Hacking Trains
summary
OSINT scanning finds an Android app on Google Play with hardcoded admin:ignorecase credentials and undocumented functionality that allows remote EVC code update to the train’s core controller, exposing diagnostic servers and GSMR links; more than 2,000 locomotives use affected components, passwords appear in GET parameters and even YouTube uploads, and a novice can reproduce much of the workflow using tools like scanar + srep + GPT‑3 for code discovery — all findings are disclosed to authorities.
AI-written summary · about
chapters (12)
- 0:00Introduction and research
- 2:23Railway vulnerability findings
- 3:59Automated security scanning
- 6:50System design and architecture
- 10:51Diagnostic system security
- 15:24Attack vectors and impact
- 19:27System control and failure
- 22:11Simulating railway security
- 25:42Lessons and best practices
- 28:52Regulatory and economic impact
- 32:21Call to action for industry
- 35:04Q&A and closing remarks
related talks
36mI just hacked your app!
45mI just hacked your app!
32mHacking the Hackers’ Code: Inside Android Malware
45mI just hacked your app!
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
53mAre your secrets secure? How mobile applications are leaking millions of credentials
44mI just hacked your app!
49mAll the 4G Modules Could be Hacked