Notices by q3k :blobcatcoffee: (q3k@social.hackerspace.pl)

My custom Lanai-based microcontrollers (QF105, https://github.com/q3k/qf100) have arrived today from Efabless!

This batch (MPW5) has timing issues that I'll have to chase out first, but hopefully we can get this to blink a LED sooner than later.

This should be easy with Efabless also having shipped a whole STM32/Micropython jig to qualify I/O configuration hold time violations.

It's finally happened! NEWAG IP Management just sued us for copyright infringement and unfair competition. This is a civil lawsuit in Warsaw, parallel to a criminal investigation that's happening in Cracow.

Of course, they got our postal addresses wrong (they could've just asked!) so we only just got a copy from the court, but hey, we now have 164 pages of content to dive into.

In 2024, $.32 gets you a Cortex M0, 4kB RAM, 16kB flash and a built-in 24MHz oscillator. All in a package that's terrifyingly close to being accidentally swallowable.

https://www.lcsc.com/product-detail/Microcontroller-Units-MCUs-MPUs-SOCs_PUYA-PY32F003L24D6TR_C5128436.html

(index finger for scale - blurred so i don't get comments about fingerprint opsec)

Shout out to the Security Research Legal Defense Fund for helping us go public about our train research! We're honored to have been their first grantees.

Without their financial assistance we would've had to crowdfund our legal bills, or even worse, stay quiet about the locks we've found in Impuls trains.

If you're facing legal threats (or even anticipate the possibility of such threats) as the result of security research we definitely recommend reaching out to them.

https://www.securityresearchlegaldefensefund.org/

The key unlock was deleted in newer PLC software versions, but the lock logic remained.

After a certain update by NEWAG, the cabin controls would also display scary messages about copyright violations if the HMI detected a subset of conditions that should've engaged the lock but the train was still operational.

The trains also had a GSM telemetry unit that was broadcasting lock conditions, and in some cases appeared to be able to lock the train remotely.

3/4

@redford and @mrtick held an unrecorded talk a bout this at OhMyHack in Warsaw - I unfortunately couldn't make it because of Munich snow.

For now this is making the rounds in Polish-speaking sources, but we do have a talk scheduled about this at 37C3, in which we plan to do a deep dive into this and actually publish our findings.

@zaufanatrzeciastrona 's article about this: https://zaufanatrzeciastrona.pl/post/o-trzech-takich-co-zhakowali-prawdziwy-pociag-a-nawet-30-pociagow/

We found that the PLC code actually contained logic that would lock up the train with bogus error codes after some date, or if the train wasn't running for a given time. One version of the controller actually contained GPS coordinates to contain the behaviour to third party workshops.

It was also possible to unlock the trains by pressing a key combination in the cabin controls. None of this was documented.

2/4

I can finally reveal some research I've been involved with over the past year or so.

We (@redford, @mrtick and I) have reverse engineered the PLC code of NEWAG Impuls EMUs. These trains were locking up for arbitrary reasons after being serviced at third-party workshops. The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parties.

1/4

BE NOT AFRAID

https://gitlab.freedesktop.org/xorg/app/xeyes/-/merge_requests/6

TIL that the EU (EPSO) has joined the bandwagon of discriminatory, privacy-invading 'remotely proctored tests':

https://europa.eu/epso/application/CotoFiles/file/AD%20382-20/CBT/Instructions%20for%20RP%20EEAS%20EN%20-%20FINAL%20(1).pdf

✓ Must show face on webcam at all times
✓ Must show ankles (???), inside of pockets and 360 degree view of room
✓ Must have an empty, dedicated room
✓ Cannot fidget/move/stand up
✓ Cannot use anything other than 100% zoom
✓ Recent macOS/Windows and Chrome only
✓ Must give your data and admin access to your computer to some random US company

Cool thing is, since we have a 'normal' DRM/KMS driver (and help from @emersion) we can just do things like... run Wayland!

behold, a penguin

(too tired to figure out the colors now, good night)