Accusations that Newag (PL) is intentionally making its trains fail

[A S Leib]

https://notesfrompoland.com/2023/12...o-its-trains-to-gain-more-servicing-business/

I don't know anything about Newag; this really doesn't seem good though.

One of Poland’s largest train manufacturers, Newag, has been accused of deliberately programming failures into its vehicles to gain more business servicing them.

The firm has denied the reports and announced legal action against those responsible for spreading the claims. However, its shares plunged on the news this morning, dropping as much as 17% at market opening.

A minister in Poland’s recently departed government also appeared to confirm at least part of the claims, saying that the authorities have been aware of them since May this year and suggesting that Newag had used “a cyberweapon against its own customers”.

The story has its origins in 2022, when trains produced by Newag and belonging to local railway operators came to a standstill in several places in Poland.

The trains could not be restarted after they had undergone servicing by Newag’s competitors or, in some cases, after they had travelled one million kilometres, reported news website Onet today. In other instances, they stopped working for no apparent reason after the date 21 November.

One of the companies servicing the trains, SPS Mieczkowski, was baffled by the problem, as there was no indication of any error.

However, because SPS could not resolve the issue, it began to face contractual penalties from a rail operator, Koleje Dolnośląskie, that had hired it to service the vehicles. The fines eventually totalled 2 million zloty (€462,000).

Koleje Dolnośląskie came to the conclusion that SPS did not have the necessary know-how to service modern trains produced by Newag. So it sent them back to the manufacturer, which, after receiving an additional fee, found them to be working.

According to Onet, citing industry sources, the issue “started to get complicated” when it became apparent that trains that were not serviced by SPS, but had been standing in train sheds for ten days, were also stopping running.

“This had already become very suspicious, and stories have started to spread in the industry that Newag itself is behind the mysterious faults,” a source connected to one of the train service companies told the website.

SPS, aware of rumours that the problem lay in the train’s software, reached out to a well-known collective of Polish hackers known as Dragon Sector.

According to both Onet and Zaufana Trzecia Strona, a cybersecurity website, the hackers discovered that the trains had been deliberately programmed to stop working in certain circumstances.

“We are sure that it was a deliberate action on Newag’s part,” Michał Kowalczyk of Dragon Sector told Onet. “We discovered the manufacturer’s interference in the software, which led to forced failures and to the fact that the trains did not start.”

Kowalczyk – whose team also worked on Newag trains owned by other operators – notes that they discovered, for example, programming that stopped the train from starting up again if it had been stationary for 10 days or more.

“Someone apparently came up with the idea that, if the train is standing still, it must be under servicing,” said Kowalczyk. However, it later transpired that this was stopping trains from working that had simply been parked in train sheds temporarily.

“Someone at Newag rightly decided that this spoiled the narrative about the incompetence of the SPS,” continued Kowalczyk, whose team then later found new programming that caused the trains not to move if they were located at the service workshops of SPS and other firms in the industry.

Following the media reports, today Janusz Cieszyński – who served as minister of digital affairs until last week – confirmed to Onet that hackers from Dragon Sector had informed the authorities of their findings in May this year.

He said that the case was under investigation but did not provide further details. However, in a post on X, Cieszński shared Zaufana Trzecia Strona’s report and wrote: “I recommend this article about how Newag used a cyberweapon…against its own customers.”

The firm itself, however, strongly denies the allegations. In response to questions from Onet, it said that the conclusions of the journalists and hackers were wrong. Newag said the problems with its trains were related to interventions by third parties of which the company had notified the “relevant services”.

In a further comment to Business Insider Polska, Newag’s CEO, Zbigniew Jakubas, called the Onet publication “unreliable” and said that it “constitutes manipulation of Newag’s share price”.

“This matter must be dealt with by all state authorities and services. Appropriate notices and lawsuits against all persons influencing the creation of this damaging material will be filed immediately,” Jakubas said.

This morning, Newag’s shares plunged as much as 17% but recovered during the day to end trading just over 6% down.

 

[ijmad]

Astonishing if true.

Louis Rossmann (a well-known US based right to repair advocate) has covered this in video form, basically summarising the report from the hackers you detail above, and giving some of his own commentary.

