BadCyber

For those that don't remember or never heard of the case: https://badcyber.com/the-great-greek-wiretapping-affair/

For folks who enjoy reading, here is a wrap-up: https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardwa…

A good start is https://social.hackerspace.pl/@q3k/111528162462505087 and https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardwa… There were also multiple threads on earlier parts of the story, but those are the "origin" english language versions.

No, absolutely not. (1) This was scheduled maintenance service, not a quick repair. Maintenance is complicated and is expected to take more than 10 days: > Maintenance a train is a complicated affair – it has to be taken apart, the parts sent to the various manufacturers, checked, sent back, the train put back together again and tested. The SPS carries out the maintenance procedures according to the relevant maintenance manual (some 20,000 pages) provided by the manufacturer, but the train does not start after being put together. From [1]. (2) If this was a legitimate check then there should be a legible error code instead of the train randomly locking up with no explanation why. This was clearly designed to sabotage competing maintenance service companies. [1] https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardwa…

Here is a better write-up of the story: https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardwa…

Seriously? I find it very unlikely this is the work of a "lone wolf developer". Newag management and executives knew about this. Some of these trains were configured (poorly) to "break" at a scheduled date that just so happen to line up with when those trains were scheduled to go get serviced[0]. Lone wolf developers usually don't have the ability to make builds/configurations for a particular deployment of the software... [0]: https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardwa… - Section "Checking the date is hard"

Some info is here https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardwa… , but the actual details will be presented at the Chaos Communication Congress at the end of December.

https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+… https://securelist.com/blog/incidents/76791/new-wave-of-mirai-attackin… https://badcyber.com/new-mirai-attack-vector-bot-exploits-a-recently-d… https://www.flashpoint-intel.com/new-mirai-variant-involved-latest-deu… http://www.cert.ssi.gouv.fr/site/CERTFR-2016-ALE-009/index.html http://www.theregister.co.uk/2016/12/01/hull_router_attack/