply that different trains had different failures in them, instead of all being on the same exact software. So it would be a simple attempt at making the breakdowns appear more "random" and unexplainable. But having EVERY train end up with unfixable maintenance issues that break the other shops contracts when the manufacturer can then fix them quickly and never say what was wrong....that would still be suspicious. But they should have done more to make it more progressive. Like "we have one that just doesn't work, for a year...wtf, okay, just pay to have the manufacturer look at it". Having it start hitting many trains, especially many at the same shop at once is too suspicious.

[@Stay_away_from_my_swamp_water]

Those ifs probably looked better in code, that's how they look like after removing all the abstraction.

[@Takyodor2]

Still broken and still sabotage though

[@2EOGIY]

Imagine that train stops for 10+ days to get graffiti cleaned. Rag and soap used on windows break computer.

[@katrinabryce]

Or if they are doing work on the tracks, and it sits doing nothing for that period.

[@marflitts]

@@katrinabryce But only if its in the vicinity of a competitors workshop.

[@Takyodor2]

Windows break computer

[@katrinabryce]

@@marflitts It is quite normal to keep trains at a workshop overnight, they do nightly inspections and regular cleaning / maintenance.

[@2EOGIY]

@@marflitts originally it was just stop anywhere. Trains gets locked on the side tracks at train stations. After too many reports producer updates firmware to geofencing

[@Karol-g9d]

the worst part ? The issue was present when train came out of factory . Till train is shut down and battery reach a low enough treshold or when train is improperly started sequence of starting is not followed . Nothing is easy to fing aside from engine noise

[@Zac2241]

What's crazy is soon cars and parts of smart houses are going to have these vendor locks if they don't already 😮

[@chigozie123]

Who's to say cars already don't have this? I've even thought about this for food products. The fact that they can so accurately predict when milk will go bad, even if the milk is stored refrigerated, is quite suspicious.

[@streettrialsandstuff]

The cars already have vendor locks. I heard a story about a guy replacing a headlight and got into a serial number locking.

[@goraxe01]

They do, there was an LTT linus installed a hundred smart switches in his home... The day after the manufacturer released firmware which closed 3rd party access to them locking them to the manufactures cloud half of them had updated. BMW sell cars with subscription heated seats, like all the hw is physically in the car but it needs to phone home to make sure you paid to turn on. VW had the software to detect when they were being emission tested and reduced its diseal emissions while under test (most eu countries have strict car emission rules and after warranty are required to pass tests to be road legal, every year) Bowing 737 max where they thought they could hide the fact the engines were too big for the frame in software. Reduced the normally dual redundant airflow sensors to one, while footnoting the 'aided flight override' switch in the fully loaded edition manual... Oh and the pilot has 10 seconds to react to identify the issue and hit that one button...

[@tkg__]

There were laws for this. The tender that was won by SPS obligated Newag to pass on everything they had, including full documentation of software to SPS so they can maintain the trains. They clearly didn't, so they broke the original contract they made with Silesian Railways they signed when they sold the trains in the first place. This also touches a bigger problem, as trains in Poland (and many European countries) are considered a strategically important resource (think - natural disasters and war). This not only goes under industrial sabotage but also potentially under those more treason-y laws. Also - Newag doesn't sell exclusively in Poland. They sell trains and trams to other countries too. :')

[@kippie80]

Remember Toyota’s random acceleration? Was accel by wire and caused by Malloc errors of C code. Proven in court.

[@rbgtk]

What a rollercoaster these train shenanigans

[@asdfghyter]

22:57 narrator: He did in fact not take out the accidental re-read (I'm assuming because the cut would be really obvious and to give us more chances to laugh at your expense ;))

[@nightshade427]

This sounds like a case of the all too common, right to repair issue, the train operator went with another company for maintenance because they were cheaper than the manufacturer, the manufacturer has placed locks in the code to tie replaced devices to serial numbers, maintenance time bombs to force a maintenance event and associated fees, etc.

[@gronki1]

Love from Lower Silesia, Poland ❤

[@HaggisMuncher-69-420]

It's so frustrating watching a manlet being deliberately obtuse "bUT hOW cAN iT bE fInE iF iT dOeSn'T wOrK?"

[@jeffgros8508]

That usage based shutdown clause for the train software reminds me of ink jet printers. Many manufacturers sell ink with authenication chips so that you cannot use 3rd party replacements. The cartridges have EEPROM or flash to keep track of usage, and will refuse to print once this count is exceeded, even if ink still exists in the cartridge. Also common in the medical industry with consumables.

[@roman_shvets-q6t]

I bet the dev who messed up with IF statements did that on purpose. From the manager's POV, everything looks good but the code never gets executed. Everyone is happy

[@Takyodor2]

There's no way in hell a developer does this at all unless under threat of losing their job or something. Might as well perform sloppy sabotage.