 

[Robski_]

I have summarised the whole fiasco from this summary of a talk delivered by the hackers at "Oh My Hack" (in Polish):

There was a tender put out for the servicing of a fleet of 45WE Newag trains operated by Koleje Dolnoslaskie (KD). Newag and another company, SPS, put tenders in. Newag's bid was 3m zl above SPS's tender, so SPS won. After the first train went through this tender, it refused to work. The same happened to the second, third and fourth trains put through the servicing regime. SPS decides to call in hackers, "Dragon Sector", to investigate, because up to that point Newag refused to help KD, stating that it was an SPS issue.

At this point, KD has to introduce an emergency timetable with rail replacement buses because the entire KD 45WE fleet (consisting of the longest trains in KD's fleet) was out of service. KD ultimately is forced to ask Newag to fix the trains, but KD wouldn't commit to terminating the SPS contract for another week to give SPS one last shot. During that week, the hackers try desperately to get the train to start, setting fire - literally - to the on board computer in the process. About 45 minutes before a KD representative was due to arrive to confirm whether the contract should be terminated, the hackers manage to start the train. KD decide not to terminate the contract with SPS and do not send the trains to Newag.

The hackers discovered that there was a geolocation check in the code, which disabled the train if it spent more than 10 days within the bounded region. SPS's servicing facility and PESA's (largest train builder in Poland, state owned) servicing facilities, amongst others, were allegedly included. There was another train with code instructing it to fail once it hit 1,000,000 km travelled distance, and another instructing the train to fail with a compressor fault on November 21st 2021 (however the code to cause this fault was not written correctly, and so it occurred in 2022). They also discovered devices on board and in depots labelled "UPD<->CAN converter" - but removing this device from the train didn't do anything. It is alleged that it was a device that sent the "lock status" of the train to Newag, as it had a GSM modem.

By this point, there is a lot of media attention on the situation (after all, an emergency timetable is in place). Once the first train was "fixed" by the hackers, Newag seemed to move quickly and disabled the method the hackers were using to "fix" the first train through a software update. This was made obvious when a train, which Newag thought should be disabled, was moving and so the train showed an error message informing the driver of a moving train that violation of copyright law is illegal (referring to the way the hackers reverse-engineered the software).

The Polish Rail Regulator, UTK, published a statement, translated below:

The President of UTK is aware of the matter and has verified the information regarding the analysis of railway vehicle software carried out, and is also cooperating with the relevant services on this matter. Together with CERT Polska (a team established to respond to incidents violating Internet security), a meeting with the vehicle manufacturer was organized. The vehicles meet the essential requirements specified in the provisions of European directives. It is the person ordering the vehicle that determines the terms of service and warranty within the scope of contractual freedom. Such requirements are included in train purchase contracts. Any limitations on servicing capabilities, including limitations introduced in the software, may constitute a potential civil dispute between the ordering party and the manufacturer. The President of UTK is not the competent authority in this matter.

Pursuant to Art. 41 point 2 of the Act of July 5, 2018 on the national cybersecurity system (consolidated text: Journal of Laws of 2023, items 913, 1703), the authority responsible for cybersecurity for the transport sector (excluding the water transport subsector) is the minister responsible for transport matters.

Newag fervently deny all of this, and has today called for UTK to revoke the certificates of any "hacked" trains claiming that they are unsafe and that hacking trains is illegal (despite SPS having a valid certificate for overhauling and servicing trains). Their stocks crashed -17% when markets opened today. Newag is planning to take all parties involved to court.

There may be errors in how I have translated the whole situation, as at the moment the exact extent of the situation is not clear. I may have missed some bits too.

 

[popeter45]

wonder how this will effect the Akiem deal for 30 locomotives

 

[AlastairFraser]

Newag fervently deny all of this, and has today called for UTK to revoke the certificates of any "hacked" trains claiming that they are unsafe and that hacking trains is illegal (despite SPS having a valid certificate for overhauling and servicing trains).

Sounds like they've been caught with their pants on fire and are doing damage limitation

 

[dutchflyer]

Thanks Robski for the clear explanation.
IF this is all true, then how could managers or those with decision powers @ Newag even think this would go unnoticed? Or was it just to wreck for a shortish period the movement of their trains? Well-the answer to that will probably never come out.
As an aside; KD with its yellow trains in the south-west corner of the country, main base Wroclaw, is IMHO one of the finest local companies for trains in PL.

