Polish teen derails tram after hacking train network
A Polish teenager allegedly turned the tram system in the city of Lodz into his own personal train set, triggering chaos and derailing four vehicles in the process. Twelve people were injured in one of the incidents. The 14-year-old modified a TV remote control so that it could be used to change track points, The Telegraph …
I mean, look at the picture - it's Soviet-era technology. Who needs expensive command and control systems when you've got fear and secret police?
@ andy gibson.
I was wondering how far I'd get down this page without someone mentioning autism. The opinion that (very smart == savantism == autism) belongs in the 1970's, please leave it there :)
Aw, what's that, just jealous that a 14 year old kid out there is smarter than you? Must be such a lonely world at the top, constantly being better than everyone else out there.
... I'd be a bit more worried about their training standards if one of their drivers was actually trying to steer their tram to the right...
I think he's missing one.
Look forward to hearing how his career progresses, selling nuclear plans to dodgy regimes, designing bio weapons. Great.
Systems just don't get tested properly. When I did software system testing our objective was to break the system any way we could, not just make it do what it was supposed to do.
The kid is an idiot. He was caught, derailed a tram, got people injured. That's on par with hacking a street signal with a bb-gun.
Also, unless the tram derailed because of a sharp turn the conductor wasn't expecting, it was on purpose. By either fighting with the conductor (left, right, no... left... no right) or waiting until the tram was on the switch. The fact that he's trying to turn the tram in a different direction from the conductor, while there is another tram nearby also seems to point to intentional harm. Depending on the evidence, I hope they slam this kid.
According to Gazeta Wyborcza, where the photo someone else linked to comes from, the system is indeed infrared.
The engineer interviewed here suggests that the system is so underprotected that even a passenger on the tram might accidentally disrupt the system with an unaltered remote control.
http://miasta.gazeta.pl/lodz/1,35136,4824049.html
Did these IP addresses begin with 192. by any chance? If so those are internal network addresses.
If you look correctly at the proper RFC, only those beginning with 192.168.0.0 are "non routeable addresses. There are others (10.0.0.0/8 and 172.16.0.0/12). See RFC1918.
I suspect that they were "private addresses".
>>(very smart == savantism == autism)
Since we've already shown that hacking the system was no great feat, that line doesn't apply. However, autistic people do things like watch the trams and try to figure out how they work, and playing with them "like their own toy set" is entirely consistent with the condition. If he was indifferent to other people (not concerned that they might be injured or angry that they were delayed), then he is pretty much a dead ringer for autism.
Duncan,
Re: "Traffic Lights .... company we used for penetrations tests .... crack the IP interface"
I employed a pen-test company, in nut shell they did not crack my IP interface to the traffic lights (I think it may be the company you are referring to). Hence I do not like the comment:-
"Transport command and control systems are commonly designed by engineers with little exposure or knowledge about security using commodity electronics and a little native wit."
When the Pen-tester compliment you on your set up and can't do anything even with all the passwords, you know you have done a good job with the design.
Posting Anonymous.
Too late, Andy. A couple years ago or so some Palestinian militants talked a kid into strapping on bombs to walk to a checkpoint to blow up. Thankfully the scared-shitless Police were able to get him to take it off and what not without any deaths.
http://en.wikipedia.org/wiki/Hussam_Abdo
"Israeli media described Abdo as a "mentally challenged" boy while his brother, Hosni, said that Abdo "has the intelligence of a 12 year old."
Unfortunately his Mother is just as ignorant.
"If he was over 18, that would have been possible, and I might even encourage him to do it. But it's impossible for a child his age to do it."
- I picked a heart because there was no icon for a broken one.
No mention of what happened to the kid's tram-busting Remote Control! What if it fell into the wrong hands, leaving villains in Lodz to strike again?
Chris C
Believe it or not, not everyone who can read has a brain that works. This kid spent a good amount of time researching and building his device to take over the tracks. That requires a little more brainpower than programming a remote. Most people cannot program a remote or a VCR for that matter. You are giving stupid people far too much credit.
