How to Crack a Train

You've probably already heard the story: we got contracted to analyze a bunch of trains breaking down after being serviced by third-party workshops. We reverse engineered them and found code which simulated failures when they detected servicing attempts. We presented our findings at 37C3 and then an update of the story at 38C3.

This talk will present the whole story, including:

- how modern electric trains (EMUs) work,

- reverse engineering a PLC based on a TriCore CPU,

- a real-world example of malicious code simulating failures in trains,

- media coverage after the publication,

- criminal investigations,

- getting sued for "copyright infringement" by the manufacturer, who claims they have no idea about the competitor-detecting logic,

- and many more!

 

Some parts of the talk will require deep technical knowledge to understand, but most of it should be comprehensible to anyone.