 

[Gag Halfrunt]

I have summarised the whole fiasco from this summary of a talk delivered by the hackers at "Oh My Hack" (in Polish):

There was a tender put out for the servicing of a fleet of 45WE Newag trains operated by Koleje Dolnoslaskie (KD). Newag and another company, SPS, put tenders in. Newag's bid was 3m zl above SPS's tender, so SPS won. After the first train went through this tender, it refused to work. The same happened to the second, third and fourth trains put through the servicing regime. SPS decides to call in hackers, "Dragon Sector", to investigate, because up to that point Newag refused to help KD, stating that it was an SPS issue.

At this point, KD has to introduce an emergency timetable with rail replacement buses because the entire KD 45WE fleet (consisting of the longest trains in KD's fleet) was out of service. KD ultimately is forced to ask Newag to fix the trains, but KD wouldn't commit to terminating the SPS contract for another week to give SPS one last shot. During that week, the hackers try desperately to get the train to start, setting fire - literally - to the on board computer in the process. About 45 minutes before a KD representative was due to arrive to confirm whether the contract should be terminated, the hackers manage to start the train. KD decide not to terminate the contract with SPS and do not send the trains to Newag.

The hackers discovered that there was a geolocation check in the code, which disabled the train if it spent more than 10 days within the bounded region. SPS's servicing facility and PESA's (largest train builder in Poland, state owned) servicing facilities, amongst others, were allegedly included. There was another train with code instructing it to fail once it hit 1,000,000 km travelled distance, and another instructing the train to fail with a compressor fault on November 21st 2021 (however the code to cause this fault was not written correctly, and so it occurred in 2022). They also discovered devices on board and in depots labelled "UPD<->CAN converter" - but removing this device from the train didn't do anything. It is alleged that it was a device that sent the "lock status" of the train to Newag, as it had a GSM modem.

By this point, there is a lot of media attention on the situation (after all, an emergency timetable is in place). Once the first train was "fixed" by the hackers, Newag seemed to move quickly and disabled the method the hackers were using to "fix" the first train through a software update. This was made obvious when a train, which Newag thought should be disabled, was moving and so the train showed an error message informing the driver of a moving train that violation of copyright law is illegal (referring to the way the hackers reverse-engineered the software).

The Polish Rail Regulator, UTK, published a statement, translated below:


Newag fervently deny all of this, and has today called for UTK to revoke the certificates of any "hacked" trains claiming that they are unsafe and that hacking trains is illegal (despite SPS having a valid certificate for overhauling and servicing trains). Their stocks crashed -17% when markets opened today. Newag is planning to take all parties involved to court.

There may be errors in how I have translated the whole situation, as at the moment the exact extent of the situation is not clear. I may have missed some bits too.

There's an English translation of the article.

Dieselgate, but for trains – some heavyweight hardware hacking

[this is an English translation of the original article in Polish, we occasionally publish the best cyber stories from Poland in English] A train manufactured by a Polish company suddenly broke down during maintenance. The experts

badcyber.com

 

[Robski_]

The Polish Internal Security Agency has notified the the District Prosecutor's Office in Nowy Sącz about a reasonable suspicion of a crime being committed "in the case relating to software on board Newag Impuls trains." The alleged charges are destroying digital data under art. 269 para. 1 of the legal code, and fraud under art. 286 para. 1. Both charges carry sentences between 6 months and 8 years.

The ISA have not mentioned who is being accused, and the DPO have not confirmed if charges have been authorised.

 

[Cloud Strife]

There may be errors in how I have translated the whole situation, as at the moment the exact extent of the situation is not clear. I may have missed some bits too.

Translation looks fine to me.

Newag are doubling down and claiming that it's all a hoax, but it's pretty clear that they knew exactly what was going on. KD made it clear last year that Newag refused to tell them what was done to repair the train that was taken to them, and there are enough suspicious failures from other companies to confirm that something was going on here.

The ISA have not mentioned who is being accused, and the DPO have not confirmed if charges have been authorised.

The curious thing is that Newag are now claiming that they themselves noticed the ABW (ISA for our non-Polish speaking friends), which means the story is more and more ridiculous. I suspect that this is really about damage limitation at this point, because every operator of Newag rail vehicles is now going to demand independent analysis of the source code and so on.

A railway friend in PKP suggests that Newag probably expected to make a lot of money from post-warranty servicing, and this was built into the prices of the vehicles.

 

[Robski_]

The cybersecurity group who discovered the malicious code, "Dragon Sector", have put out a statement, translated below (may contain errors - I put this in google translate and corrected most of the mistakes instead of manually translating the entire thing).

