Claims that new signalling "could be hacked...."

[martynbristow]

Ah yes. Why bother? It's obvious nobody's going to bother hacking this (because Land Rovers), so let's not bother with security models.

I think that's called Security by Obscurity, and quite a number of people have lost a lot of money assuming that was safe enough.



I really hope you're not a developer of critical systems (though for the record, neither am I). Simply not being connected to the Internet really isn't enough.

The Iranian nuclear centrifuge control systems weren't connected to the Internet at all, but a fairly simple attack vector led to them being infected by Stuxnet - USB pen drive.
http://en.wikipedia.org/wiki/Stuxnet



Nope. As long as you can socially engineer someone to stick that pen drive in, you still don't need to ever go near the railway.



Really, a lack of Internet access is not enough to make a system secure!

Also, these systems are connected to the Internet somewhere along the way - how else would the Open Data sites get details about realtime running? How would the berth data get to OpenTrainTimes so Poggs can produce his maps, if not from the signalling centre or another part of the signalling system?

You've taken it out of context!
Why bother hacking a system when you can get the same access another way which is much easier/cheper. You could have the best firewall in the world but as you put USB sticks pose a risk and also it was mentioned about the human influence in the original article.

With regards to USB devices its simple. BAN THEM! Previously I worked in a job where USB sticks were banned unless they were specially authorised. On a secure system just block off the USB ports or remove the driver.
Stuxnet malware was creative and was more of an exploit. You would need to find an equivalent parallel in the railway industry which would require in-depth knowledge of the systems.

 

[LexyBoy]

Exactly - yes, it will be possible given enough resource.

But if your aim is to cause hundreds of deaths and/or economic chaos, there are and will remain many much, much easier ways, many of which require nothing more than a suitable implement for bonking people on the head. That this doesn't tend to happen is a credit to the fact that people are generally decent, and that we have government agencies to stop those that aren't.

 

[MarkyT]

Simply not being connected to the Internet really isn't enough.

Of course it isn't and I never said it was. Encryption is used in the hardwired trackside data links as well, and even if you managed to defeat that and could read the raw data in messages, unless you knew the full engineering configuration of the specific site you were attacking you would be able to make little sense of it.

Nope. As long as you can socially engineer someone to stick that pen drive in, you still don't need to ever go near the railway.

Signalling, since its inception, has always incorporated a core safety layer in it's architecture, the interlocking. This is where most effort is made to ensure unsafe combinations of output signal states cannot occur. ETCS does not change this.

For original SSI installations, the interlocking logic that interprets control centre requests and issues trackside commands to moves points and clear signals is run on triplicated majority voting custom hardware housed at secure sites using programs and site-specific data burned in EPROMs that cannot be changed in service without first shutting the system down which means all signals at red or the ETCS equivalent. Official reconfiguration is tightly controlled and can only be carried out under a possession shutdown with rigourous handover and handback procedures and lots of paperwork. There simply is no way an external drive could be inserted containing malwar. Newer interlocking hardware products are based to a greater extent on generic industrial process control components, but they certainly are not 'off the shelf' PLCs. In approval of such systems for railway signalling use, manufacturers have had to prove that the system and its configuration procedures are at least as secure as older systems and conform to SIL4, the highest safety integrity level possible. That process requires exhaustive risk analysis of all failures and attacks known and envisaged. Specialists and consultants are employed widely for their particular fields of expertise, in EMI and security for instance, and there are constant independent reviews at all stages. A very complex and expensive but neccessary process when so many lives depend on it.

In its unending pursuit to fail safe, signalling technology is and always has been quite vulnerable to 'denial of service' incidents. System performance is often balanced on a knife edge between sensitivity and reliability. Theft of cable in old relay technology areas invariably results in signals reverting to red on loss of control, if not complete power disconnection. In modern systems with their greater centralisation, reliability has become a major preoccupation and there are safety implications as well because a system that fails frequently (albeit safely) leaves the operating railway full of passengers under the manual control of signallers and drivers exchanging verbal commands and confirmations. That is very slow compared to normal operations and much more open to human error. Using the fibre FTN assists providing instantly switchable diverse routing for remote links in the case of cable damage.

Also, these systems are connected to the Internet somewhere along the way - how else would the Open Data sites get details about realtime running? How would the berth data get to OpenTrainTimes so Poggs can produce his maps, if not from the signalling centre or another part of the signalling system?

Interlocking computers can only accept certain kinds of commands on specific hardware configured ports from the control centre. These are route or point movement requests, and engineering disconnections which can lock certain parts of the track layout or specific routes or points out of use. No other instructions can be interpreted by the interlocking successfully. The real-time states of all signals, points and tracks circuits are exported continuously via another output port to the control centre, and it is there that the steps are interpreted and linked to the headcodes for the Train Describer functionality and the results exported to other systems.

Encryption in GSM was hacked many, many years ago. The particular cipher in question (A5/1) continues to be used for basic GSM (i.e. 2G) communications.
http://en.wikipedia.org/wiki/A5/1

New ciphers were of course introduced as 3G and LTE came along, but for backwards compatibility reasons they weren't introduced onto 2G.

