Open Source Rail Security
Introduction
Good day, dear reader. Surely there have been situations when you were somewhere to get out of the house outside the city. One of the possible means of transportation is a train, and sometimes it turns out that getting to the destination with it is possible as soon as possible than by plane.
At the very beginning, I want to make some important clarifications. Potential attack vectors, which will be discussed in Section 4, are determined only on the basis of information from open sources. In addition, this article considers the situation as a whole on the railways of different countries of the world without reference to a specific country. However, in particular, we clarified some data on the attack vectors proposed in the article by our Russian colleagues from the Russian Railways Cybersecurity Center: work is underway to eliminate possible attack vectors, and some problems have been partially eliminated. It is also worth noting that the author is not able to give a full technical conclusion on the safety of high-speed trains due to the lack of access to the system and the possibility of conducting full-fledged practical experiments on the railway.
This article will provide an overview of some safety systems that can be used on modern high-speed trains. The number of such platforms is growing, they are becoming more complex. At the same time, they are built on the basis of well-known technologies, including Ethernet, CAN, RS-485. Various PLCs and industrial computers running Windows / Linux / QNX are increasingly being used. In addition, the popularity of systems using the radio channel (as an example, GPS / GLONASS, GSM-R, Wi-FI) is growing.
In this regard, the question arises - is it safe to create a huge system based on “modules” that are familiar to potential attackers?
As an example, potential vulnerabilities in GSM-R. Of course, someone will object that GSM and GSM-R are different technologies. However, the main difference between them is that the coverage area in GSM is a "circular" area, in the center of which is the base station. The GSM-R standard, in turn, is adapted for railways so that the coverage area extends along the railroad. More important is another: all the vulnerabilities present in GSM are inherent in GSM-R, and this technology is actively used to regulate the movement of high-speed trains.
The GPS signal can be muted. And it’s not so difficult. If you go into the thicket of the forest, with a high degree of probability the GPS receiver will lose satellites, and you don’t even have to do anything. Now imagine a situation where an attacker not only suppresses the signal, but also replaces the data so that the receiving side receives completely different coordinates. And the location of the train is only used to calculate moving block sections.
In modern trains can not do without Wi-Fi. This, of course, is very convenient for passengers, but let's not forget that the IEEE 802.11 standard (in other words, Wi-Fi) is well known to attackers. Next, we'll talk about the fact that at present Wi-Fi / Ethernet is beginning to dominate in the construction of TCN. Thus, under the right set of circumstances, a situation may arise when an attacker, having connected to Wi-Fi in a car, will gain access to other nodes on the MVB / WTB bus. And in some cases, these nodes have very good production capacity. An explanation of the abbreviations mentioned will be given in section 1.1.
Another possible attack vector is attacks on computers, to which various mobile diagnostic equipment is connected, which “monitors” the operation of all parts of the rolling stock. And therefore, it seems not a very good idea to send a train for diagnostics after each trip due to incorrect operation of mobile equipment.
In conclusion of the introductory part, I would like to remind you that you should not forget about a possible scenario when the equipment is infected with malware in various ways.
1. General information about modern high-speed trains
This section will describe what technologies are used on modern high-speed trains.
Unfortunately, the author does not have the opportunity to purchase or at least rent for a while to study and search for weaknesses of a full-fledged train. To dive into the world of safety of high-speed trains, we will use only open sources and our personal experience in this field. In principle, a potential attacker could be in similar (or even privileged) conditions.
Before the advent of distributed automation systems, satellite systems, logistics was carried out “manually”: before sending the train, the dispatcher called the next station and found out if the stage was free, if the previous train had passed.
And on the trains of those times there were not many systems interacting with each other, the engineer and the dispatcher.
Enough time has passed since then, a lot has changed. Let's see what the modern railway infrastructure looks like today.
Figure 1 shows the relationship of various systems. Conventionally, this "variety" can be divided into several categories:
- Dispatch automation;
- Railway automation (on-board);
- Railway automation (track).
