Search
Items tagged with: Newag
Remember the Polish train hackers? The guys who identified why trains being serviced by an independent, licensed train servicing center, "randomly" started failing? And identified the root cause, namely geofencing and/or time-related triggers?
The face charges by the original train manufacturer, who claims the violated copyright and other laws. A fascinating story of contradictory arguments. Enjoy!
#Newag #PolishTrainHackers #Poland #Train #ReverseEngineering
rys.io/en/175.html
Newag admits: Dragon Sector hackers did not modify software in Impuls
Wednesday, August 28th, marked the beginning of the copyright infringement lawsuit filed by the Polish train manufacturer Newag against train maintenance yard Serwis Pojazdow Szynowych and experts froSongs on the Security of Networks
![A heavily modified window of Wanna Decryptor from the infamous WannaCry ransomware.
The window title: "Wanna Rail (UDP<->CAN Converter)".
Header: "Ooops, your train can't start after maintenance!"
Section: "What happened to my train?"
"After spending over 10 days in required maintenance, your train does not start anymore. There's no error, it just doesn't. Maybe the third party service is incompetent and does not have the required know-how for the work? Or maybe the "if" statement with coordinates of known third party workshops had something to do with it? Who's gonna know?"
Section: "Can I get my train working?"
"Oh, you sound nervous. What about? Some contracted rides you have to make? :) Don't worry, the Authorized Service can check up your train this time. For a little price. We'll do the secret sequence of button presses and it's all right! But next time, you know what's the place to pay for the maintenance, right?"
Section: "This is ridiculous, I'll get hackers to handle this!"
"These are not our "if" statements, we would never do such thing. Hackers? Maybe they are the ones who did this?! How dare you touch our sacred intellectual property?! We're calling Homeland Security, Prosecutor, Intelligence Agency, Railway Transport Office, [text cuts off here]"
[alt text continues in next picture]](https://fedi.ml/photo/preview/640/485857 "A heavily modified window of Wanna Decryptor from the infamous WannaCry ransomware.
The window title: \"Wanna Rail (UDP<->CAN Converter)\".
Header: \"Ooops, your train can't start after maintenance!\"
Section: \"What happened to my train?\"
\"After spending over 10 days in required maintenance, your train does not start anymore. There's no error, it just doesn't. Maybe the third party service is incompetent and does not have the required know-how for the work? Or maybe the \"if\" statement with coordinates of known third party workshops had something to do with it? Who's gonna know?\"
Section: \"Can I get my train working?\"
\"Oh, you sound nervous. What about? Some contracted rides you have to make? :) Don't worry, the Authorized Service can check up your train this time. For a little price. We'll do the secret sequence of button presses and it's all right! But next time, you know what's the place to pay for the maintenance, right?\"
Section: \"This is ridiculous, I'll get hackers to handle this!\"
\"These are not our \"if\" statements, we would never do such thing. Hackers? Maybe they are the ones who did this?! How dare you touch our sacred intellectual property?! We're calling Homeland Security, Prosecutor, Intelligence Agency, Railway Transport Office, [text cuts off here]\"
[alt text continues in next picture]")
![On the left side, there is a big icon of a lock and 2 time counters: "Bogus compressor failure report on: 2022-11-21 00:00:00+01:00. Time left: 142:00:10:39:[overflows, not readable further]". "Next day of contractual penalty: 2022-07-02 00:00:00+01:00. Time left: 00:10:39:26".
2 links: "Polish manufacturer accused of programming failures into its trains to gain more servicing business -> 2137.pl/Dtpzev". "Dieselgate, but for trains – some heavyweight hardware hacking -> 2137.pl/RCRddm".
