Cyber attack at 19 major railway stations - WiFi hacked

[Prime586]

Seems like a classic bit of hacktivism (aka "idiot ruins his life because he thinks he's saving the world"). Questions will be asked of Telent about why they didn't have a change control process in place to prevent exactly this.

From what I understand it's nothing to do with Telent, they are the system integrator for NR (their main role is to supply the network infrastructure, CCTV and SCADA-based station control systems). The public wifi rides over the hardware they supply and is subcontracted to Globalreach. It was Globareach's wifi logon page that was hacked, to display islamophobic messages about terrorism.

 

[Thames99]

According o this

Man arrested after cyber vandalism hit wifi at UK railway stations including Reading

A man has been arrested after an act of cyber vandalism hit public wifi at some of the UK’s biggest railway stations, police said.

www.readingchronicle.co.uk

someone has been arrested, but there are no further details.

To their credit the article has a photo of the correct station.

 

[Couru]

By definition an admin account will have the permissions to change stuff.

There are various ways of controlling updates, such as independent code reviews which can be set as rules in any decent configuration/content management system, however those rules are set by an Admin account: they necessarily have to exist.

Admins still have to go through change controls, but I suppose you're right - if they're disgruntled and intending to break the law, they're not exactly gonna follow proper process. Still surprised they don't require dual confirmation for something as vital as the landing page though.

From what I understand it's nothing to do with Telent, they are the system integrator for NR (their main role is to supply the network infrastructure, CCTV and SCADA-based station control systems). The public wifi rides over the hardware they supply and is subcontracted to Globalreach. It was Globareach's wifi logon page that was hacked, to display islamophobic messages about terrorism.

Yes, my apologies. Questions will be asked of GlobalReach and their processes - surely admin access to national infrastructure would require a security check? - but I'm well aware that complacency is rife in my industry and the laws aren't keeping up.

 

[skyhigh]

surely admin access to national infrastructure would require a security check?

Does free passenger WiFi count as national infrastructure?

 

[Peter Mugridge]

By definition an admin account will have the permissions to change stuff.

There are various ways of controlling updates, such as independent code reviews which can be set as rules in any decent configuration/content management system, however those rules are set by an Admin account: they necessarily have to exist.

Which leads to the question of how the admin account credentials came to be used maliciously: either a disgruntled (possibly former) employee or they have been compromised. And whether any second factor authentication (2FA) was in use: the sort of thing that sends you an email to confirm your identity. (Often the root admin account doesn't have 2FA as it may be needed to fix the 2FA!)

Will be interesting where this one goes. IMHO, more interesting than if it was a straight up hack.

It said on the BBC yesterday that the person they arrested worked for the information system provider; that at least answers the access questions.

 

[Recessio]

SWR's station WiFi is unaffected at Guildford. Which is good, because despite the fact you can see at least signal masts from the station, and often have full signal, the 4G/5G never actually seems to work. So I'm glad SWR are there as a backup!

 

[Joe Paxton]

I take that to mean we should expect TfL issues to continue for another month and a bit at least)

I have no privileged information here, but it doesn't look very promising from what is in the public domain. No commitment to any sort of date for service restoration

Better not to promise something which many not be achievable.

My guess is that in time we'll learn significantly more details about the hack.

 

[Baxenden Bank]

I can't speak for IT systems but in other industries, a senior person with the right to access 'stuff' (and responsibility for that access if abused) will often give those log-in details to an underling to actually enter and retrieve stuff. Think bosses and their Personal Assistants for example.

 

[Bill57p9]

Does free passenger WiFi count as national infrastructure?

I would argue probably classified as National Infrastructure but surely not Critical National Infrastructure, which the operational railway is.

 

[JKF]

I may be wrong but since we're all speculating - the content of the message (basically conspiratorial great replacement right wing loony stuff) wasn't really something I'd think yer typical IT guy would either be stupid enough to do or indeed hold such views.

Base on that, I suspect more likely his or her credentials were breached. Still as I said I may be wrong about that!

tech nerds are all over far right conspiracy nonsense unfortunately - see Elon Musk as a prominent example. Young men and the terminally online are being radicalised. While the boots on the ground attacking mosques and refugees in hotels mostly comprise an assortment of thickos, the messages curated to get them to do this are provided by intelligent and well-off agitators.

 

[Egg Centric]

tech nerds are all over far right conspiracy nonsense unfortunately - see Elon Musk as a prominent example. Young men and the terminally online are being radicalised. While the boots on the ground attacking mosques and refugees in hotels mostly comprise an assortment of thickos, the messages curated to get them to do this are provided by intelligent and well-off agitators.

Yah but you have to have an intersection between holding those beliefs, having this access, and being stupid enough to do this, pretty much guaranteeing imprisonment for no gain.

Being careless with security procedures / credentials / what have you on the other hand requires only being a daftie, and maybe not even that.

It'll come out in the wash anyway! Neither explanation would surprise me, I just think latter more likely

 

[stwales]

I think the query was less why it's being investigated per se, than why it's BTP doing the investigtion. Apart from anything else, I wouldn't have thought they'd have the officers with the specific knowledge needed to investigate this.

BTP had at least one officer who was totally capable of carrying out any digital forensic investigation required. Although this was back in 2009. I imagine his skills have advanced since then.
Do not assume people do not have other skills than that required by their job.

== Doublepost prevention - post automatically merged: 28 Sep 2024 ==

isn't it simply because it is railway infrastructure. I would assume they can call on the NCSC/GCHQ and other orgs just as the territorial police or NCA can.

do not assume the organisations named above are the best available, they may be good at providing someone for school prizegiving, or an interview for the bbc, but the best will remain discreet. i now of at least two government funded places that are better than those named above.

 

[infobleep]

SWR's station WiFi is unaffected at Guildford. Which is good, because despite the fact you can see at least signal masts from the station, and often have full signal, the 4G/5G never actually seems to work. So I'm glad SWR are there as a backup!

I didn't know there was two WiFis at Guildford. Seems overkill.

 

[Recessio]

I didn't know there was two WiFis at Guildford. Seems overkill.

It was overkill until very recently!

 

[Tracked]

I was thinking it was a bit odd something like this happened while that's being released...

I heard the guy arrested works for the BBC's Drama department

 

[CharlieSpotted]

BTP had at least one officer who was totally capable of carrying out any digital forensic investigation required. Although this was back in 2009. I imagine his skills have advanced since then.
Do not assume people do not have other skills than that required by their job.

In addition, note that police forces employ the services of contractors to do Digital Forensic work, either in place of or in addition to their own capability. There are several very well established companies that can assist with this type of investigation.