I would like to note that often on-board and track railway automation is a single hardware-software complex, part of which is located on the train, and the other part is on the railway tracks. Of course, this division is very arbitrary. In addition, we will be more interested in modern high-speed trains.
1.1. Applicable Standards
Let us make a small digression to say a few words about the standards that apply to the railway.
In 1999, the international standard IEC 61375 was adopted, which is based on the TCN - Train Communication Network. At the time of adoption, the TCN consisted of two tires:
- MVB - M ultifunction V ehicle B us - the on-board network of a unit of rolling stock (it can be a car, locomotive);
- WTB - W ire T rain B us - a train network integrating MVB parts into a single train control system.
In 2014, a new standard was adopted, IEC 61375-2-5, which aims to replace WTB with ETB - E thernet T rain B ackbone.
A few words about the prerequisites for the creation of ETCS - European Train Control System. Rail transport is popular in Europe. But each country has its own standards for railway safety; in addition, there are structural differences in the placement of various sensors, providing similar logical functions. For a painless transition to a new single standard, several levels have been developed.
1.1.1. ETCS Level 1
ETCS first level. At this stage, there is no use of a radio channel for driving a train. Various systems are used to monitor the occupancy of the block area (rail chain or axle counter). Reference points with fixed information or with variable information are used to determine the location of the train, duplication of traffic signals.
1.1.2. ETCS second level
ETCS second level. Using a radio channel to transmit coordinates and train status, permission to move, data on the upcoming block section. Data is duplicated by track automation, in particular, on the basis of track congestion control devices.
1.1.3. ETCS Level 3
ETCS third level. The full conduct of the train on the radio channel. Transition from fixed block sections to dynamic ones. Thus, the distance between trains can be reduced to the necessary and safe, optimal for braking the train.
1.2. Modern railway infrastructure
Now consider the modern infrastructure of the railway. As you can see, a huge number of different technologies will be used to collect and exchange information not only within the train, but also between the train, track automation, railway station and other elements.
Take a close look at the modern train. This vehicle today is the focus of various subsystems, responsible both for the safety of the train on the stage, and for providing comfort to passengers.
1.2.1. WTB bus
An MVB bus is laid within the car, and the train is combined into a single WTB bus. Let us consider in more detail the key functionality of the WTB bus.
The main task is to provide a single information channel between different units of rolling stock.
For this, real-time protocols are used. Furthermore, WTB provides PDM - P rocess D ata M arshalling, LFLD - L ine F ault L ocation D etection, Network Management, Conformity arrangements. English terms are intentionally used to avoid distortion.
The main limitations are:
- the need for complete redirection of devices (when a car is attached or detached);
- a certain number of cars in the train (no more than 22).
1.2.2. MVB bus
In turn, the MVB bus provides interaction between various sensors, actuators and PLCs. The master-slave architecture is used. Moreover, it is allowed to use several devices of the “master” type in the network.
The communication format is shown in Figure 8.
Master sends a request containing the device address and operation code; slave-device - if it received a request from the master - responds.
1.2.3. Data transfer medium
The following media can be used to build the MVB / WTB infrastructure:
- ESD ( E lectrical S hort D istance). It provides communication at a distance of about 20 meters; it is often used to connect devices in one housing;
- EMD ( E lectrical M edium D istance). It is used to provide communication at distances of about 200 meters; up to 32 devices can be connected;
- OGF ( About ptical the G lass on the F ibre) - distance of about 2000 meters. The main application is where high noise immunity is required (for locomotives, for example).
1.2.4. Applied Equipment
Now I would like to say a few words about the classes of MVB devices. The simplest can be attributed to the 1st class. Basically, they are designed to be connected to sensors and actuators. Higher-class devices have a CPU, they can already be configured and programmed. If you look at the technical description of the presented devices [8], [15], [16], [17] we see that Intel Atom N450, XScale IX435, ARM 9, Intel Core i7 and similar processors can be used there. The amount of RAM from 512 MB to several GB. They work under well-known operating systems (including Windows, Linux, QNX). For some devices, it is possible to develop programs in programming languages such as "C" or "Perl".