We are a group of three independent cybersecurity researchers and members of the Dragon Sector group. At the OhMyH@ck conference on 2023/12/05, we presented our analysis of Newag Impuls train processors/controllers. In the code of these processors, after downloading it from the device and reverse engineering it, we discovered an undocumented complex locking system. We started the analysis at the request of SPS ASO Mieczkowski in May 2022.

This system effectively immobilized the trains while they were being serviced at independent workshops providing P2/P3 inspections. This system checked various conditions (e.g. recorder readings, date, geographical coordinates from GPS) and when any condition was met, it blocked the train. The blocked train did not show any error code, it was ready to move and when given a driving command it only released the brakes (without activating the inverters that power the vehicle's engines). There is no mention of this behavior in the Impuls technical documentation.

We have already analyzed 29 vehicles and 24 of them had a more or less advanced locking system. The conditions causing the vehicle to stall varied between different trains and sometimes even changed between visits to Newag workshops. With our successes in restoring trains to running, newer versions of the software in the Impuls controllers have had the train unlocking mechanism (an arbitrary sequence of pressing appropriate buttons in the driver's cabin) removed.

The conditions we found for enabling the lock include:
- Train stoppage for 10 days (21 days in later software versions)
- Stop at independent workshops based on GPS readings
- Replacing some system components (CAN831)

We also found a software version that reports an auxiliary compressor failure starting from the expected day of the train's P3 inspection or after a mileage of more than one million kilometers.

In at least one of the trains, the train locking mechanism may also have been activated by a device bridging network connectivity (UDP) to the train's CAN bus.

We are 100% confident in our analysis. Technical reports prepared on its basis were submitted to workshops cooperating with us, carriers and relevant authorities and institutions. We have secured copies of all software versions we found from all the vehicles we analyzed. Some of these safeguards were carried out through a commission with the participation of independent auditors.

At the same time, we would like to correct frequent misunderstandings in the media:

We did not interfere with the code of the controllers in Impuls vehicles - all vehicles still run on the original, unmodified software. It is not possible to update the software in Impulse remotely (e.g. via GSM/Internet).

We are responding to the Newag Statement of 2023/12/06:

"Our software is clean. We have not introduced, we do not introduce and we will not introduce into the software of our trains any solutions that lead to intentional failures. This is slander from our competition, which is conducting an illegal black PR campaign against us - NEWAG firmly denies Onet's manipulated information and his interlocutors, i.e. representatives of a group of hackers hired by a competing company - SPS Mieczkowski. However, the service of previously delivered sets generates only about 5 percent of NEWAG's revenues. This is a fraction of the business, unlike the company "SPS Mieczkowski", whose business model relies on servicing vehicles."

The results of analyzes carried out by Dragon Sector on the software of Newag's Impuls trains clearly show that the software contained malicious code simulating faults, activated, among other things, based on the GPS coordinates of repair shops competing with Newag. The term "hacker group" contained in President Konieczek's statement may in everyday language evoke negative associations, but we accept such terminology without resentment and understanding this term as a mental shortcut. We are a group specializing in cybersecurity and reverse engineering, and software analyzes of Impuls trains produced by Newag at the request of several entities, both carriers and other service workshops, not only SPS Mieczkowski. We helped 10 operators and workshops, and 29 vehicles were analyzed. We have prepared several detailed technical reports analyzing various cases. The reports contained a thorough analysis of the operation of the vehicles, detailed explanations of the operation of some of the programs responsible for the faults, and an explanation of the methodology we used.

"The manufacturer of the system controllers allows and has provided access to the vehicle control software at all times."

The manufacturer of the CPU831 driver, Selectron, does not provide tools directly to download the code installed on the driver. This was only possible thanks to our analysis and creation of special tools.

"Consequently, at any time it was possible to reverse engineer the control software (i.e. hack it) by transferring its decompilation code, modifying it and reloading the changed control software."

The above words prove the gross technical incompetence of the author of the statement. There are no tools that allow you to decompile the code generated for the Selectron CPU831 controller in such a way that it can be recompiled. The only existing tools allow you to understand how the code works and possibly make simple changes, but they do not allow you to introduce such a comprehensive locking system as we found.