[@sirdrzamich]

For a moment I thought I'm imagining things when I saw a video thumbnail with Primeagen and Koleje Dolnośląskie train in the background xd

[@Yupppi]

The chat had the worst copium on rather clear illegal action. Safety and maintenance, part expiration date my ass, you can look up ISO standards about safety and common practices in automation and machine engineering safety and you can't find "we lock the system by software if the product hits anyone else's maintenance location after we have lost the service deal". In fact the party ordering the trains needs to specify in the deal for safety features and they are well documented (especially if the documentation is 20 000 pages large to begin with) if it's legal practices. The locks hit to prevent the trains from running IF they went through maintenance (or stopped them from running in general), it did not lock them up until maintenance. Furthermore straight up locking the train is not safety practice, at worst if you lock the train while running, it can be a huge safety issue. The safety related parts surely have a schedule and it's on the company using the trains to take care of that (or they order the safety feature, not discover it when their products don't work). Part expiration date would not be critical neglection from the manufacturer especially when they are scheduled for maintenance. Or you do business in Poland and don't care to begin with as a manufacturer - definitely not the manufacturer's problem in either case. Also it makes zero sense to lock nearby maintenance facility like someone claimed. The very opposite, you are trying to make them running there if they aren't and it does not bring any safety or practicality if unknown software feature locks them up (anywhere except the product provider's facility). Kinda upsetting to read those comments.

[@claudiovasquez2099]

The 22:00 Slack notification made me stand up to my computer to see what's up 😂😂

[@testing2517]

pkill -9 slack got me 😆😆😆😆

[@codeman99-dev]

20:08 You don't know what a pantograph is? For goodness sake! There's even context here. 1. Part of the train's startup procedure. 2. The train is suppose to "raise" it! It's the boom arms that reach for sweet sweet electronics from the sky! lol

[@bonaventuraxyz]

Most american trains dont have pantographs, they run on diesel fuel

[@thekwoka4707]

One or two of the things, MAYBE could be argued as test code that escaped. But I don't think the maintenance shop geofencing would remotely be argued as such a thing (what's the context you create where you'd need to test it specifically in that way???). And on top of that the sheer number of things that just make it break for nothing.

[@marsjaninzmarsa]

"escaped" multiple times, with trains owned by different carriers, with many incremental versions and fixing the bugfixes… yeah. Definitely done by a mistake :D

[@BulbaWarrior]

22:25 and then lil bro says he doesn't loose much focus by distracting for random questions 💀

[@pesterenan]

My god, poo see the stroyer got me good hahhaahahahha

[@catcatcatcatcatcatcatcatcatca]

This honestly deserves a movie. What these hackers made such mind-blowing discoveries under insane time pressure, it sounds almost invented for cinema. Also there is absolutely no way vendor locking a product through means like this is legal. It is a conspiracy. In some jurisdictions, using proprietary parts and protocols might be legal and effectively mean the manufacturer has monopoly over maintenance. Planned obsolescence might be possible through intentionally faulty design. But in no economy would targeting specific market competition in your software, or setting up specific, undisclosed dates for malfunctions be allowed. Companies didn’t wait for the invention of software and computers to use tactics like this; they just paid someone to actually sabotage the train. This is not a right to repair -issue; This is fully fledged conspiracy. Just like you can’t hire goons to break your customer’s windows if they don’t renew a service contract, you can’t write software that secretly bricks a train to protect your market position either. There is a very clear difference between planned obsolescence and a conspiracy to directly cause obsolescence. What jurisdiction this falls under hardly matters.

[@Z4KIUS]

on one hand when you're tight on time boarding a Polish train is a death wish... on the other sometimes there's no faster option and you just won't make it otherwise so you have to bet on it

[@xdman2956]

The guy that did the reversed engineering is my teacher of RE at uni 😊

[@quantum_dongle]

The real sabotage was the names Prime had to pronounce in this one

[@szirsp]

13:40 The train they took probably was late, because they started to dump the running train's firmware mid journey :)

[@chickenduckhappy]

If malicious, due to how much operating a railway system costs, the possible sentence in case of a criminal lawsuit could be stupidly nasty. I'll put fraudulently tampering with large scale public transport systems on my don't list 😎

[@christopherconkright1317]

This is 100% malicious

[@EdmondDantèsDE]

One of the best articles you've read, maybe on par with the a$$word article. Largely due to the great writing. It also reminded me a lot of Atlas Shrugged with all the trains breaking down.

[@Midaspl]

I recommend original presentation by those guys you can find in KZbin.

[@alexandrecolautoneto7374]

Just by seing how you need to pay BMW a subscription to have your seat heatens, it's not hard to imagine that your car have similar code of those trains. after all we don't have spare polish hackers to find this out. That is just the old capitalism at it's best.

[@NithinJune]

these people did a really good talk that was fun to listening to

[@sfalpha]

Serial number lock is probably fine because it tamper proof, but must state clearly in documentation and also way to modify the checks in case thing need to be replace. Even 1m km for fail to start is OK because it should require proper servicing before going out again for safety reasons, but as long as it's in documentation with proper way to fix this. The date check and Geofencing is clearly not for the security purposes of tamper proof. This is anti-competition issue and will only bring Newag to lawsuit and penalty. Some said train software need to be re-certified for it's specific version but somehow Newag update the controller version every now and then. This is also weird and must investigate by certification institution. Or at least announce forfeit of certification and need to re-certified. Along with some code-audit by 3rd party (with NDA) before certification.

