14-Year-Old Turns Tram System Into Personal Train Set

F-3582 writes "By modifying a TV remote a 14-year-old boy from Lodz, Poland, managed to gain control over the junctions of the tracks. According to The Register the boy had 'trespassed in tram depots to gather information needed to build the device. [...] Transport command and control systems are commonly designed by engineers with little exposure or knowledge about security using commodity electronics and a little native wit.' Four trams derailed in the process injuring a number of passengers. The boy is now looking at 'charges at a special juvenile court of endangering public safety.'"

how many other "systems" like this?

[yagu (721525)]

I know some kids who are extremely bright, curious, and for lack of a better description, "like to experiment". Any one of these I think could have done the same thing, and with completely innocent (though mischievous) intent. For playing with such big toys in such a fashion there should be repercussions. But the kids I know who also could have done something like this would be much more on track with thinking about how they're moving switches than about what moving those switches implies.

However, I'm led to a different train of thought. What other systems are out there created in the same context, i.e., with little thought to external interference? I'm betting there are a "few". I wonder that in the process of designing something like this if we must pay more attention to the possibility of outsiders tinkering. I hope France's TGV has a bit more built in checks and balances than this. I hope the new Boeing 787 has more security built in than this [news.com.au].

I actually think (and hope) this kid's imagination and curiosity somehow gets channeled rather than squashed. He actually sounds like he could be a contributor. Of course, he's at least grounded for the next month.

Re:how many other "systems" like this?

[show me altoids (1183399)]

Reminds me of Johnny [cmu.edu].

Re:how many other "systems" like this?

[_spider_ (171782)]

I think we are bound to see more and more of this, after all, in this day and age, parents get their kids a Wii/xBox,PSx/etc in lieu of more challenging and creative toys probably a lot of us grew up with like Legos, Lincoln logs, erector sets, . . . things that I think are challenging and engaging.

I'm proud for the kid in the sense that he put his mind to work, but at the same time, no points for lacking discretion, and a good sense of responsibility. And I don't think he should get a free pass just because he is a kid. If he is smart enough to do what he did, I think its entirely reasonable to assume that he had the capacity to know what the effects may be.

Re:how many other "systems" like this?

[TamCaP (900777)]

I read on one of the Polish websites about this guy, and he contacted the local public transportation club and was asking way too many questions (either during a meeting or on a webforum). As he didn't join the club / pay the fees and he disappeared immediately, it seemed a bit awkward. When the trams started behaving strangely, the authorities suspected outside interference and contacted the club leader for any information. The club leader recalled this strange guy asking too many questions, and the rest is history.

Re:

[jacquesm (154384)]

because it's called 'The Netherlands', which probably makes us 'neanderthals'

Re:

[neomunk (913773)]

You're comparing roller coaster tycoon to an erector set and actually implying that the video game is more challenging?

See, NOW I feel old. I always thought that actually studying the engineering aspects and bolting things together to see if you have the design down right took more thought and imagination than 'the computer says this track piece won't fit, better click on the hole digging button'.

Or is it just the fact that if it's not on the big pretty color-making box and just in plain ole' 'real life' (

Re:how many other "systems" like this?

[Kelbear (870538)]

14 year olds are young, but not so young to not realize that swapping train tracks around will affect what happens to trains when they reach that section of track. They might not follow that train of thought(pun intended) through to what the actual aftermath may look like, but it's no stretch of intelligence to conclude that a massive train moving at significant speeds will have a significant consequences when directed somewhere unexpectedly.

Not that I'm recommending dire consequences for the boy, I'm just saying that there is probably some malicious intent here, though he probably didn't calculate the magnitude of his mischief either. I'm envisioning something like: "I'm gonna screw around with this and it'll be funny watching them try to fix i--*FOOM*...oh...wow...shit I better go".

(And jeez, whoever designed that system that way is going to have a whole mess of flying poop coming their way).

Re:how many other "systems" like this?

[Lemmy Caution (8378)]

Many 14 year olds are angry, isolated, and misanthropic, in the throes of adolescent angst and frustration. He may have been indifferent at best to the harm he could have caused. There were times in my own adolescence I was angry and self-pitying to the point of sociopathy.

