A cheap radio hack disrupted Poland's railway system
wired.com
wired.com
Fortunately, that one is not quite the case – the aviation industry is incredibly safety-conscious and does not allow relying on GPS exclusively.
For both en-route navigation and landing, every plane will have at least one fallback system available (usually ground-based radionavigation aides such as VORs or DMEs or inertial navigation systems, which is also what was used for navigation during ocean crossings before there was GPS), and in fact, these other systems are seeing more use than you might assume: https://www.thedrive.com/the-war-zone/17987/usaf-is-jamming-...
https://www.gpsworld.com/what-happened-to-gps-in-denver/
The advisory also said the Wide Area Augmentation System (WAAS) and
Ground-Based Augmentation System (GBAS), both designed to make
navigation with GPS more precise, as well as the ADS-B collision
avoidance and traffic management system, would be unreliable.
Pilots reported other systems affected such as transponders that help
radar controllers keep track of aircraft, traffic alert and collision
avoidance (TCAS) equipment, autopilots, electronic flight bags and
terrain warning systems.
Flights into the Dallas area are being forced to take older,
cumbersome routes and a runway at Dallas-Fort Worth International
Airport was temporarily closed after aviation authorities said GPS
signals there aren’t reliable.
Stanford researchers have determined that the interference event
lasted 24 hours, though it took the air traffic system another 20
hours to reset and recover.
https://www.gpsworld.com/nasa-report-passenger-aircraft-near...
A report filed with NASA’s Aviation Safety Reporting System and
published in June outlines how a passenger aircraft flew off course
during a period of GPS jamming and nearly crashed into a
mountain. Fortunately, an alert radar controller intervened, and the
accident was averted.https://www.faa.gov/about/office_org/headquarters_offices/at...
https://gssc.esa.int/navipedia/index.php/GBAS_Fundamentals
https://aerospace.honeywell.com/us/en/products-and-services/...
Even for "plain" (i.e. unaugmented) GPS, there's countermeasures, starting from simple physical ones (e.g. directional antennas leveraging the fact that GPS satellites are usually located above the airplane and not below or inside it), up to complicated logical filters checking all inputs for plausibility and rejecting suspicious signals and resulting position fixes.
Galileo even supports message authentication, which thwarts everything other than (very sophisticated) real-time signal relaying attacks: https://berthub.eu/articles/posts/galileos-authentication-al...
https://www.cnet.com/culture/truck-driver-has-gps-jammer-acc...
(aware of military receivers that can receive jam resistant signal, but that is not what commercial applications have access to)
The possibility of a large-scale GPS outage or jamming event is definitely a threat scenario that's being considered by aviation safety agencies. For example, here's the FAA's approach for en-route navigation redundancy, which includes maintaining enough VORs to ensure that there's at least one within every 100 nautical miles: https://www.faa.gov/about/office_org/headquarters_offices/at...
Yes, denying augmented GPS capabilities will probably impact operational efficiency significantly, but it shouldn't endanger safety.
Sure, I believe that in the air, GPS is redundant. But what Kelsey explained is that, before GPS and graphical maps, pilots on the ground would rely on paper charts that were manually updated and placed in huge binders. They would scour these paper charts to understand what taxiways they needed to take across the airport to get from gate to runway and back again.
Nowadays, the pilots have a nice screen where an image of the airport is displayed underneath a nice arrow depicting the aircraft in its GPS location and velocity. It's more difficult to get lost now, because you can see at a glance on the screen where you are. Looking outside your windows can often confuse, and fog and darkness and unfamiliarity can confound someone who is already lost.
The issue on 74 Gear was that someone got lost and thought they were in an entirely different location, when actually they had intruded on an active runway while just trying to taxi. A very dangerous situation, as you can tell.
I believe that, if GPS were jammed and unavailable, pilots would possibly be able to fall back on these paper charts, that is, if they are even being maintained anymore, but it would be error-prone, and any taxiing pilot would need to exercise utmost caution not to get lost like that.
Regarding the runway incursion scenarios, you need to pay attention to the lights on the taxiways, because runway entries are highly illuminated and visible even in really low visibility conditions. You just don't enter an active runway by mistake.
"Paper charts" as you call them, are physical charts of airpots maps akin to a city map. And as a pilot you are required to know how to read and use those maps. Just as with SID/STAR charts. Pilots are expected to know how to fly using only basic instruments (airspeed, altitude, attitude, vertical speed, compass, banking), and even with some of those not operational.
Long story short, GPS jamming at an airport is an inconvenience rather than something critical.
There is definitely responsibility on the pilots to not take a wrong turn, and that job gets harder without precision navigation systems, but more than one thing normally has to go wrong for a runway incursion to occur, as far as I understand.
