Abusing legacy railroad signaling systems
summary
Claim: many legacy track beacons are passive LC resonators that encode signals by resonant frequency (examples: ~111 kHz base, red at ~95 kHz) and have no authentication, so an attacker can spoof a beacon. Prototype uses a tuned coil+capacitor, a frequency generator, a vector analyzer and a receiving coil; built from copper wire and cardboard, exploiting parasitic capacitance. The device reliably convinces onboard equipment to display restrictive aspects (L8) and trigger emergency braking.
AI-written summary · about
chapters (11)
- 0:00Railroad signaling security intro
- 2:20Dark territory in railroads
- 6:20Legacy train blocking systems
- 10:00Signal misinterpretation dangers
- 14:43ASFA analog system explained
- 18:11Human error and accidents
- 21:29ASFA beacon wireless signals
- 24:05ASFA beacon security flaws
- 27:53Fake beacon exploit demo
- 31:28Train beacon signal detection
- 33:12Global similar systems & closing
related talks
01h 01mRapid Radio Reversing
22mHacking LTE Public Warning Systems
06mAnti-Spoofing Voice Commands: A Generic Wireless Assisted Design
01h 06mSelf-Driving and Connected Cars: Fooling Sensors and Tracking Drivers
46mAttacking Hardware Systems Using Resonance and the Laws of Physics
39mHacking your home-reverse engineering wireless transmission
51mRadio Hacking: Cars, Hardware, and more!
35mWireless Hacking With HackCUBE-Special