Skip to main content

I can finally reveal some research I've been involved with over the past year or so.

We (@redford, @mrtick and I) have reverse engineered the PLC code of NEWAG Impuls EMUs. These trains were locking up for arbitrary reasons after being serviced at third-party workshops. The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parties.

1/4

@mrtick@infosec.exchange in front of an Impuls.
@Michał Kowalczyk @mrtick
Tato položka byla upravena (11 months ago)

reshared this

in reply to q3k :blobcatcoffee:

q3k :blobcatcoffee:
q3k :blobcatcoffee:
• •

We found that the PLC code actually contained logic that would lock up the train with bogus error codes after some date, or if the train wasn't running for a given time. One version of the controller actually contained GPS coordinates to contain the behaviour to third party workshops.

It was also possible to unlock the trains by pressing a key combination in the cabin controls. None of this was documented.

2/4

A Selectron CPU831 TCMS/PLC on a workbench, being probed and programmed.
Coordinates of a third-party workshop extracted from PLC, overlaid on a map.
Tato položka byla upravena (11 months ago)
in reply to q3k :blobcatcoffee:

q3k :blobcatcoffee:
q3k :blobcatcoffee:
• •

The key unlock was deleted in newer PLC software versions, but the lock logic remained.

After a certain update by NEWAG, the cabin controls would also display scary messages about copyright violations if the HMI detected a subset of conditions that should've engaged the lock but the train was still operational.

The trains also had a GSM telemetry unit that was broadcasting lock conditions, and in some cases appeared to be able to lock the train remotely.

3/4

A NEWAG Impuls HMI complaining about copyright violation on cabin controls.
Tato položka byla upravena (11 months ago)
in reply to q3k :blobcatcoffee:

q3k :blobcatcoffee:
q3k :blobcatcoffee:
• •

and @mrtick held an unrecorded talk a bout this at OhMyHack in Warsaw - I unfortunately couldn't make it because of Munich snow.

For now this is making the rounds in Polish-speaking sources, but we do have a talk scheduled about this at 37C3, in which we plan to do a deep dive into this and actually publish our findings.

@zaufanatrzeciastrona 's article about this: zaufanatrzeciastrona.pl/post/o…

O trzech takich, co zhakowali prawdziwy pociąg – a nawet 30 pociągów | Zaufana Trzecia Strona

Adam Haertle (Zaufana Trzecia Strona)
@ZaufanaTrzeciaStrona.pl @mrtick
⇧