Re:

[rbanffy (584143)]

This reminds me of a Mythbusters episode when they investigated how deadly a coin falling from the top of the Empire State Building would be to someone down on the street. They interviewed a lady that lives (or works) a couple dozen floors down, where most of the coins end up falling and she wondered what they had in mind - because they are either throwing money away for no reason or they are throwing it away because they are trying to get someone killed on the streets below.

Re:how many other "systems" like this?

[LordLucless (582312)]

That might have been possible the first time. But he did it FOUR times. After he saw the first tram derail, then the consequences would have been made abundantly clear. The fact that he continued shows that he either didn't care, or enjoyed it.

Re:how many other "systems" like this?

[Muhammar (659468)]

Never forget that these things are done first time to figure out if can be done at all - and the second, third and fourth time for the benefit of friends (and sometimes alone too, to fight the boredom). Sharing the exitement of discovery and earning the bragging rights is your reward. Many bright guys at the age 14 are pretty sociopathically disposed.

Re:

[snowraver1 (1052510)]

Yeah, me neither. At that time, I bought a cell phone, making the pay phone obsolete.

Other Similar Systems: Signal Pre-emption

[Palal (836081)]

In the US many places with newer traffic signal circuitry (at least on the west coast) have something called Signal Pre-Emption [wikipedia.org].

This allows emergency vehicles to by-pass traffic lights by turning them green. It uses an IR transponder on vehicles, and an IR receiver on lights. When a certain frequency (pulse) is sent out from the vehicle and picked up by the receiver, the light turns green.

Before you try to build a device to do that I want to say 2 things:
1. Devices are available on the 'black market', and
2. Every time this signal gets sent, it gets recorded in a log. There have been cases of people getting caught using these and the fines are hefty.


The same system is used, called "Signal Priority" can be used by buses to hold the light green or trigger an early green in various circumstances. (Basically this involves sending out a frequency that's different from Emergency vehicles.

I bet that Lodz uses a similar technology for its trams, but maybe they thought nobody could figure it out, so they simply went with security via obscurity (or whatever the term for it is).

Czech Republic has a single system (as in same system type, not same transponders) in the entire country for its trams and trolley buses and uses something similar to your car key remote.

If anyone manages to figure out how the signal pre-emption works, please post details online :).

Re:Other Similar Systems: Signal Pre-emption

[Daniel_Staal (609844)]

Some places have a more inteligent system: The signal turns the light Red (in all directions), and the emergency vechicles just go through the red lights.

Works just as well, and less suceptable to hacks. (Not impossible of course, but less chance of people doing it for their own benifit.)

Re:Other Similar Systems: Signal Pre-emption

[Evil Adrian (253301)]

Those people that panic and don't move promptly should have their licenses revoked.

This whole thread is pissing me off. "He was young and didn't know what he was doing..." BS. If the kid is smart enough to hack into a system, he's easily smart enough to know how much a train weighs and what damage a train derailment will cause. Send this kid to jail!

Secondly, I hate when people excuse bad driving as normal. It's not acceptable. If you don't clear the intersection when emergency vehicles are coming, you shouldn't be driving, period. If you consistently drive 5mph under the speed limit, your license should be revoked. If you can't PARK YOUR CAR without extreme effort, license REVOKED! If you took licenses away from all the people that shouldn't have them for safety reasons, there would be 50% fewer people on the road, AT LEAST.

I hate people.

Road rage much?

[PhxBlue (562201)]

Now, I'm all for people driving the speed limit, maybe a little more. But legally, the speed limit is an upper limit, not a lower limit. And people who drive like the speed limit is just a guideline tend, in my experience, to be more prone to road rage than those who actually obey it.

This whole thread is pissing me off. ... I hate people.

Maybe you should consider a class in anger management. Or take a deep breath and put on some jazz music when you get in heavy traffic.

Re:Other Similar Systems: Signal Pre-emption

[ShieldW0lf (601553)]

Secondly, I hate when people excuse bad driving as normal. It's not acceptable. If you don't clear the intersection when emergency vehicles are coming, you shouldn't be driving, period. If you consistently drive 5mph under the speed limit, your license should be revoked. If you can't PARK YOUR CAR without extreme effort, license REVOKED! If you took licenses away from all the people that shouldn't have them for safety reasons, there would be 50% fewer people on the road, AT LEAST.