The modern infrastructure of the train involves the use of various multimedia devices (including smartphones or tablets), with which it is possible to connect to the internal network of the train and receive information about the departure time, weather forecast and other data relevant to travelers.
2. Modern train infrastructure
Now we will consider in more detail a possible scheme that can be used on modern trains, as well as various automation systems that are used to ensure the safety and comfort of passengers.
This figure shows one of the real solutions for building an MVB bus offered by the developer. As you can see, a huge number of different devices are connected to the bus, including the HVAC system (1), the functional for monitoring various parameters of the wheel trolley (2), and there are various external communications (12). All this is controlled by the on-board computer (11).
2.1. Locomotive Telemetry System
Consider some platforms, the description of which was found in open sources. One of them is the Locomotive Telemetry System. As you can see in the diagram, when building this system, widely used protocols are used, including CAN, Ethernet, RS-232, RS-485. Industrial Ethernet switches may be used.
2.1.1. CLUB-U system
One of the platforms responsible for safety on the stage is the CLUB-U system, consisting of various devices. The main functions performed by this system [18]: exclusion of unauthorized movement of a locomotive; comparing the actual speed with the permissible (when exceeding the permissible speed, the “Attention” signal is turned on and the voltage is removed from the EPA electromagnet); braking control before the prohibition signal of the traffic light; signal generation for the automatic brake control system SAUT; control of the vigilance of the driver; registration of motion parameters.
2.1.2. ALS system
"ALS" - Automatic Locomotive Alarm. The system includes outdoor transmitting devices, receiving and decrypting devices on rolling stock, as well as devices that coordinate the operation of ALS with other components of signaling and blocking, indicators, sensors and actuators on rolling stock [19]. It is part of the CLUB-U system.
The principle of operation is this: track automation through a rail circuit transmits a signal at a certain frequency about a traffic light signal. The equipment located on the locomotive receives the signal from the rail circuit, decodes it, and then transfers it to the locomotive traffic light, to the driver’s vigilance control system, and another auxiliary option.
2.2. The system of monitoring the trolley wheelset
In addition to determining free block sections before the train, it is necessary to conduct self-diagnostics and monitoring of the train. In particular, a system for monitoring the state of wheelsets should constantly work. She is responsible for measuring the speed, vibration and other parameters of the wheelsets, and, in the event of a deviation from the norm, generates messages, the result of which may be a referral to diagnostic service after arriving at the terminal station.
2.3. Passenger flow metering system
Electronic tickets and electronic registration for the train - this can hardly surprise anyone. But high-speed trains in their arsenal certainly have a system of accounting and analysis of passenger traffic.
As can be seen in Figure 13, Ethernet switches are used to implement this scheme. In addition, the meters are located next to the doors where an attacker can gain access to them and connect to an Ethernet network.
2.4. Interval Motion Control System
To increase the capacity of the hauls, a transition from fixed block sections to moving block sections is implemented.
Driving in fixed block sections implies that a train travels to the next block section only if it is completely free. In turn, the moving block sections reduce the distance between trains to the minimum distance necessary to safely stop the train going behind.
Mobile block sections can be implemented on the basis of an interval control system based on a radio channel. This solution allows you to increase the capacity of the haul, but it also requires strengthening safety measures to avoid collisions of trains and other emergency situations.
2.5. Diagnostic equipment
Do not forget about various diagnostic systems, some of which are presented in a mobile version.
This equipment can be operated as part of the test equipment (KPA) of integrated locomotive safety devices KLUB-U. It can simulate the activation signals of locomotive control devices, the signals of speed sensors, the telemetry system of the driver’s vigilance control system, and ALS signals.
