This is FUD spread by the auto industry to make people afraid of public transportation options like high-speed rail. If the rail industry is ignoring this CVE, then it must be because it's either not practically exploitable or not as severe as the author claims. Publishing an "exploit" on a major piece of industrial equipment is great for the resume, but testing it would be a federal offense, so we can assume that the author has no real idea whether it works or not. People who work for the railroad are smart, and have a lot more experience with trains than your average Lambda School grad, so I'll defer to their judgemental rather than enthusiastic headlines like this. Do better.
> If the rail industry is ignoring this CVE, then it must be because it's either not practically exploitable or not as severe as the author claims.
> People who work for the railroad are smart, and have a lot more experience with trains than your average Lambda School grad, so I'll defer to their judgemental
That's a very idealistic view of the world, I don't think reality would agree. Ego, indifference, and plain incompetence are extremely common in every industry, then add onto that the fact that hardware companies are already notoriously bad at software, and then you can double the risk for entrenched companies that have little pressure to be proactive about these things.
This is exactly the kind of lax response I would intuitively expect from a company of this nature. I say that as I glance over at Boeing.
It would be very short sighted of the auto industry to criticize an insecure car to car protocol when that is a thing they want to implement with exactly the same security budget.
It needs local proximity RF which was probably considered an out of scope risk in the initial design but is more and more likely to be available by accident as newer RF devices have more defined by software.
eh I worked around this and other operational technology and industrial control system security testing previously - lots of it isn’t built with security in mind
test wise you’d be amazed at what old controllers end up at surplus places or on eBay.
Maybe the CVE is being ignored because it's not such a big issue at all? It's already possible to cause a train to brake and make a disruption by pulling any of the emergency breaks inside it.
https://threadreaderapp.com/thread/1943708133421101446.html
https://nitter.net/stneil/status/1943708133421101446
This is FUD spread by the auto industry to make people afraid of public transportation options like high-speed rail. If the rail industry is ignoring this CVE, then it must be because it's either not practically exploitable or not as severe as the author claims. Publishing an "exploit" on a major piece of industrial equipment is great for the resume, but testing it would be a federal offense, so we can assume that the author has no real idea whether it works or not. People who work for the railroad are smart, and have a lot more experience with trains than your average Lambda School grad, so I'll defer to their judgemental rather than enthusiastic headlines like this. Do better.
> If the rail industry is ignoring this CVE, then it must be because it's either not practically exploitable or not as severe as the author claims.
> People who work for the railroad are smart, and have a lot more experience with trains than your average Lambda School grad, so I'll defer to their judgemental
That's a very idealistic view of the world, I don't think reality would agree. Ego, indifference, and plain incompetence are extremely common in every industry, then add onto that the fact that hardware companies are already notoriously bad at software, and then you can double the risk for entrenched companies that have little pressure to be proactive about these things.
This is exactly the kind of lax response I would intuitively expect from a company of this nature. I say that as I glance over at Boeing.
It would be very short sighted of the auto industry to criticize an insecure car to car protocol when that is a thing they want to implement with exactly the same security budget.
It needs local proximity RF which was probably considered an out of scope risk in the initial design but is more and more likely to be available by accident as newer RF devices have more defined by software.
I work on trains. This is FUD.
Except for 1 train in the US, no passenger trains use this function. It is only for long freight trains.
If you block it, the train still brakes…. Just the propagation is at the speed of sound instead of speed of light. Functionally, it doesn’t matter.
You can theoretically cause the brakes to apply, but then this system just gets cut out anyway. It’s not really required.
Is Ethan Supplee in Unstoppable (2010) also auto industry propaganda, portraying some railroad workers as less than smart?
Is a fictional character in an action movie a realistic or relevant point in relation to real life?
eh I worked around this and other operational technology and industrial control system security testing previously - lots of it isn’t built with security in mind
test wise you’d be amazed at what old controllers end up at surplus places or on eBay.
Maybe the CVE is being ignored because it's not such a big issue at all? It's already possible to cause a train to brake and make a disruption by pulling any of the emergency breaks inside it.