I say yeah..give the kid a job.
To all those of you saying: "The kid should be tied to a train track and then shot" & "in my day..." , my missus comes from Łódź (pronounced "ooch", as in "hooch") and from what she tells me the police there are definitely of the "Don't f**k with me if you value your knee-caps" variety.
When I was over there in November the tram drivers all drove like nutters and left the braking very late - more than once I saw a tram nearly rear-end another at a stop!
Remember points (or 'turnouts' for our colonial cousins) have a max speed at which they can be negotiated. Attempt to take one too fast and you_will_leave the track!
The coat with the mittens on a bit of string is mine...thank you
"It's do to plonkers like this kid that we have DRM and encryption."
Nonsense. It's due to the greed and complete lack of ethics of the Corporate world, combined with the reactionary resistance to new ways of doing business, that we have DRM and encryption.
So, yes, some cities do use a transponder system. But, others do in fact just use some kind of flashing light detector. A friend of mine about 10 years ago had a truck with one badly misaligned headlight (my state has no safety inspections so there's some real shitboxes on the road). He found he could flash it and it'd turn the lights for him every time -- until a policemen finally caught him at it, wrote him some ticket for that and a ticket for the misaligned headlight, plus probably some other ones.
I also can second reading about someone (briefly) commercially selling the strobe-boxes, until they were quite quickly pulled off the market.
Intelligence isn't the only quality needed to help society. Sanity, sympathy, and a sense of responsibility are also required.
The last thing any one needs is for this guy to get a job where he get access to privileged information. At least not until he has demonstrated he can and has grown up. (Some people never grow up properly, psychopaths for example, and we have to minimize the control they have over other people.)
You need a the qualities of a responsible person in addition to intelligence, before you can handle a job that involves responsibility.
Tram points are controlled by the driver, not some signalman in a remote location, and in the old days they sometimes had to lean out the cab and physically change the setting using a pull cord or something like that. Using an IR remote is a handy upgrade, especially if you live somewhere cold and wet. The problem here is that the kid changed the track setting after the driver had set it, either sending the tram the wrong way or (if its while the vehicle is going over the switch) derailing it.
Its a lot more difficult to do this on a railroad. We have more opportunities to do this in the US because we put sidings off the main track in all sort of remote locations but changing would be vandalism -- you've got to cut locks and things. It might be easier to just unbolt a section of track.
Incidentally, we do use a form of remote control to change traffic signals in the US. Its supposed to be used on emergency vehicles only but due to an oversight it wasn't illegal to have one until recently.
-shows how we have dropped the baton in the UK; the cohort before me back in the 50s at Manchester University used thermite to weld trams to the track for a Rag Week stunt.
Chain him to the tracks at one end of the line, with a bag of miscellaneous electronic bits. Then set a tram going at the other end.
If he manages to hack the network by the time the tram gets to him - give him a job.
If he doesn't, shovel him up :)
No, really...that story shows all the signs of a God Complex and the initial signs of a Machiavellian bent.
"Its a lot more difficult to do this on a railroad. We have more opportunities to do this in the US because we put sidings off the main track in all sort of remote locations but changing would be vandalism -- you've got to cut locks and things. It might be easier to just unbolt a section of track."
That would be a federal crime and they would charge you with terrorism.
From what I've read in the Polish press (I'm from Łódź - actually couldn't get to the uni because of the derailment, it's pronounced /wooch/, btw), the problem is that he switched the points when the tram was halfway through it, thus derailing it. There should be some sort of protection against it, but it's installed only in few places (and since the transport company is renting the tracks from the city - which in turn gives them money for renovation - both refuse to take responsibility for that).
@Jeremy
> I mean, look at the picture - it's Soviet-era technology. Who needs expensive
> command and control systems when you've got fear and secret police?
Beg pardon?
@ Anonymous Coward:
You GOT TO BE KIDDING! A city tram running at 100mph...
Do you have any idea what a tram is?