3. High-speed train “Sapsan”
Above was a small list of various systems that can be used on trains. In particular, in Russia there is only one high-speed train - Sapsan, built on the basis of the German ICE. (Intercity-Express) [20]
In Figure 16 you can see the functional diagram of the Sapsan train control system. And, as already mentioned, it consists of MVB modules that integrate into the WTB train bus.
The train system was built on the basis of SIBAS 32.
The SIBAS system itself was developed for railway transport back in 1983 by the German company Siemens. In 1992, SIBAS16 was upgraded to SIBAS32, which is currently used in trains such as Sapsan and Swallow.
In 2008, the system was upgraded to SIBAS PN, and it is expected that the first train running this system will be launched in 2016. The main difference between SIBAS 32 and SIBAS PN is that SIBAS32 was based on the Intel 386/486 CPU using the closed SIBAS OS, while SIBAS PN is based on the Power PC and Intel Atom CPU. Simatic Step 7 is used as the development environment.
The main features of SIBAS PN are modularity, compliance with industry standards, automatic addressing, software independence from the hardware platform, the availability of registration and monitoring via the WEB interface.
Also noted is independence from the hardware platform, which is achieved through the use of hard real-time OS VxWorks and WinAC. I want to immediately emphasize that there are a number of known vulnerabilities for VxWorks, and up to version 6, a single address space is used. As practice shows, many modern devices use old versions of this operating system, which can very negatively affect information security.
4. Possible attack vectors
Having examined the "stuffing" of a modern train, it is time to talk about possible attack vectors.
4.1. Exposure to radio signals (GSM-R, GPS)
So, what we have in the "arsenal". As mentioned above, GSM-R is used to run the train and transmit telemetry. Through this communication channel, data on the coordinates of the train, its speed are transmitted, information related to the moving block sections is received. Now imagine a situation in which the train receives information that the next few stages are free, and in fact behind the “next turn” the train catches up with the train ahead, because In the control room there is incorrect data on the location of the train ahead. Such an attack scenario cannot be called “fantastic” due to the fact that there are no fundamental differences between GSM and GSM-R. As already mentioned, the main difference between these two standards is the coverage area. For GSM, it is presented as a circular area, in the center of which there is a base station, for GSM-R - extends along the railway. In addition, according to [4], the requirements that are put forward for GSM-R during the construction of ETCS are to ensure double overlap of each section, and, in the event of a radio communication failure, the train should switch to protective mode until emergency braking.
We have already described a situation in which a train collision may occur due to the fact that the control center receives incorrect data about the location of the train. One way to find out the current coordinates is to use GPS. But this technology has some disadvantages. Firstly, the signal itself is rather weak: go into the dense thicket of the forest or move away from the window, and with high probability your device will “lose” satellites. Another, more important point, is the substitution of the signal itself, as a result of which the on-board automation of the train can calculate what is in another place. In fairness, it is worth noting that not only GPS / GLONASS is used to determine the location of a train.
4.2. Impact on track automation
Another possible attack vector may be a different effect on track automation interacting with the train. As an example, it is potentially possible to connect to the ALS “track system” and gain access to make changes to the pulse code packets.
As a result, a signal will be generated prohibiting passage to the next block section. This can lead to a false stop of the rolling stock. The railway is not a freeway, where, if one lane is occupied, everyone will calmly, slowly reorganize into the next lane. On the railway there is a rather tight train schedule, especially on busy sections, and an unexpected stop of the train can create a “transport” collapse. In some European countries, up to 100% of the ticket price is refunded if the train is late for more than 5 minutes. [14]
4.3. Ethernet / Wi-Fi network connection
Since modern trains use technologies such as Ethernet and / or Wi-Fi, which are very familiar to attackers, you should not exclude the option of connecting to Ethernet or Wi-Fi and the possibility of reconfiguring various nodes based on the insecure SNMP v1 protocol. In addition, we should not forget that the attacker has a direct opportunity to connect to the train infrastructure if a passenger flow analysis system is used and thereby potentially gain access to any network device.
