Accusations that Newag (PL) is intentionally making its trains fail

[rf_ioliver]

It's quite a talk. Absolutely riveting and disgusting at the same time. You can see exactly what was done to disable the trains. The reason becomes obvious. If I were buying trains, I would be looking elsewhere.

These guys have done fantastic work. I know of quite a few cases like this in other devices, so nothing "new" here unfortunately. But, excellent work nevertheless.

 

[CarrotPie]

talk from the hackers on what they found

Just had time to watch it and by golly is it good! Thanks so much for sharing! I hope they get a good outcome from this in the not-too-distant future.

 

[Robski]

Newag has officially started legal action against both SPS and Dragon Sector for IP infringement. https://www.rynek-kolejowy.pl/wiadomosci/newag-pozywa-dragon-sector-i-sps-mieczkowski-119568.html

Translation below (first half only)

There is a new chapter in the major affair regarding the disabling of Newag multiple units which, according to the hackers, with the help of some code in the [on board] software, were unfit for service and unable to be fixed at third party overhaul facilities except for those authorised by Newag.
Newag has sued the hackers from the Dragon Sector group, according to a source close to the proceedings, who accessed the source code for the on board software.
We [Rynek Kolejowy] tried to get confirmation for this from Newag, however they asked for patience. Confirmation was received from "Dziennika Gazety Prawnej".
"We confirm, that Newag IP Management has sued three hackers from Dragon Sector as well as the following organisation: "Serwis Pojazdow Szynowych" (SPS), headquartered in Lisim Ogonie. The lawsuit has been brought on the basis that the copyright rights [of Newag] have been infringed upon multiple times in a damaging way by the the parties being sued." - Łukasz Mikołajczyk, press officer at Newag Group.

Lawyers representing Dragon Sector and SPS have also stated that Deloitte was contracted by Dragon Sector/SPS to audit their work and has confirmed that trains leaving Newag workshops were leaving with altered on-board software compared to when they entered - presumably to amend the blocking mechanism.

The Regional Prosecutor in Krakow has also opened a case into this dispute about two weeks ago, again without naming the defendants.

 

[Cloud Strife]

An interesting side note is that Newag have pledged to use open source software, which really does point at them trying to salvage their reputation. They've signed two large contracts with PKP Intercity and Koleje Śląskie, so I suspect that they will simply try and push for a settlement that silences everyone.

 

[Robski]

Newag has once again called SPS/Dragon Sector in front of yet another court, this time in Gdańsk. They are now alleging "violation of personal rights".

Sprawa blokad w Impulsach. Newag po raz drugi pozywa Dragon Sector i SPS

Kilka tygodni po pierwszej rozprawie w sprawie pozwu Newagu przeciwko Dragon Sector i SPS, przedsiębiorstwo... złożyło kolejny pozew. O co chodzi?

cyberdefence24.pl

(translation of first paragraph below)

Newag has filed a summons for personal rights violations against the members of Dragon Sector and SPS - according to recently published company filings for the first half of 2024. This case is the second brought about by the Nowy Sącz based rolling stock manufacturer.

 

[U-Bahnfreund]

Update on Newag's shenanigans by the hackers today at this year's Chaos Computer Congress, at 11 pm CET. CCC is also calling for donations to the hacker group to help recover 30,000€ of legal costs because of Newag's court cases.

Livestream: https://streaming.media.ccc.de/38c3/eins
Recording will be available later at: https://media.ccc.de/ or probably YouTube.

 

[Chriso]

Shame as their nice trains

 

[Chonner]

A video of the presentation is available at https://media.ccc.de/v/38c3-we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure#t=0

Summary:

• Workshop group in Polish Parliament got shut down by Newag's local MP
• A criminal case is under investigation in Krakow (defendants unspecified but assumed to be Newag)
• Newag offered "free software updates" to all of their train operators after the public talk last year.
• A few other train operators went public with similar expereinces of trains getting locked, which they solved by disconnecting the GPS module.
• Newag has initiated 2 lawsuits against Dragon Sector (see post #35 for details about them) which they consider SLAPP lawsuits.