Poland: cyber-attack on rail network

[Adlington]

https://www.bbc.com/news/world-europe-66630260

Hackers broke into railway frequencies to disrupt traffic in the north-west of the country overnight, the Polish Press Agency (PAP) reported on Saturday [26 Aug 2023]. The signals were interspersed with recording of Russia's national anthem and a speech by President Vladimir Putin, the report says.
Saturday's incident occurred when hackers transmitted a signal that triggered an emergency stoppage of trains near the city of Szczecin. About 20 trains were brought to a standstill, but services were restored within hours.

According to official sources, this proves the emergency stoppage mechanism works as designed. Look on the bright side....

 

[stuving]

Why is this being described as hacking, or cyber-anything? It sounds more like jamming, or intentional radio interference if you prefer. That has the important implication that it had to be done in situ, with suitable equipment, not by shady groups in Russia.

 

[Adlington]

Why is this being described as hacking, or cyber-anything? It sounds more like jamming, or intentional radio interference if you prefer. That has the important implication that it had to be done in situ, with suitable equipment, not by shady groups in Russia.

The official line, as per the BBC article is "For the moment, we are ruling nothing out". OTOH, the Polish authorities tend to blame any snafu on the Russkies nowadays. Hot weather is excepted, so far

There was another case of unauthorised emergency stoppage on Sunday (27/09) morning, near Łapy (NE Poland).

 

[dutchflyer]

Well, just by chance today I left POland-the south west, Dolnoslaskie, Wroclaw and am now in Berlin. And this is also the very first news item I read about this, even though I also heard the Polish news on TV yesterday eve.

 

[Cloud Strife]

Why is this being described as hacking, or cyber-anything? It sounds more like jamming, or intentional radio interference if you prefer. That has the important implication that it had to be done in situ, with suitable equipment, not by shady groups in Russia.

Simply put: I wouldn't trust a word that the Polish government says. They're facing a very difficult election in less than two months, and they are out of ideas. Without dragging the thread in a political direction, it's worth knowing that the railways are under state control.

It's highly likely to be an inside job, put it that way. There's another stoppage today near Łódź, apparently.

 

[MarkyT]

Highlights a vulnerability of some radio-based systems. This may have been a track-to-train operational voice comms system with an emergency stop facility included like GSM-R in UK. Without antagonists having to successfully break into or spoof heavily crypto-protected data messages, it's plausible such systems might be prone to DOS (denial of service) attacks, by masking legitimate messages or jamming the airwaves with nonsense on the appropriate frequencies, overwhelming safety critical systems onboard which then fail safely, stopping traffic in the affected area.

 

[Adlington]

I wouldn't trust a word that the Polish government says.

Hear, hear....

According to Polish media, the train-stop signals are still transmitted by an analogue radio system at 150 MHz. The stop signal consists of 3 tones of specific frequencies, broadcast one after another. Details are apparently freely available online.
GSM-R was to be implemented in 2023, but it's delayed by at least 3 years

 

[MarkyT]

Hear, hear....

According to Polish media, the train-stop signals are still transmitted by an analogue radio system at 150 MHz. The stop signal consists of 3 tones of specific frequencies, broadcast one after another. Details are apparently freely available online.
GSM-R was to be implemented in 2023, but it's delayed by at least 3 years

That's very insecure and open to interference, by hostile forces or those wishing to exploit events for political purposes.

 

[Polrail]

In a related note, the Polish president has signed any new anti-espionage bill, which seems to forbid most railway photography.

https://www.fotopolis.pl/newsy-sprz...ania-kara-grzywna-areszt-i-konfiskata-sprzetu

Analyzing the above provisions, it may turn out that the ban will cover many objects that are a fairly common part of the everyday landscape, such as railway stations, hospitals, bridges, railways, power grids or various types of pipelines.

https://www.rynek-kolejowy.pl/mobil...nia-powroci-sejm-przyjal-przepisy-114237.html

It will be forbidden to take pictures of objects marked with a no-photography sign.

 

[Segedunum]

It looks like my trip to Poland in a few weeks is going to turn into a right barrel of laughs at this rate. First the risk of random disruption from signal interference, and now photographing a train could get me arrested

At least, it looks like the object has to be marked with a 'no photography' sign. When I was in Lithuania, it was common for station buildings, areas around depots etc. to have such signs, but not the platforms themselves.

Judging by the comments section of the first article, it doesn't sound awfully popular...

 

[MarkyT]

It looks like my trip to Poland in a few weeks is going to turn into a right barrel of laughs at this rate. First the risk of random disruption from signal interference, and now photographing a train could get me arrested

At least, it looks like the object has to be marked with a 'no photography' sign. When I was in Lithuania, it was common for station buildings, areas around depots etc. to have such signs, but not the platforms themselves.

Judging by the comments section of the first article, it doesn't sound awfully popular...

It's absurd in the age of ubiquitous camera phones and cheap microscopic spy cameras that can be concealed in a pen or button hole. What about people with eidetic memory; have Polish secret police developed the MiB neuraliser already? Is a fair defense that you were too far away from the sign to read it? Is it legal to take a close-up of the no photos sign revealing none of the object it's attached to? Are the steam engines of Wolsztyn and museum collections especially protected against public photography because they're the ultra-secret strategic reserve for when it all kicks off and the EMPs from tactical nukes have scrambled the electronics in more modern traction?

== Doublepost prevention - post automatically merged: 2 Sep 2023 ==

Two Polish citizens have been arrested for this incident.

Two Men Arrested Following Poland Railway Hacking

Polish police have arrested two men suspected of illegally hacking into the national railway's communications network

www.securityweek.com

Polish police on Sunday arrested two men suspected of illegally hacking into the national railway’s communications network, which destabilized traffic in some areas of the country this weekend. “The two men arrested are Polish citizens,” said Tomasz Krupa, a police spokesman in the eastern city of Bialystok where the arrest occurred. Police also seized radio equipment from the apartment where the men, who are 24 and 29 years of age, were detained.

Quite why this website chose to illustrate the story with a Eurostar e320 passing through Kent I don't know!

 

[pokemonsuper9]

I saw this video that covered the interference (the first 4 minutes and 13 seconds) and thought it was worth sharing here.

 

[nanstallon]

In a related note, the Polish president has signed any new anti-espionage bill, which seems to forbid most railway photography.

https://www.fotopolis.pl/newsy-sprz...ania-kara-grzywna-areszt-i-konfiskata-sprzetu



https://www.rynek-kolejowy.pl/mobil...nia-powroci-sejm-przyjal-przepisy-114237.html

I'm old enough to remember the early 1980s, the good old days of Communism with Poland being one of the most anti-enthusiast countries behind the iron Curtain.

 

[DEE-DE]

It's not a new thing that Radiostop has been abused in Poland. This article comes up from 2011 (Polish but translator works reasonably well). And as it's just analogue radio the fallback is to repeat a word sequence a certain number of times. This obviously doesn't cause the brakes to come on automatically but still causes disruption.

 

[TheGuy]

It does cause brakes to come on automatically. The radio-stop signal is just few DTMF tones broadcasted on an analog frequency, as opposed to the spoken "Alarm, Alarm, Alarm", which as defined in the signaling/radio-communication code, should cause the same action, but this time not automatically. And yeah, I've seen few posts on skyscrapercity.com where people were analyzing abuses of radio-stop of last 10 (or more years), and the number is more or less the same every year. Nihil novi sub sole.