To reduce the risk from such attacks - it is necessary at least to carry out network segmentation. As mentioned earlier, some nodes are characterized by high production capacity. In addition, as already noted, there is a transition from the “zoo of systems” to some unified and “unified” systems based on the x86 / ARM architecture using well-known operating systems (Linux / Windows / QNX), which, in turn, have vulnerabilities. Unfortunately, in-service industrial equipment is not always covered by the latest updates and “patches” covering the vulnerabilities found.
4.4. Impact on train automation systems through diagnostic equipment
Another scenario may be a situation when an attack occurs on a computer interacting with various diagnostic equipment, which later connects to automation systems installed on the train.
As practice shows, there are no completely isolated systems. We see examples in abundance in an adjacent area - the sphere of various industrial control systems, where the methods of "connecting from the outside" are constantly found. Thus, it can be assumed that computers that are connected to various diagnostic equipment can also be accessed from the outside. As a result, a possible infection of the computer, followed by a change in the configuration of mobile diagnostic equipment. It is not difficult to guess that the operation of the onboard systems of the train will be affected.
4.5. Modification of firmware on hardware
Do not forget about the possibility of modifying firmware along the route of equipment from the manufacturer to the end customer.
Often, in addition to remote methods of configuring and configuring equipment through special software, you can directly access the hardware by connecting via RS-232. Further, the attacker will take possession of a fairly wide range of equipment configuration capabilities. Until the firmware update. As practice shows, often there is no control of the authenticity of equipment firmware. This may result in the attacker replacing the firmware at the lowest level. As a result, by the behavior it will not be possible to distinguish serviceable equipment from the infected one until the moment of receiving a “critical” data packet.
Unfortunately, the problem of the integrity and authenticity of the firmware of various equipment is typical for many vendors from different areas.
5. Conclusion
As a conclusion, we summarize the main conclusions that we came to when analyzing the safety situation of high-speed trains based on open sources. So, well-known technologies begin to dominate in the construction of TCN, including Ethernet, Profinet. One can observe the transition from closed architectures to an x86-like architecture. There is a transition from proprietary OS to well-known OS. There is an increase in the amount of information transmitted between the train and other systems and an increase in automation systems responsible for the safety and comfort of passengers.
I would like to note that many of the technologies that are used in a modern high-speed train, individually, are already well studied and "broken." The train is an aggregation of such technologies into a single whole, therefore, to implement various kinds of attacks, attackers will have to “break” several systems at once, taking into account the specifics of the railway. And the question of the safety of high-speed trains remains open.
List of references
Here is a small list of open sources from which the information was gleaned:
[1] Railway transport
[2] High-speed ground transport
[3] Railway automation “Components and systems of railway automation of the Siemens company for the railways of the“ 1520 space ”
[4]“ High-speed railway traffic ”Series of lectures by Siemens President in Russia Dietrich Möller
[5] The Only Full-Range IRIS-Certified Product Portfolio for Railway Communication
[6] Change is Easy with New Technology to Upgrade Rolling Stock
[7] Mo Xia, Kueiming Lo , Shuangjia Shao, and Mian Sun “Formal Modeling and Verification for MVB”
[8] EKE “Technology for sm arter trains ”
[9] IRZ-Lokomotiv, Product Catalog 2014
[10] SKF Solutions for high-speed rail.
[11] Automated passenger flow metering and analysis system
[12] Bombardier, “Products and solutions for railway transport”
[13] Technical features of the Velaro Rus high-speed train
[14] Renfe Memoria social
[15] IGW series Multiple Type Bus Gateway family
[16] Duagon, i101 A8 Based CPU Module
[17] Siemens, On-Board Products and Systems
[18] Hardware Description of Locomotive Safety Integrated Devices
[19] Automatic Locomotive Alarm
[20] German Railways
