37C3 - Breaking "DRM" in Polish trains
media.ccc.deCited 3× on HN, 2024–2025
talk · intermediate · evergreen · 2024–2025 on HN
A 37C3 talk on how a series of Polish electric trains stopped working after servicing by an independent company. The speakers explain how train control systems work and how they reverse-engineered the software lockouts.
HN cites it as the key account of train DRM being broken, in threads on right to repair, reverse engineering and vendor lockouts.
Up next
11 mo on HNBehind the Scenes of iOS Security
Black Hat
9 HN recommender · 2016–2026
11 mo on HNWhy Electronic Voting Is Still A Bad Idea
Tom Scott
11 HN recommender · 2020–2026
10 mo on HNUSENIX Security '18-Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
USENIX
10 HN recommender · 2018–2026
10 mo on HNDefcon 18 Changing threats to privacy Moxie Marlinspike Part
killab66661
6 HN recommender · 2012–2019
9 mo on HN28c3: The Science of Insecurity
28c3
9 HN recommender · 2012–2024
8 mo on HNDEF CON 25 - John Sotos - Genetic Diseases to Guide Digital Hacks of the Human Genome
DEFCONConference
11 HN recommender · 2017–2023
7 mo on HNElevator Hacking: From the Pit to the Penthouse
DeviantOllam
9 HN recommender · 2014–2026
7 mo on HNCompiling C to printable x86, to make an executable research paper
suckerpinch
8 HN recommender · 2018–2023
7 mo on HNBreak Me00 The MoVfuscator Turning mov into a soul crushing RE nightmare Christopher Domas
Adrian Crenshaw
6 HN recommender · 2017–2026
7 mo on HNBlackHat USA 2011: SSL And The Future Of Authenticity
Christiaan008
9 HN recommender · 2011–2017
7 mo on HN27C3: Adventures in analyzing Stuxnet (Bruce Dang from Microsoft)
basti0007
8 HN recommender · 2011–2024
7 mo on HNFrank Abagnale | Catch Me If You Can | Talks at Google
Talks at Google
8 HN recommender · 2018–2023
3 comments from Hacker News
I'm not sure this comment does justice to the situation. Poland put out a separate bid for manufacturing and servicing of their locomotives and one company won the manufacturing bid while another won the servicing bid. The servicing company was unable to get the trains into working order and after hiring hackers accused the manufactoring company of bricking the software on purpose by including geo-fences where the trains would no longer work after arriving at the servicing company's property. Perhaps the interesting part to me was Dragon Sector's (the hackers) claims that the software needs to be blessed so although they discovered problems they never changed anything because they don't have the authority to bless it and heavily imply that the fact that the manufactoring company is changing the software at will is illegal. The changes by the manufactoring company had an (undisclosed) activation sequence added to it so you didn't need to modify the software in order to get the train working so the servicing company never actually modified the software. ▶ this video link
The whole train DRM saga has been endlessly entertaining as someone looking in from afar, but I can only imagine the stress this must place on operators trying to keep trains maintained with this dagger dangling over their heads. I wish I could hack a train, thats a once in a lifetime opportunity and would make for an incredible "2 truth and a lie" type story Also available at link Previous coverage: "37C3 - Breaking "DRM" in Polish trains" ▶ this video "O trzech takich, co zhakowali prawdziwy pociąg – a nawet 30 pociągów" link Mastodon post by q3k link
Oh, I know something about this. Some people that made this are part of DragonSector [1] polish hacking group that broke DRMs in trains quite recently [2]. Sadly I joined company after there were long gone. Really surprised seeing this posted here as it was pointed out, the repo is pretty old and archived. [1]: link [2]: ▶ this video