This means that the standard movie-plot methods of hijacking aircraft are ridiculously easy to carry out: just bring weapons on a plane. There's only a 50% chance you get caught.
This means approximately no one wants to hijack airliners.
Between TSA missing most weapons while compulsively stealing cash, travelers would be far safer from genuine harm if the the agency didn't exist.
ref: https://reason.com/2021/11/19/after-20-years-of-failure-kill...
ref: https://duckduckgo.com/?q=tsa+seizes+cash
I just learned: It seems that state efforts to maximize gun possession have led to so many guns in airports - even TSA agents are starting to find them.
ref: https://www.forbes.com/sites/suzannerowankelleher/2022/11/01...
I was blown away with my first First-Class flying experience. You go through all this TSA security theater, and then they hand you a real metal steak knife and glass stemware shortly after take off.
You don't even need to bring weapons, they give them to you.
TSA stuff is all for show. It makes some people feel safer that they had to take off their belt or something...
You probably don't even need bullets honestly, just the visual aid.
You don't even need a gun though, a knife is plenty lethal on it's own and readily available inside the terminal and even on the plane.
Have you seen the kinds of people they put in that job? The whole thing is a farce.
I didn't ask for it back.
The bad guys know this: they figure an attempt to do a 9/11-style hijacking will result in failure and death without doing damage to anything but the plane itself. No flying into the Capitol or the Pentagon in a blaze of glory.
Americans won't see the enemy which is staring at us. Domestically it will have to get a lot worse over the next decade.
the hijack to end all hijacks?
Apart of some war zones or crime holes the world is quite safe and hospitable in general if one doesn't do stupid mistakes or really ask for problems. Every society has some form of agreed laws which try to correct a harmful behavior against them.
Accidental radio interference or setting fire can happen out of simple stupitidy or incompetence.
July 4th consistently has the highest amount of human-caused wildfire. https://www.reuters.com/graphics/USA-JULY4/FIREWORKS/klvygax...
Terror Cell can't afford First Class? Just walk to one of the restaurants inside the terminal and take a steak knife before you get on the plane.
The TSA shenanigan's are wild... security theater on an entirely different level.
So with the example of the 9/11 attacks, the situation has changed enough that a plane hijacking with a knife is much more unlikely
I'd actually expect a plane to the one of the absolute safest places, because like others said, everyone on that place has just become a victim. It doesn't even matter if you like the person being victimized, you're gonna exploit that distraction and beat the fuck out of the dude.
In public people are much quicker to just run away and keep themselves safe.
I liked a comment a few days ago about hostile actors on the internet versus meatspace:
"I asked about the security systems governing walking around in the hallway - was there any physical impediment preventing one person from punching, kicking, throwing a rock at another? Of course not - the security is socially constructed. Norms, consequences, etc, that on balance seemed to work out pretty effectively. I tried to make a case that security inside a local network of the size and scope of our school board was also ~90% social construction, but the student really struggled with it. There was a strong belief that because it was computers, you were expected to exploit it if it were vulnerable."
(Not saying you’re lying, I just want to learn more!)
For GSM, basic IMSI sniffing: https://github.com/Oros42/IMSI-catcher (usable with cheap SDRs)
For LTE, basic IMSI sniffing: https://github.com/JiaoXianjun/LTE-Cell-Scanner (usable with cheap SDRs)
For LTE, full-on sniffing of all unencrypted metadata: https://github.com/SysSec-KAIST/LTESniffer (generally requires fancy SDRs with GPSDO)
Can vouch that the first and second repos definitely worked as of about a year ago, but haven't personally tried since then. I don't have a USRP X310 (yet!) so can't personally speak to the fancy one.
I know my Canadian SIM card somehow hides US providers from network scans, possibly with some geo or if/then rules (but visible from my EU SIM that tries its darnedest to latch onto the US networks and avoid the Canadian ones at all costs)
The way I see it, seems law enforcement agencies using stingrays have a vested interesting in seeing 2G alive and well.
If you have no idea what a railroad yard working environment is like, here's a Union Pacific recruiting video.[2] They're up-front about what you're getting into; the intro shows someone at 5:48 AM in a snowstorm in a railyard in Chicago.
But yeah, it's REALLY important these radios work :|
He was back then saying that the railways will start operating GSM-R in the near future, and the problem of the unauthenticated Radio-Stop will go away :)
https://telegra.ph/How-easy-is-it-to-paralyze-the-Polish-rai...
Much better than the article linked IMO.
Even without drones, aircraft, or spot beams on satellites, you might be able to do this with ionospheric bounce or tropospheric ducting. 150Mhz is on the top of 2 meter HAM radio.
I got one of those Baofengs. I wander what other mischief you could commit with them.