"It is not true that we caused faults in our trains to allegedly take over orders for their repair. This is slander. The company servicing rolling stock for the Lower Silesian Railways was unable to fulfill the order to service our trains and, in order to avoid contractual penalties, created this conspiracy theory for the media. We learned from Onet that she had hired hackers who were to create a report blaming us for her - says Zbigniew Konieczek, president of NEWAG S.A. - We do not know this document, we do not know how it was created, what is the adopted methodology, on the basis of which its baseless NEWAG, theses. Apart from false allegations, no evidence was presented that our company intentionally installed the faulty software. In our opinion, the truth may be completely different - that, for example, the competition interfered with the software."

It is undisputed that the functionalities described by us during the conference and earlier in the reports were present in the programs installed in the processors controlling the Impuls trains. In response to the statement that malicious code fragments were the result of the activities of entities other than Newag, we can say that this is a rather inept and at the same time risky line of defense, because the functionalities were introduced in a way that indicates full access to the program's source code. In several cases, vehicles were sent to Newag for repairs and we downloaded the code just before sending it to Newag and compared it with the code downloaded right after returning from service at Newag. After arrival, the code uploaded to the controller changed and, in particular, contained significant changes in the locking logic (for example: the parking time after which the vehicle was to be blocked was extended from 10 to 21 days).

Considering that the lock code does not appear to have been disguised in any way, we believe that Newag was not aware that it was possible to detect this interference using reverse engineering and the possibility of thorough analysis of the functionality uploaded to the controller - in particular, the presence of checking the GPS geographical coordinates of competitor workshops.

"We have notified the relevant services in this matter. It is not the first time that we have notified law enforcement agencies that our software is being modified without our authorization. We also informed about it publicly in 2022. Therefore, it is surprising that Janusz Cieszyński, former Minister of Digitization, spoke about ongoing investigations, contributing to the dissemination of false and highly harmful information about NEWAG, and not adding that it was initiated based on our notifications - adds Konieczek."

Also now, in connection with the information publicly provided by Onet and its interlocutors that the control systems of NEWAG trains have been hacked - out of concern for the safety of passengers, we have submitted appropriate notifications to the relevant authorities.

"Hacking IT systems is a violation of many legal provisions and a threat to railway traffic safety."

"In the current situation, the above statement sounds not only like a cliché, but also like a grim joke. What regulations did Dragon Sector violate? I'll answer. It did not meet the criteria of any crime specified in Chapter XXXIII of the Penal Code." said Zbigniew Krüger from the Krüger & Partners law firm, who is the IT specialists' representative.

 

[AlastairFraser]

The cybersecurity group who discovered the malicious code, "Dragon Sector", have put out a statement, translated below (may contain errors - I put this in google translate and corrected most of the mistakes instead of manually translating the entire thing).

NEWAG seems to be playing a dangerous game, unless they are genuinely being honest and this is a ploy by the competitor.

 

[Gag Halfrunt]

NEWAG are now threatening to sue the hackers.

Polish Hackers Repaired Trains the Manufacturer Artificially Bricked. Now The Train Company Is Threatening Them

After breaking trains simply because an independent repair shop had worked on them, NEWAG is now demanding that trains fixed by hackers be removed from service.

www.404media.co

All of this has created quite a stir in Poland (and in repair circles). NEWAG did not respond to a request for comment from 404 Media. But Rynek Kolejowy reported that the company is now very mad, and has threatened to sue the hackers. In a statement to Rynek Kolejowy, NEWAG said “Our software is clean. We have not introduced, we do not introduce and we will not introduce into the software of our trains any solutions that lead to intentional failures. This is slander from our competition, which is conducting an illegal black PR campaign against us.” The company added that it has reported the situation to “the authorized authorities.”

 

[Robski_]

The case was transferred yesterday from the District Prosecutors Office in Nowy Sącz to the Regional Prosecutors Office in Krakow. Also, UTK (rail regulator) has announced it will not be intervening. Still no word on who is the alleged offender.

 

[eldomtom2]

If I was involved with rolling stock procurement I would be looking very seriously at the possibility of establishing open-source standards for train software...

 

[A S Leib]

The case was transferred yesterday from the District Prosecutors Office in Nowy Sącz to the Regional Prosecutors Office in Krakow. Also, UTK (rail regulator) has announced it will not be intervening. Still no word on who is the alleged offender.

Is that affected by the new government being formed at all, and is rolling stock procurement something which has been particularly politicised?

 

[Gag Halfrunt]

The new government was sworn in today (Wednesday). PiS were still in power until then.