I can't find anything stating which ciphers are used in GSM-R specifically, but it's interesting that the following document notes, on page 7, that GSM-R should be considered basically open from a safety standpoint.
http://www.bane.dk/db/filarkiv/5589/Boundaries between ETCS and the GSM-R network.pdf

Happily, they do seem to have taken security into account in designing ETCS, and as you note - they are running their own encryption on top (diagram on page 6).

That has always been the case. In designing digital systems to respond safely to environmental interference and hardware malfunction much of the work to protect against maliciuos attack has already been done. The continuing challenge in the future is to harden the systems further to create greater resilience to denial of service attacks as part of the reliability effort.

The ETCS concept is not fundamentally reliant on using GSM-based radio specifically, and might adapt plausibly to offer alternative open radio standards in the future like other communications based control systems.

For its (admittedly non-ETCS) urban SELTRAC system Thales now offers a variant which dispenses with the unloved continuous leaky feeder cable between the rails (as used in London for Jubilee, Northern and Docklands lines) in favour of closely spaced overlapping radio transceivers using IEEE 802.11 standards.

https://www.thalesgroup.com/sites/default/files/asset/document/SelTracBrochure_CBTCSolutions_eng.pdf.

TfL intends to use SELTRAC for extensively upcoming TfL schemes covering the entire 'subsurface' network (Circle, Metropolitan, District, Hammersmith & City) and the Piccadilly Line. Perhaps these will incorporate the 802.11 solution.

 

[Pigeon]

On the topic of a *DoS attack, its more of interference as your using the wrong protocol.
This could be mitigated by using large enough signal (broadcast power). To destroy this you would need to use the same the same exact frequency with a large enough noise. It becomes a balance. If its (ERTMS) built on the cheap (economic side) then this would be simple, but if the power was strong enough you would need a very large power source to override it, as digital communication is more resilient to interference and its binary in its nature. It wouldn't be hard to find such a power source or broadcast if you knew how to do it. Theoretically it would be very easy but I think in practise it could become cumbersome without expert planning.

The resilience of digital systems to interference isn't the point. I'm talking about exploiting the limited dynamic range of the front end of the radio, by broadcasting enough power to overload it so no usable signal makes it through to the demodulator. All this needs is an oscillator connected to an antenna, and at the sort of frequencies in question an efficient antenna can be very small.

Fibre optics can't be "tapped" they can be tampered with and you can use a relay etc. But you can't look into a fibre, unless you can defy laws of optics. In the short it requires extra equipment, tools and skill and will give an outage which a system should detect.

Oh, it can; the technology exists...

I agree that it's not worth it for trying to interfere with signals, that level of technology is much more likely to be used by the intelligence services for keeping an eye on foreign powers.

...and is so used. Apparently they can even tap undersea fibre optic cables.

Stuxnet malware was creative and was more of an exploit. You would need to find an equivalent parallel in the railway industry which would require in-depth knowledge of the systems.

Again, a government level agency would have no problem obtaining that knowledge.

This thread still seems to be unclear over what threats potentially exist. Terrorists wanting to cause a crash aren't a big deal since they could far more easily do it using less sophisticated methods. Terrorists wanting to cause disruption, though, have their job made easier since there is no longer any need to physically connect to railway systems. To cause massive disruption would be something a government level agency would be interested in; it is the same concern as exists in some quarters over the amount of Chinese-manufactured hardware in our telecoms infrastructure. Of course, I am probably not helping the lack of clarity with my compulsion to pedantry over tapping fibre optics

 

[martynbristow]

The resilience of digital systems to interference isn't the point. I'm talking about exploiting the limited dynamic range of the front end of the radio, by broadcasting enough power to overload it so no usable signal makes it through to the demodulator. All this needs is an oscillator connected to an antenna, and at the sort of frequencies in question an efficient antenna can be very small.



Oh, it can; the technology exists...



...and is so used. Apparently they can even tap undersea fibre optic cables.



Again, a government level agency would have no problem obtaining that knowledge.

This thread still seems to be unclear over what threats potentially exist. Terrorists wanting to cause a crash aren't a big deal since they could far more easily do it using less sophisticated methods. Terrorists wanting to cause disruption, though, have their job made easier since there is no longer any need to physically connect to railway systems. To cause massive disruption would be something a government level agency would be interested in; it is the same concern as exists in some quarters over the amount of Chinese-manufactured hardware in our telecoms infrastructure. Of course, I am probably not helping the lack of clarity with my compulsion to pedantry over tapping fibre optics

DOS normally refer to a specific IP threat, but this is more jamming the signal using a brute force method. If your block a small area of the spectrum then the communication can use a different available waveband, systems will need to have such resilience built in. To block more parts of the spectrum simultaneously would require more power and be larger.

I'm aware of methods to break into fibre optics but it will leave traces in the signal which can be detected.