GoKawiilThe communications and monitoring platforms for rail networks has come under scrutiny following the recent "hacking" of a Taiwanese railway operators' radio system, which led to the emergency stoppage of three high-speed bullet trains for nearly an hour.
On April 5, a 23-year-old train enthusiast used a software-defined radio set up and hardware bought online to spoof a general alarm, or GA, alert to the operations center of Taiwan High Speed Rail (THSR). The company issued orders for emergency braking to the three high-speed trains in the vicinity of the signal, resulting in a 48-minute delay in service.
While few details have been reported, the compromise may have been simple — a voice or text that announced an emergency situation, says Wouter Bokslag, a founding partner of Dutch cybersecurity consultancy Midnight Blue, which has studied vulnerabilities in emergency radio systems. THSR reportedly used the emergency radio protocol known as Terrestrial Trunked Radio (TETRA), which can be secure, if set up correctly and maintained assiduously, but is also easy to leave in an insecure configuration, he says.
Related:AI-Driven Cyberattack on Mexico Couldn't Breach OT Systems
"These technologies — the core of it definitely is old stuff, but it's reliable," he says. "The TETRA Network, under certain conditions, can definitely be secure and could be a suitable solution here, but I suspect they were not running the strongest of configurations for their network."
Rail systems have increasingly come under scrutiny by cybersecurity researchers and cyberattackers. For two days in August 2023, hackers in Poland — which have a history of targeting trains — used a simple three-tone radio signal to order trains to stop, disrupting transportation in three different regions of the country. A month later, the pro-Iranian hacktivist group Cyber Avengers claimed that it had disrupted trains in Israel, although Israeli officials and cybersecurity firms refuted the claims.
The Taiwan incidents appear to be a more sophisticated version of the Poland Radio-Stop incidents, says Lukasz Olejnik, a cybersecurity consultant who studied the Poland incidents. For Poland, the hackers duplicated legacy analog tones that indicated an emergency, he says.
"For Taiwan, it apparently required understanding the environment and extracting or cloning the necessary parameters to inject them to cause an alarm," Olejnik says. "The lesson is that communication protocols add resilience only if deployed well and that everything — authentication, key rotation, terminal control, anomaly detection, et cetera — are actually enforced."
Related:Serial-to-IP Devices Hide Thousands of Old & New Bugs
From End-of-Train to TETRA
... continue reading