Tusk's new Polish government sworn in by President Duda

"We come from different political camps but I am open to cooperation," Duda told the new government.

notesfrompoland.com

Poland’s new government, led by Donald Tusk, has been sworn into office by President Andrzej Duda. It marks the end of eight years of rule by the national-conservative Law and Justice (PiS) party and the start of a four-year term for a more liberal coalition of parties ranging from left to centre-right.

 

[Robski_]

Is that affected by the new government being formed at all

As far as I know, no. The transfer to the RPO indicates that it is a major case which the DPO can't handle. As for the UTK not intervening, they have stated that they have not received any official complaints as of yet so they won't be investigating.

is rolling stock procurement something which has been particularly politicised?

Route modernisations are generally more politically important/subject to more political interference rather than rolling stock. Although PESA, Newag's main competitor, is state owned so there is that.

If I was involved with rolling stock procurement I would be looking very seriously at the possibility of establishing open-source standards for train software...

Unlikely to ever happen. All the manufacturers would demand that their way of doing things should be the established standard.

 

[eldomtom2]

Unlikely to ever happen. All the manufacturers would demand that their way of doing things should be the established standard.

Yet rolling stock standards do exist...

 

[Fragezeichnen]

I don't understand how that's relevant here at all.

So you get a dump of a few million lines of this "open source" code from the manufacturer, what happens then? You are supposed to hire people to check throught it all to assure yourself that the product you brought was not purposefully sabotaged by the manufacturer, and then again every time the software changes? Should the customer all demand circuit diagrams, and check every solder trace, to check for sabotage there, too? And anyway, as mentioned in the article, finding out what software is actually on the train, as opposed to what your were told is on it, is very difficult.

They did something they shouldn't have done, they will definitely be sued, and perhaps criminally prosecuted. But trying to treat your own supplier as a foreign agent is just silly.

 

[edwin_m]

I don't understand how that's relevant here at all.

So you get a dump of a few million lines of this "open source" code from the manufacturer, what happens then? You are supposed to hire people to check throught it all to assure yourself that the product you brought was not purposefully sabotaged by the manufacturer, and then again every time the software changes? Should the customer all demand circuit diagrams, and check every solder trace, to check for sabotage there, too? And anyway, as mentioned in the article, finding out what software is actually on the train, as opposed to what your were told is on it, is very difficult.

They did something they shouldn't have done, they will definitely be sued, and perhaps criminally prosecuted. But trying to treat your own supplier as a foreign agent is just silly.

There should be something in the contract about the supplier having a duty to co-operate with a third party maintainer. This might involve the supplier getting a payment if the case of a genuine problem the maintainer couldn't fix, and not within warranty or down to the supplier's product or documentation being defective. I'd guess there is some general law that would cover making a product become deliberately defective when someone else attempts to maintain it, especially if the contract made clear that maintenance would be tendered to other parties.

(always assuming this is genuinely a software trap introduced by NEWAG and not an attempt to frame them)

 

[AdamWW]

And anyway, as mentioned in the article, finding out what software is actually on the train, as opposed to what your were told is on it, is very difficult.

Well yes but I don't think it has to be made that difficult.

I'd have thought that a requirement to be open about software on trains would be something of a deterrent to unethical behaviour whether the customer actually paid someone to trawl though the code or not.

 

[Cloud Strife]

Is that affected by the new government being formed at all, and is rolling stock procurement something which has been particularly politicised?

Under the last government, absolutely everything was politicised. While it would take a lengthy explanation to explain it all, Newag seem to be trying to go down the line of argumentation that this is some sort of framing by the previous government so that they could take over Newag on the cheap before merging it with other state-owned companies. This sort of dirty trick was quite common under the last government, as for instance, a state-owned printing company used various government institutions against a private company that won the tender to print school exams.

However, this argument doesn't hold up for a simple reason: Newag were very close to the last government anyway.

So you get a dump of a few million lines of this "open source" code from the manufacturer, what happens then? You are supposed to hire people to check throught it all to assure yourself that the product you brought was not purposefully sabotaged by the manufacturer, and then again every time the software changes?

That's not how open source works. The general idea is that if the software is open source, then it's available for anyone to have a look through, and they will. It's very difficult to conceal such traps in open source software, because the open nature of it means that it'll be found sooner rather than later, even by other companies that might want to adapt it for their own use. More to the point, open source means that changes can be tracked, so Newag's deceit with software would be very quickly found. Closed source in comparison just leads to the situation that KD encountered, that is, Newag simply refused to tell them what was done to make the trains work.

