Security vulnerability on U.S. trains that let anyone activate the brakes on the rear car was known for 13 years — operators refused to fix the issue until now

News
By published

Wireless hardware to seriously disrupt rail transport costs less than $500.

Freight Train
(Image credit: Shutterstock)

A security vulnerability on American trains was discovered in 2012, but the American Association of Railways (AAR) has refused to act on it until the Cybersecurity & Infrastructure Security Agency (CISA) published an advisory a few days ago. According to Hardware Security Researcher Neils on X (formerly Twitter), they first discovered the issue in 2012 when software-defined radios (SDR) started becoming more popular. All American trains were equipped with an End-of-Train (EoT) module attached to the last carriage, which reports telemetry data to the front of the train wirelessly.

Back when it was first implemented in the late 1980s, it was illegal for anyone else to use the frequencies allocated for this system. So, the system only used the BCH checksum for packet creation. Unfortunately, anyone with an SDR could mimic these packets, allowing them to send false signals to the EoT module and its corresponding Head-of-Train (HoT) partner. This would not have been an urgent issue if the EoT had only sent telemetry data. However, the HoT can also issue a brake command to the EoT through this system. Thus, anyone with the hardware (available for less than $500) and know-how can easily issue a brake command without the train driver’s knowledge, potentially compromising the safety of the transport operation.

What’s frustrating for Neils is that the AAR refused to acknowledge the vulnerability back in 2012, saying that it was just a theoretical issue and that they’d only believe it if it happened in real life. Unfortunately, the Federal Railway Authority (FRA) lacks a test track facility, and the AAR has not permitted any testing due to security concerns on their property. It has got to the point that the security researcher published their findings in the Boston Review, only to be refuted by the AAR in Fortune magazine.

By 2024, the issue still hasn’t been resolved — the AAR’s Director of Information Security said that it wasn’t really a major issue and that the vulnerable devices are already reaching their end of life. Because the AAR continued to ignore the warnings, the CISA had no choice but to officially publish an advisory to warn the public about it. This has got the AAR moving forward, with the group announcing an update last April. However, implementation is going at a snail’s pace, with 2027 being the target as the earliest year of deployment.

Follow Tom's Hardware on Google News to get our up-to-date news, analysis, and reviews in your feeds. Make sure to click the Follow button.

Jowi Morales
Jowi Morales
Contributing Writer

Jowi Morales is a tech enthusiast with years of experience working in the industry. He’s been writing with several tech publications since 2021, where he’s been interested in tech hardware and consumer electronics.

6 Comments Comment from the forums
  • Notton
    Why would the train operators fix it? That costs money!
    At a time when they're reducing engineers, increasing train lengths, and running ever more dangerous trains for maximum profits, there's no way they'll fix it unless it becomes unprofitable.
    They don't even care if the train doesn't fit inside a secured yard and allow the containers to get looted. (google LA and Chicago container train looting)
    Reply
  • coolitic
    I'm sorry, but isn't there an easily accessible emergency brake in every passenger car anyways?
    Reply
  • USAFRet
    coolitic said:
    I'm sorry, but isn't there an easily accessible emergency brake in every passenger car anyways?
    Yes, but that requires physical presence.
    And possibly being on camera.

    Wireless can be done from outside the train.
    Reply
  • hugh crawford
    This is about activating the brakes on freight trains, possibly remotely or by a Pi and ta software defined radio module left near the track.
    A train full of $300 sneakers stopped in an out of the way location would be problematic.

    A train stopped on a switch with a mile long train of hazardous chemicals approaching would be very bad.

    Having multiple trains across the country apply their brakes by remote control timed just so is one of those scenarios that would make a good movie but would suck in real life.

    So, not remotely like pulling the emergency brake on a passenger train.

    Also, sending telemetry to the effect that “everything Is fine” when it is not could be bad too.

    But hey, the bad guys only have a couple of years of opportunity to figure this out.

    Something like this so be trivial to pull off.

    https://apnews.com/article/norfolk-southern-train-derailment-pennsylvania-automated-braking-0bebaaf927ca061cddb691ea6cb1c599
    Reply
  • mike.stavola
    coolitic said:
    I'm sorry, but isn't there an easily accessible emergency brake in every passenger car anyways?
    There aren't passenger cars on freight trains.
    Reply
  • cojofojo
    mike.stavola said:
    There aren't passenger cars on freight trains.
    I would also imagine that applying any sort of emergency brake system initiates a controlled stop where all the brakes on all the cars are activated. I would think activating the brakes on a single rear car in an uncontrolled manner is more likely to derail the train.
    Reply