So, if more than 50% of the people are kept off the road because you don't like how they drive, perhaps they should round YOU up, get rid of YOU, and drive as they see fit without interference from micromanaging busy bodies who think we're obligated to operate in a way that you can predict and write down?

You know, there have been numerous suppressed studies demonstrating that road rules and signs actually make driving less safe because they give a false sense of security. I don't have a link at my fingertips, but there have been several of them done. The safest way to structure roads is to remove all signs and controls, and force people to remain interactive with the environment rather than being hypnotized into routine. The reason the highly structured and regulated road systems continue is because they are an industry with an interest in self-preservation, and a cash cow for government, not because they are a good way to do things.

Re:Other Similar Systems: Signal Pre-emption

[jonbrewer (11894)]

Lodz has had electric trams since 1898 - and while it's not likely any of the original track or switches are in use, the system is not new. Turning at too rapid a rate will cause derailment. I've seen a fair number of older generation trams derailed on similar Polish systems, especially around the old town of Krakow. Somehow I doubt that Lodz have a spanking new fleet of low-floor trams that have required system-wide track upgrades to run. I imagine the trams that derailed were built in the 1960s.

As for the engineers being "grossly incompetent", I really don't think so. I wouldn't be at all surprised if the system hacked was decades old, designed by folks who had no reason to think that anyone would ever have the means or desire to circumvent the system.

(FYI those 1960s electric trains are far better transport than any diesel bus I've ever been on, and the new low-floor trams are like something out of a sci-fi movie!)

Re:Other Similar Systems: Signal Pre-emption

[cp.tar (871488)]

The downside to that approach is that emergency vehicles encounter cars stopped at a red light at every intersection. Where I live, drivers panic when an emergency vehicle approaches, move their car six inches towards the side of the road, and don't realize they should go through a red light to clear the roadway.

I've heard emergency drivers say: "If you don't know what to do and where to go when you see/hear an emergency vehicle, simply stop. It's much easier to manage your way around a halted vehicle than around one whose driver is panicking."

Re:

[sn00ker (172521)]

The downside to that approach is that emergency vehicles encounter cars stopped at a red light at every intersection. Where I live, drivers panic when an emergency vehicle approaches, move their car six inches towards the side of the road, and don't realize they should go through a red light to clear the roadway.

I've heard emergency drivers say: "If you don't know what to do and where to go when you see/hear an emergency vehicle, simply stop. It's much easier to manage your way around a halted vehicle th

Engineers who built such...

[by Anonymous Coward]

...heinously vulnerable systems are the ones who should get locked up in jail.

Re:

[luder (923306)]

What other systems are out there created in the same context, i.e., with little thought to external interference?

Here's a video of a german teenager messing up with road information panels [ongein.nl]. Apparently, he got a copy of the software used by authorities to change those displays. It seems that anyone in the possession of that software and a wireless card can do it. Maybe someone who knows german can give more details.

wtf

[JohnFluxx (413620)]

It should be the enginners and their bosses that should be the ones facing criminal charges.

Re:wtf

[MightyMartian (840721)]

No bloody kidding. Yeah, the kid was doing what he shouldn't have, but who the hell develops something as critical as switch controls for a $#@!@% tram that can be so easily overridden. I don't buy this "not exposed" BS. That's why, in the old days of manual switches, you had padlocks on them to stop the earlier, low-tech version of this stunt.

Once they've finished throwing the book at this kid, someone ought to look at getting him into a decent technical school. Maybe, in a decade, he can replace the retarded engineers.

Re:wtf

[MightyMartian (840721)]

One expects a lack of forethought and responsibility from teenagers. It's practically the defining characteristic of that stage of life. One expects a good deal from adult engineers.

Re:wtf

[mea37 (1201159)]

If by that you mean that the engineers (responsible for design of the system) and their bosses should also be facing criminal charges, then yes, they should.

That doesn't mean what the boy did was ok, or that he shouldn't be facing charges, though. While he is young and might not be held to the same standard of foresight as an adult, still his behavior cannot be excused as merely impulsive considering the time and effort involved. Even if he isn't held fully accountable for endangering lives, still he had to know he would be causing considerable disruption.