It should be a requirement for open source software to be used when it comes to state procurement. There's really no reason for it not to be used, except in fringe situations where the regulatory environment is so complicated that it's not possible, such as in aviation.

 

[nwales58]

Open source has many virtues but ...

In this situation you typically have binaries from the supplier going into production use without customer engineering intervention.

If you build a release yourself you seldom get an identical binary to the one in use, in my limited experience in a different area, and the supplier does not see why it matters if the contract is that they maintain the software. You also discover 3rd party object code which is not open source or is not reproduceable for some reason.

Few customers, especially not small railways and small engineering companies, have the software engineering resources to validate builds and control deployment outside of safety-critical areas such as aviation and nuclear.

Imagine, in the small hours the (train, not software) maintenance engineers are told that a new build mends the intermittent door interlock problem that has been knackering performance. They OK its deployment to get the trains out in the morning. Problem solved. Future malware installed too.

So the misbehaviour is unlikely to be found in practice until someone investigates retrospectively.

It would need very different contracts and processes around embedded software to do this properly. I suspect management would nod earnestly, ask for the costs then not do it.

 

[Robski_]

UOKiK (competition and consumer protection regulator) has announced that they had started preliminary inquiries into the situation on December 7th following a request from MPs belonging to the "Razem" ("Together", social democrats) party. The party press office also seemed to indicate that Newag is the defendant/suspect in the ABW investigation.

On 21st December, an Impuls unit operated by Polregio (ED78-010) broke down with a compressor fault. Polregio have refused to confirm the nature of the breakdown, but it is widely believed to be the date checking breakdown "feature" allegedly implemented by Newag. This unit also "broke down" on 21st November with an identical fault, but then fixed itself on 1st December - the cybersecurity experts who are responsible for revealing the information about the code speculate that the train will again fix itself on 1st January.

Newag have now announced they are going to sue Onet, the news website which reported this.

Source: https://www.rynek-kolejowy.pl/wiado...1-grudnia-mamy-stanowisko-newagu--116695.html

 

[popeter45]

talk from the hackers on what they found

 

[bobcov]

talk from the hackers on what they found

It's quite a talk. Absolutely riveting and disgusting at the same time. You can see exactly what was done to disable the trains. The reason becomes obvious. If I were buying trains, I would be looking elsewhere.

 

[Robski_]

ED78-010 was returned to service 1st January 2024. No repairs were made to the unit.

If I were buying trains, I would be looking elsewhere.

PKP Intercity announced on Wednesday that Newag have won yet another rolling stock tender - in fact, the largest single order by PKPIC for locomotives of one type (63 locomotives + 32 options) - so unfortunately nothing has changed.

 

[AdamWW]

ED78-010 was returned to service 1st January 2024. No repairs were made to the unit.

PKP Intercity announced on Wednesday that Newag have won yet another rolling stock tender - in fact, the largest single order by PKPIC for locomotives of one type (63 locomotives + 32 options) - so unfortunately nothing has changed.

Presumably handled under EU procurement rules.

Perhaps someone more familiar than I am with the rules could comment on whether there would actually be any overt mechanism for not awarding them the tender if their bid was the most favourable, given that they haven't formally been found guilty of the accusations (even though it seems very likely that they're true).

Of course sometimes it's possible to unofficially exclude a supplier by careful construction of technical requirements based on knowledge of what they can or would be willing to supply.

 

[43096]

Presumably handled under EU procurement rules.

Perhaps someone more familiar than I am with the rules could comment on whether there would actually be any overt mechanism for not awarding them the tender if their bid was the most favourable, given that they haven't formally been found guilty of the accusations (even though it seems very likely that they're true).

Of course sometimes it's possible to unofficially exclude a supplier by careful construction of technical requirements based on knowledge of what they can or would be willing to supply.

Newag were reportedly the only bidder. Presumably there’s something in the ITT that others don’t like as you’d normally expect at least Alstom and Siemens to bid.

 

[bahnause]

Perhaps someone more familiar than I am with the rules could comment on whether there would actually be any overt mechanism for not awarding them the tender if their bid was the most favourable, given that they haven't formally been found guilty of the accusations (even though it seems very likely that they're true).

They don't have to award the tender. If they do, they have to award it to the winner.