They are legal for use by licensed Radio Amateurs (because Hams can legally build and modify their own gear), but the importers used this loop-hole to sell them to other users (eg CB, MURS, commercial two way, etc). Unfortunately, the lax administration by the authorities have allowed this to become a serious issue.
First, and the reason for hate by the licencing authorities is, that they have emissions on other bands (higher harmonics), sometimes way above the allowed levels.
And second, the more problematic here, is that they're cheap. Every airsofter, milsimer, prepper and mall ninja will buy one or two, in "tactical" camo colors with "tactical" antenna, usually one of those huge ones, painted camo, with some kind of "tactical" camo holster, to look "tactical"... while at the same time, they have no idea about frequencies, legalities and just use the preprogrammed channels or input a random frequency in the VFO mode. Before baofeng, this wasn't an issue... cheapest radios were in $150++ range, and paying $600 (or more) for four airsofters was a lot of money... now they can get a set for $100. And in camo and "tactical" designs.
Doing what the person in the article did requires not just $30 of equipment but also at least some knowledge (which frequency, what tones, what timing, how to use audacity or whatever to generate those tones, etc.), and most of the "normal" abusers of baofeng can't do that... just look at the questions on /r/baofeng on reddit... most of them are "we can't hear eachoter", because they're looking at channel numbers instead of frequencies and/or have tones enabled, and "can i listen to <some service not on uhf>?".
Certainly spurious emissions are the big one. The manufacturers have made some attempt to fit LPFs for the ham bands, but simply don't bother for the bands that they don't legally cover.
And yeah, the "cheap and nasty" aspect is simply the other side of the same coin. If the manufactures had fitted LPFs for each possible band, plus sought type-approval for other bands, they would be unaffordable.
Not to mention that removing keypad panel programming would block any attempt at type approval in the first place.
Now with around 80% of military equipment to Ukraine is transported through Poland, those vulnerabilities are going to be exploited.
Russia already run remotely groups though encrypted messages and crypto payments:
https://www.washingtonpost.com/world/2023/08/18/ukraine-weap...
The aim is to do some diversion or disinformation. There were many instances of producing fake news or misrepresent about some events. Please do your part and refrain from sharing those news about Poland without double checking sources.
Unfortunately, some "news" were picked by mainstream media, even though they could not find any evidence behind that (e.g. turning back non-white people on Poland-Ukrainian border by Polish officials).
GSM-R wasn't really postponed, but the implementation by PKP PLK was botched. There's NIK report about that: https://www.nik.gov.pl/aktualnosci/krajowy-programu-kolejowy...
Basically our main transformer switchgear was opening and closing on its own every few minutes. We run a diesel truck repair company and it was killing everything from the front office to the air compressors and anything in between. The electric company told us there's an ultra low frequency "DX" the hams sometimes get into that their own power lines use to communicate with substations. Pretty silly. We lost the air conditioner and the boombox that year.
There have been various systems which attempt to reuse existing frequencies by feeding them over un-shielded power lines. And as experts have warned so many times, it will always end up in tears.
If you put radio energy on un-shielded lines, the signals will leak out, causing interference to licensed services. Or will leak in, causing interference from licensed services. And because of the risk of outgoing interference, the signal levels must be kept low, which means that any interference leaking inwards will be much worse.
The only possible remediation is to use good error correction so that the effect is minimised. But of course that slows down the communication rate, so the power authorities don't bother.
And of course this interference can be caused by a large number of industrial electronics, eg motor speed controllers, welders, and so many others.
The point however, is that even if the fault was caused by a flaky VLF control system, then it is very unlikely that it was caused by the relatively low power transmission from an Amateur Radio setup.
To try and blame Radio Amateurs when they are legally operating on a licensed Ham band, using very low power levels is ludicrous.
And to rabbit on about "ultra low frequency DX" only further demonstrates that the power authorities don't have a clue. It's not ULF and whether or not it is DX is irrelevant.
If the power authorities were concerned about interference, they would not have relied on a notoriously unreliable system, or would have run an Optical Fiber along with their Earth/Neutral cables.
they can do as much or more damage as, say, blowing up a bridge
There is this mistaken belief that an act of war somehow immediately and automatically triggers war. This is not the case. If a country wants to wage war against an other they will find a reason. If they don't want to / it is not in their interest to do so they won't.
This answers your question. It is not seen as an act of war because the country in question (Poland) wouldn't benefit from seeing it as an act of war at this moment in time.
As an example, if someone from Canada were to come to the US and blow up a government building, no matter how severe the damage and human loss, we wouldn't dare consider that an act of war by Canada, unless evidence existed that the Canadian government or military were involved somehow.
Likewise, Poland has no interest in defining malicious actions by a Russian national or Russian Imperialism supporter as an act of war by Russia without clear evidence that The Russian state was directly involved.