I'm curious, though, about the details of the tram system in question. The article describes a tram operator trying to go one way while the track pushed him the other way... so I assume these are not strictly rail-following vehicles (like trains) that have only an accelerator and a brake?

Re:

[eebly (7752)]

Many tram systems have operator-controlled switches. In the old days (and still in some places, like Prague) switches are set by an operator manually. This system appears to basically be the same thing through proximity IR control.
On railroads, switches are mostly controlled from a central dispatch office.

I'm taking the troll -- on encryption, etc.

[by Anonymous Coward]

Well, yes and no. Just give a bit of serious thought to the issue... I'm at work, have to AC.

It sounds as though the system worked of infrared pulse encoding, and that is why he could use a modified television remote. Imagine you are the one designing this (probably in the 1970's or 1980's...) It is generally desirable to keep things simple to ensure they actually *work* -- that is, having a rolling code that may be out of sync while having a signalling train hurtle toward the junction at 80 mph is not

Re:

[imbaczek (690596)]

I live in Poland; news sources say that they indeed are under investigation.

Re:

[HTH NE1 (675604)]

Yes security should have been implemented but why should one group have to defend themselves against another group?

It's better to have your lack of security demonstrated to you by a relatively benign agent before a truly malevolent one.

Is this not the rationale for penetration testing?

New terrorist plot for TV

[Sciros (986030)]

I have $20 that says at least one TV crime-drama-whatever show will have a plot where a bad guy tries to plot some train crash by messing with a TV remote, or better yet, video game controller.

This kid does deserve to get in trouble, though, big-time. You don't go around derailing trams, that's not cool.

Re:New terrorist plot for TV

[dgatwood (11270)]

This kid does deserve to get in trouble, though, big-time. You don't go around derailing trams, that's not cool.

I'm surprised nobody has asked the obvious question. Switches normally switch between two tracks. How does switching a train to a different track cause it to derail? Collide, sure, but derail? Sounds like a design problem to me... or a whole lot of design problems if it is possible for it to switch when a train is in the middle of the switch, as I suspect occurred. There should be safety interlocks to prevent switching from even being possible as long as a weight sensor at the switch is depressed.

It strikes me that this kid not only found a security flaw in the system, but also found at least one very serious safety flaw that could have occurred due to electronics glitches even if he hadn't done this. It could have ben a lot worse, particularly if those same switching systems are used for any high-speed trains....

Re:

[anno1602 (320047)]

Speculation: An alternative explanation would be that the two curves were of different diameter, and the driver intended to take the larger-diameter one, traveling at a speed too high for the sharper curve the tram ended up taking. Tram lines sometimes take pretty sharp turns.

Re:New terrorist plot for TV

[joebok (457904)]

Have you never had a train set? A switch will have one pair of rails on one side, and two pairs of rails on the other. If you are coming to the switch from the side with one pair, you won't get derailed - you'll just go to one or the other output tracks. But if you are on the other side of the switch it has to be set right to get your train back to the single pair side. If the switch is set to route traffic from the other side rail then you would derail if you didn't stop.

I'm sure there are visual indicators if you are heading into a situation where the track ahead isn't switched correctly (my train set had red and green lights), but it is easy to see how there could have been derailments if somebody was running amok with the switches.

Law enforcement differences

[KaiserSoze (154044)]

Good thing he wasn't in the United States, where he'd be charged with terrorism, waterboarded, sodomized with a broom handle and thrown in Guantanamo Bay forever. The Department of Homeland Security would then increase the Train Flight Security Awareness Threat to Indigo, and the attorney general would trumpet the great work that the US Government is doing to prevent further Terrorist Train Derailments.

Re:

[Adambomb (118938)]

Just a reminder we are currently at threat level Moving Pictures [wikipedia.org].

Up from Blackwatch Plaid [wikipedia.org].

Re:

[Itninja (937614)]

..with a broom handle and thrown in Guantanamo Bay forever.

Nah, I doubt that would have happened - this was an white kid. But if he'd been, um, not white....o yeah, they would have totally gone Abu Ghraib on him.

Special security training?

[Optic7 (688717)]

Does it really take special security training for engineers to realize that controlling train junctions with TV remote controls (or close enough) might be a bad idea? Where's the whatcouldpossiblygowrong tag when you need it?