On the bottom, small logos of Newag and Iris Certification. Small caption: "Infringement of copyright in the vehicle control system is subject to civil and criminal liability under the terms of Chapters 8, 9 and 15 of the Law on Copyright and Related Rights of February 4, 1994. Newag is not responsible for the consequences of improper maintenance of delivered vehicles by users or third parties, in particular, it is not responsible for unauthorized interference with vehicle control systems. To the Company's knowledge and assessment, users of railroad vehicles in Poland, guided mainly or exclusively by price, are increasingly entrusting the maintenance of railroad vehicles to entities that do not have the competence and know-how necessary to maintain modern railroad vehicles. In the Company's view, this kind of policy, which is unthinkable in Western European countries, may one day lead to a human tragedy in the form of a rail disaster."
Below, 2 buttons: "Check Payment", and "Unlock".](https://fedi.ml/photo/preview/640/485859 "On the left side, there is a big icon of a lock and 2 time counters: \"Bogus compressor failure report on: 2022-11-21 00:00:00+01:00. Time left: 142:00:10:39:[overflows, not readable further]\". \"Next day of contractual penalty: 2022-07-02 00:00:00+01:00. Time left: 00:10:39:26\".
2 links: \"Polish manufacturer accused of programming failures into its trains to gain more servicing business -> 2137.pl/Dtpzev\". \"Dieselgate, but for trains – some heavyweight hardware hacking -> 2137.pl/RCRddm\".
On the bottom, small logos of Newag and Iris Certification. Small caption: \"Infringement of copyright in the vehicle control system is subject to civil and criminal liability under the terms of Chapters 8, 9 and 15 of the Law on Copyright and Related Rights of February 4, 1994. Newag is not responsible for the consequences of improper maintenance of delivered vehicles by users or third parties, in particular, it is not responsible for unauthorized interference with vehicle control systems. To the Company's knowledge and assessment, users of railroad vehicles in Poland, guided mainly or exclusively by price, are increasingly entrusting the maintenance of railroad vehicles to entities that do not have the competence and know-how necessary to maintain modern railroad vehicles. In the Company's view, this kind of policy, which is unthinkable in Western European countries, may one day lead to a human tragedy in the form of a rail disaster.\"
Below, 2 buttons: \"Check Payment\", and \"Unlock\".")
No i skończyło się rumakowanie, bo zawiadomienie do UOKiK w sprawie Newagu składają parlamentarzyści, w tym Pola Matysiak @polamatysiak, która takich numerów na kolei nie odpuści. Widać to zresztą po bolesnym dla Newagu pytaniu:
"Chcemy, aby polski podatnik wiedział za co dopłacał. Pragniemy też, aby pasażerowie kolei usłyszeli, że mogą się czuć bezpiecznie w polskich pociągach bezpiecznie."
Jeśli polski podatnik dopłacał za nic, no to trzeba będzie kasę oddać, a liczyć się z karami. Kilka lat zakazu brania udziału w przetargach dla spółek państwowych i samorządowych to byłaby kara zapamiętana na długo.
Pytanie Adriana Zandberga (jest na mamucie?) wbrew pozorom też jest ciężkiego kalibru:
"Zwracam się do Pana Jakubasa o jasną odpowiedź: czy w firmie Newag dochodziło do praktyk, które zostały opisane w mediach?"
Oczywiście Jakubas może nie odpowiedzieć, ale to jak przyznanie się do winy. Z kolei zaprzeczanie może być bardzo słabe wizerunkowo, gdy zarzuty zostaną potwierdzone. A biorąc pod uwagę to, co już wiemy, to z ich potwierdzeniem nie będzie szczególnych problemów. Wiem, wiem, jest trzecia opcja, branie na klatę, no ale xD
Za oknem mróz, ale w siedzibie Newagu chyba zaczęło robić się ciepło.
🌐 klub-lewica.org.pl/aktualnosci…
Tajemnicze awarie pociągów. „Zawiadamiamy Urząd Ochrony Konkurencji i Konsumentów, aby polski podatnik wiedział za co dopłacał”
Lewica - jedyna postępowa siła w polskiej polityce. Jesteśmy różnorodni, ale łączy nas przyszłość. Dlatego wspólnie chcemy budować Polskę jutra.klub-lewica.org.pl