DRM has already stopped us from using third-party coffee capsules, repairing our tractors ourselves, repairing our phones, and scanning on multi-function printers with empty cartridges. And the newest episode of this saga is “the Polish taxpayers cannot repair the trains they paid for”, or more precisely, not without the help of a group of hackers…
The story begins with a bit of politics and budget: Koleje Dolnośląskie, also known as Lower Silesian Railways, is a railway operator in the Lower Silesia region of southwestern Poland. This public operator runs eleven Impuls 45WE trains built by the Polish company Newag. However, maintenance is handled by another company, Serwis Pojazdów Szynowych or SPS.
Why? Simply because SPS won the tender: The trains require mandatory maintenance every million kilometers traveled. Both SPS and Newag competed, but the original manufacturer's offer was 750,000 dollars more expensive. With a total of 5.5 million dollars for eleven trains, SPS secured the contract, and that's when their troubles began: Trains that entered the workshops ended up dead, not moving an inch.
How to revive a DRM-blocked train
Now, SPS has all the relevant information (the maintenance manual is 20,000 pages), the workshops, and the contacts. Refurbishing a train requires (loosely speaking) a complete teardown, sending parts to their manufacturers for recertification, getting them back, and reassembling… but the Newag trains remained immobile, despite telemetry indicating optimal conditions. The first stopped train led to a second, the third had a battery failure, and the fourth that took its place… also stopped after maintenance. A new report from another workshop in Szczecin adds fuel to the fire: An Impuls train enters maintenance, and dies.
The first official response from Newag was that the trains stopped due to a “safety system”, which doesn't appear anywhere in the 20,000-page manual. The downtime translates into contractual penalties, and with no other options, the workshops eventually contact a group of hackers, “Dragon Sector”.
The difficulties don't take long to appear. The CAN bus of the computers uses strange protocols, the official SDK only allows software uploads (no dumps), and a modified version of Ghidra had to come into the picture… all with the imminent breakdown of the contract between SPS and Lower Silesian Railways hanging over their heads. Long story short: At 08:42 on the last day, one of the modified computers got the train running again.
So, the trains can run again, but a huge question remains: Why did they fail in the first place? Additional months of analysis and reverse engineering confirmed the presence of GPS coordinates linked to repair and maintenance workshops. Basically, a condition in the code completely blocked the trains if they spent at least ten days in those workshops. In addition, there were blocks for component changes, and in another train a “hard stop” was discovered after traveling one million kilometers, similar to the famous conflict over Epson printer pads.
To date, researchers have discovered remote links via GSM and analyzed the software of 29 trains. In 24 of them, they found all kinds of blocks and barriers that do not appear in the documentation.
Original article in Polish: Click here
English translation: Click here
We saw it at: Hackaday