Telegraph article

[ddrichardson (869910)]

Here is the article in the Telegraph [telegraph.co.uk].

I particularly enjoyed the phrase:

The incident is the latest in which "hackers" - many of them young computer experts - have broken into computer systems.

As they then list two incedents since 1999 and the Boeing 787 concern.

Video

[Nutty_Irishman (729030)]

Local authorities released this video capturing the culprits in their crime: http://www.youtube.com/watch?v=jiAk5vqvn3A [youtube.com]

OK, I have to ask

[Critical Facilities (850111)]

on Tuesday when a driver attempting to steer his vehicle to the right was involuntarily taken to the left. As a result the rear wagon of the train jumped the rails and collided with another passing tram

IANATE (I Am Not A Tram Expert), but if it was on RAILS, how or why would you STEER it?

Re:OK, I have to ask

[ThreeGigs (239452)]

Tram line 21 runs east to west.
Tram line 19 runs east to west on 21's tracks, then turns onto a north-south track heading south.

Driver of 19 sets his left-straight-right turn lever to broadcast "right".
Kid overrides with a left, lead car turns left.
Kid stops overriding, the junction again sees the signal on the tram to switch to turn right, and the second car goes right, causing a derailment.

In the US, most remote junction switches have a fail-safe that prevents the tracks from switching if there's a car over the junction, thus preventing driver error or malicious external elements from causing a derailment by making the train go in 2 directions at once. Apparently no such fail-safe is present on the systems in Lodz (pronounced 'woodj' in Polish).

Why is it that...

[by Anonymous Coward]

Why is it that facility operators, be it trains, power plants, oil refineries, or anything have pathetic security, and when something does happen, they blame it totally on the perp who likely never had to confront even a single lock, much less a guard?

Makes me wonder if countries should have a special regulatory team whose job it is to attempt break ins on a regular basis to various areas, and levy fines to organizations failing compliance. Only problem is areas where people shoot to kill... telling a tiger team from a genuine trespasser/burglar/criminal before pulling the trigger.

Yes, there's an RF remote for the thing

[Animats (122034)]

This is a street tram switching system similar to the Elektroline [elektroline.cz] system. It's not a full signalling system with interlocking. The tram driver is in control, and has an RF transmitter which can control switches. The current generation, the "TRAMVYS 6K", is an RF transmitter on 433.9 or 868.35 MHz. Normal range is very short, about 2M, with the transmitter down on the front truck of the tram and the receiver buried in the road. But it could probably be triggered by someone at the side of the street with a suitable transmitter. This system is interlocked so that the switch can't change position underneath a tram.

That's current technology. Older systems are much dumber [google.com]. Some of this stuff is at the garage-door-opener level of RF devices. The Lodz tram system dates from 1898, so they have lots of legacy trackwork.

Re:

[GiMP (10923)]

It is interesting that you note the distance required. It isn't mentioned at the Register, but the Polish news sources have said that he was riding inside of the trams that were being controlled.

He could have done better..

[DigitAl56K (805623)]

Four trams derailed in the process injuring a number of passengers.

I know he hacked this together out of a remote control, but that's a horribly inefficient process he created - surely it's possible to injure the passengers without derailing the trams! ;)

Re:

[Dmala (752610)]

Yeah, Poland is so backwards. In the US, we don't need teenagers to derail our trains [wptz.com].

Re:Leave it to the Polish!

[TheGratefulNet (143330)]

Yeah, Poland is so backwards.

I know. in fact, they call RPN just "notation" !

Re:

[earlymon (1116185)]

And not that I have anything aginst the Polish...

No, of course you don't. Rather than flame, I'll try education. The original was taken down, these will have to do.

http://www.youtube.com/watch?v=Quld5950v6w [youtube.com]
Alternate video - http://www.youtube.com/watch?v=3lSaYx6ttuE&feature=related [youtube.com]
5 lies about Poland (try not to knock the spelling - check your own) - http://www.youtube.com/watch?v=p67IVwRUilc&feature=related [youtube.com]

Here's the kernel of truth underlying all those Polish jokes - most people can't seem to pull themselves up, so they choose someone superio

Re:

[Critical Facilities (850111)]

This [gamespot.com]might be what gave him the idea in the first place.