Getting back to the original point though, I see no reason not to define attacks against infrastructure, regardless of who was responsible, foreign or domestic, or their motives, as acts of terrorism.
But that is where you are going wrong. If the US would want to attack Canada they would absolutely use that as a cause for war. If they don't want to go to war then even an straight up Canadian military attack can be brushed aside as "navigational error during a training exercise" or "regrettable rogue elements in the Canadian military".
This is not the court of law. The important factor is not if the evidence is strong or weak. The important factor is not if the perpetrator was acting in concert with a government or not. The important factor is if the country wants to go to war or not. Everything else falls in place after that.
Attacking infrastructure as a non-government entity can certainly be considered terrorism, but if the government backs you even after the fact, that feels a lot more like an act of war with plausible deniability. And in this case I think there might be a motivation for Poland to view it that way, since allowing Russian action against NATO countries invites more of the same, and Russia absolutely does not want to give NATO an excuse to retaliate in any way.
Countries refuse extradition for many reasons: they lack a reciprocal agreement with the other country, laws against extraditing citizens, laws against extraditing residents to face potential execution, etc.
While Russia is the Nazi Germany of examples, refusing to extradite a person doesn't automatically mean anything.
Of course, if someone wanted to go to war with Russia, it makes for a wonderful pretext.
Even if you had evidence that this were the case, you might not do anything, as with Saudi involvement with 9/11.
By changing the traffic lights you can cause a traffic collapse in the whole city.. and a kid can do it:
https://interestingengineering.com/innovation/the-fantasy-of...
> Youtube user VolteGe, who says he is too young to drive, has nevertheless created a MIRT controlled by an Arduino microcontroller.
ADSB spoofing can cause massive problems for the air traffic control, and software for that is open source, works on a $200 sdr with a touchscreen and a gui.
FM transmitters are cheap, and remembering the "war of the worlds", anyone can create panic for $20
etc.
With Ukrainian forces now striking deep in Russia, that cold war is heating up. This is a reminder that that can work both ways and might soon start affecting Nato territory as well. All deniable of course. But a few high profile attacks like this sends a not so subtle message that Russia can escalate as well if they want.
Goes without saying here that this needs to be fixed ASAP.
>>The railway agency wrote that “there is no threat to rail passengers. The result of this event is only difficulties in the running of trains.”
There is no threat to rail passengers, unless a passenger train does not know about a stopped train ahead of it on the tracks, e.g., a cargo train go stopped by the hack, but the passenger train 10min behind it did not and continues to rush onward towards the stopped cargo train. IDK if Poland's control system would reliably detects these conditions, but if it does not with 100% reliability, this is a real threat.
Almost everywhere in Europe uses actual signalling blocks backed by axle counters and DC detection circuits between the rails of a track, or by physical key/token based interlocks to detect if a train can safely enter the block. The way the US does it (especially detecting if a train has not been separated along the way by using a caboose/end-of-train beacon) may cost less money, but would be viable to such issues.
Detecting separation doesn't rely on the end-of-train device. The EOTD only helps with this by 1/ helping activate the brakes twice as fast by detecting loss of pressure on its end and opening the brake valve, and 2/ sending periodic status indication via radio signal to the locomotive so the crew has more visibility into what the pressure is and whether the tail of the train is moving.
> (Of course that's not entirely foolproof, either, and there have been accidents caused e.g. by a lack of braking power because the brake pipe wasn't fully connected throughout the full train.)
Can you specify what you mean? If the pipe wasn't properly connected, it shouldn't start at all, because the system needs pressure to release the brakes.
These pneumatic systems leak. You're not allowed to park a train for longer than 24h in Germany if it is purely secured with air pressure for that reason - if it's a particularly bad composition, you seriously risk having no pressure anywhere in the system by that time, and thus no brakes being applied.
I don't know anything specific about Poland's rail signaling, but they can't have messed that up. It's written in blood.
Particularly the fact that it's possible to use a "subsidiary signal" to just override the problem. The equivalent British scenario calls for the signaller to vocally inform the driver (e.g. today over GSM-R) something akin to "Pass the danger signal at caution, obeying all other signals". This may mean if there are a multiple related failures, you need to "caution" drivers the same way repeatedly - but without that final sentence the driver may ignore signals that are not related to the failure you understood, and passing those really will kill somebody.
The requirement to move "at caution" meaning with the ability to stop on sight means trains under these conditions don't go very fast - they can't, even on straight lines in broad daylight you can't see far enough to go full speed on a passenger train under those rules, but it also means if you screwed up and there is a serious problem the driver under caution can see the problem with enough time to stop. It further ensures there's an incentive not to allow such situations to persist as they presumably must have for Poland to deliberately fit the "subsidiary" lamps.