[@weed0509]

As a Pole, I find that hilarious when I hear something "Polish" and not working hahahaha. It makes me laugh a lot.

[@demanuDJ]

There will be lawsuit agains Newag because practices like this are illegal in Poland, according to EU law, the producer cannot force customer to maintain the vehicle in their own workshop (the same is with cars in entire EU). Also aging the product is illegal so if the the office of Competition and Consumer Protection (yes, there is something like that in Poland, very common used by citizens) confirms all these practices, Newag will be hit hard.

[@tomaszkubiak1011]

Honestly, 20k pages seems low considering my car service manual is 13k. I would expect the train service manual to be 3-4x the car.

[@ChrisCox-wv7oo]

I can't believe some devs sat there for week s as the country's train infrastructure crumbled, knowing that there were vendor locks put in place to keep these trains from being repaired by anyone but their current / former employer. Someone should have been blowing some whistles.

[@esbrasill]

I made some projects on trains and other heavy machinery. But i would always hand the source code and schematics to the client. No strings attached!

[@cprn.]

It's morally bad, obviously malicious but legally...? It's a gray area. HP did the same few years back - their printers blocked after N thousands of pages or N years of service or when you loaded a 3rd party replacement ink cartridge - they claimed they couldn't guarantee that the quality of such "obsolete" hardware or 3rd party products would meet the expectations of an HP customer and it'd hurt their reputation. It included all-in-one devices - imagine you not only can't print but also can't scan anymore because you've changed the ink. None of that would happen if you used their ink and send your device for (paid) maintenance every few years (I think the manual said every 2 years but I don't remember exactly).

[@Kane0123]

The only couple minutes I’m sat here thinking is it going to be a sling blade moment? … It ain’t got no gas in it

[@sidharthcs2110]

That's not a skill issue if it's intentional

[@ArturdeSousaRocha]

Wait until Prime discovers the loudspeaker button in Google Translate. 😆 This sarcastic and humorous style of documentary is not uncommon in Polish media. I haven't read the original (or maybe I have but forgot, this got a lot of coverage) but the translation has all the signs of being accurate. Besides, who knew that a big company in a conservative industry sector would resort to "Januszex"-style business practices, right?

[@ThrowAway-t3m]

An inch is exactly the same as a mm, that's why people call me 9-millimeter-peter!

[@proosee]

Every firmware, I mean *EVERY* firmware should be open source by law. Imagine this: you bought a car, next year the producer bankrupt and there are mysterious accidents connected with your car model - you have to have ability to fix your own car. Period.

[@tei187]

The article missed the whole point, dumbing it down to lack of proper if-statement skills. This is likely not a bug, nor a skill issue of the manufacturer, but seemingly an intentional backdoor in place in order to keep getting money for servicing and repairs by the said manufacturer, even though they did not win the bid.

[@Exilum]

2:50 That's how contracts in the public sector work in France, I don't know how it is in Poland, but maybe trains are public-owned.

[@Crimerenegade]

YUP it's a company owned by the local government of the Województwo - Province. So it works the same way as in rest of the EU countries

[@Exilum]

@@Crimerenegade Not exactly, in France trains were privatized a decade or two ago (they only removed the laws guaranteeing a monopoly in the past few years)

[@rzyr]

You hit that 15 minutes mark on the point. Nice

[@ThrowAway-t3m]

When you need to hire hackers who have never worked on trains before to unfuck your technical debt...

[@stooczu9359]

I guess he took train to the maintance company because it is supposed to have railway and could be located outside the city.

[@dracula7779]

Newag recently closed new huge deal with sps, no mentions for concerns about this mess reocurring btw... 480~ million euro deal

[@dragonridertechnologies]

All of this was sabotage. Effectively, the trains would break early to get more maintenance fees. If the trains were taken to any other repair shop, they would break, making the other repair shop look bad and ensuring only the saboteurs eventually got paid because they were the only people that knew about and could fix the malicious code that was the real problem (rather than any real issues that the other maintenance teams were perfectly competent to fix). Same with how replacing parts of your FruitPhone causes unrelated stuff to not work right with no explanation (as one example, swapping the screen FOR A WORKING SCREEN OFF AN IDENTICAL PHONE breaks the ability to take pictures and use some camera modes...?!) so you think the repair person broke it and you send to back to the fruit company because somehow _they_ are able to fix it... AND THEN the train dev team tried to make it fail for a dedicated maintenance window too (on some trains, because using a consistent version of software is too hard for them - but they can physically sneak people into someone else's trainyard to illegally update the software (without updating the audit log) IIRC!), but couldn't figure out how to specify the correct dates properly. The announcement by the group mentioned that they used this to predict when the train would "fail" to run - and sure enough, it didn't work in that time range. They also noted that other trains showed similar behavior, from other rail lines...