Don't at least some of us remember 14 accurately? Sure, at 14 we know right from wrong but at 14 who gives a monkey's? From 11 to 14 to 16 to 18 - most of us are a series of different and incomparable personalities.
Oh sorry ... geeksville is here. We are all 14.
My bad - though in fairness I've found the 'w'/Łó is hard to hear to someone used to Germanic languages (English, French, German), as opposed Slavic ones.
Loved the city, by the way (not necessarily the architecture! ;-) ). Was impressed that the road and tram network is being modernised at the time, meaning that although you guys are suffering traffic chaos at the moment, at least you'll get the pain over in one big hit. No-way could any city authority in the UK ever be that coordinated!
@Mitch
I grew up near Bern in Switzerland. On the 'inter-urban' routes (I.e. where the tram runs on dedicated tracks, not on a tracks in the road surface), they regularly hit 80km/h (50mph)- just don't hit the emergency stop (as some 14 yr olds are apt to do...) or the last thing to go through your head will be your arse!
Paris Hilton icon 'cos the girls in Łódź are far cuter....
"Transport command and control systems are commonly designed by engineers with little exposure or knowledge about security using commodity electronics and a little native wit."
As an Engineer who designs Railway Control Systems. I can assure you that every design engineer I have met throughout the UK and Australia has security and safety concerns at the forefront of every design.
If this comment were re-worded to be truthful it would read:
"Transport command and control systems are commonly designed by Engineers and passed through four stages of safety and security analysis processes using proprietary encrypted protocols running on specialised electronics and a lot of experiencial knowledge."
It will only be a matter of time... Perhaps he just wont like the movie they are showing...
It is fortunate that there is no possible way for a passenger to compromise the flight systems from their seat on a 787 because the flight control runs on a physically isolated network to the network provided to passengers. Right guys? Guys?
Society needs to stop blaming the kid and find the root cause of the problem. It is clear the engineers did not have a necessary skill / time needed to design a safe and secure system. This was the problem and the solution should be fixing it so that it doesn't happen again (training or providing the time to pick up these skills).
I'm a streetcar i. e., tram, motorman for the Port Authority Transit System here in Pittsburgh, PA, US. I say the Port Authority should bring this kid to Pittsburgh and hire him. We have a "stae of the art" signaling and routng system. Signals and routing can be controlled by the Operations Command Center remotely. In automatic, a route is selected onboard by the motorman by entering a three digit code into the "train-to-wayside" device console. This emits a radio signal which is picked up by receivers installed between the rails on the track.
One day a two car train was approaching a major junction. However its I.D. was lost from the system. As the train passed through the turnout at about 20 mph the following train set up its routing though that same interlock about a mile back. The switch threw under the train sendin the first car the right way and the second the wrong way thus derailing the train. This, they told us in training, "can't happen". I say, bring this kid to Pittsburgh and hire him. Maybe he can figure it out.
"A Polish teenager allegedly turned the tram system in the city of Lodz into his own personal train set, triggering chaos and derailing four vehicles in the process. Twelve people were injured in one of the incidents."
I can't quite work out if these were four vehicles derailed as a result of one signal change or if they were separate acts.
If the former, I can see how it was a prank gone wrong and it'd perhaps be a little shortsighted to be too harsh on him.
If the latter, lock away the key!
A 14-year-old is a child. End of story.
However - no sense blaming the designers of the system for "they should have known" not to build public transport a child can hack. 20 years ago, who was to know that kids would be able to hack (what was then) high-tech semiconductor control systems?
Has anyone heard any comments from the twelve injured victims yet?
I wonder if they will be saying "he's only a kid", etc...
Maybe not Anonymous Coward. See here:
http://www.pprune.org/forums/showthread.php?t=307162
Penguin icon coz I like it.
Changing points with IR is just daft at least the kid brought it to light it'll probably be made more secure now. Imagine if Al-Qaeda got hold of a remote at rush hour! Thousands of people would have been late for work, the economy would have been ruined!
Sign up, sign up for The Register's weekly IT security newsletter - click here
