Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2833 Thanks!
[Music]
the following talk by
Kya is going to be introducing some
Railway specific protocols like gsmr and
others listen to while ra why Railway is
safe but not secure by Katya stage is
yours
[Music]
hi thank you um it's great to see that
so many people are actually interested
in the topic of Railway security as I
was asked lately um is there even
security like in the railway
system and yes it is it's just that most
of the things are are locked up in like
big
companies and not all of it is easily
accessible so I'm going to talk about
things I learned during my industry
experience and during my time as a
researcher where I had the luck to be
able to speak to a lot of rare
Engineers okay some disclaimers first
someone asked me whether the
um two people on the first slides are
actually me and my dad they're not so I
feel obliged to mention that most
similarities to people living or dead
are purely
coincidental then um most of the claims
I do are based on anecdotes what people
said to me um so it's not like real
evidence and um you will not learn how
to heck a train sorry that talk was
yesterday if you missed it
uh okay so rway Network um let's start
with the basics what do we need uh we
have a train and there's actually a lot
of equipment inside the train but I also
referenced a talk from yesterday the
guys did a pretty good job uh and
explained what you expect there so I'm
more uh interested in the track side
equipment so if you look out uh on a on
a rway journey you look outside you see
some light signals uh you can see some
points you can see a level crossing and
if you look a little bit closer you see
a lot of these yellow boxes in the
tracks beside the tracks they can
actually for example detect the train
and what you can't see
is um that what they are connected to so
interlockings who actually
determine um whether the point should
switch or the light uh is is providing
the indication to the driver that he can
move
on and then like in the near future
whatever that means for rway um we're
also going to have more Wireless
Communications so like the actually the
maximum um speed of a train is limited
uh by the driver being able to still
recognize the light signals so if you
can just send that directly to the train
in a safe manner you could also increase
the maximum speed and that would like be
a really nice
feature okay but what happens if we
actually say to a Riv engineer you need
to get Z we want to do you uh we want to
have Z height well the riv engineer most
likely will respond we have been doing
this for 150
years and the problem is that we here
have a misunderstanding and English
helps so in English we have two terms we
have safety and we have the term
security so what's the
difference safety actually means that we
want prevent uh we want to prevent the
system under consideration here or said
train to harm the
environment and security means we want
to prevent the environment from
influencing the train so that means the
guy in the back with a laptop playing
around with a point leading or cran to
trash crash well then it's
trash okay so both terms are actually
also not what I'm looking for for so for
the remainder of the talk I'm going to
speak about rail security this is not an
established term I just say I I'm just
going to call it that way uh and not to
be mixed up with uh some company in
America America also does everything
different about trains so race security
what do I mean by race security we want
to ensure the secure operation of the
river system and thus enabling the safe
operation of the ra race system so
actually safety is a main goal and
security here is a
tool so why can't we I mean we haven't
had any big crashes in Germany um so why
can't we just stick to how rway has been
operating over the last 150
years and so far the security that R are
providing is based on
processes so I really like this picture
because that has this phone and that uh
very old interlocking with the levers
so you need a lot of phones because
people are talking forth and back via
protocol so actually people are
following protocols like a computer and
sounds a little bit ridiculous if you
hear it for the first time but that's
how they ensure the safe
observations but we are now moving to
more standardized interfaces because
currently like everything looks a little
bit different
and that's quite expensive because you
have everything in hardware and every
time you have another project it needs
to be reconfigured so we're now moving
to towards more standardization towards
more
interconnection and so we're broadening
the attack surface okay then why don't
we just use it security as we know it
well in it security we often rely on
limiting the access to an
Network to achieve safety we want to
have a fallback option we want to have
redundancy we have several
connections for security we want to do a
lot of updates if we find out our system
is not secure anymore for safety that
doesn't work either because we have
standards and these standards have a
lifetime of 30 years so like they're
being discussed in the '90s then they
come into um they are going to be active
10 years later and then you build system
which will be in the field 30 to 50
years so we have a really really long
lifetime so this is kind of
contradictory but um yeah it's moving
forward okay so first steps first we
need to convince rway Engineers that
they actually need to do
security and the first thing you usually
encounter when you're talking to a r
engineer
is we have always done it like this we
don't need
this I call it security by
denial and as I've heard a variant
lately which was oh I think security at
R that's just a hype topic it will go
away okay everyone has their
opinions um and then there was another
reasoning uh which was quite nice
someone said oh I think we're just lucky
because hacking a train is not as sexy
as hacking a plane so we have security
by
unsex let's look at the data so these
are just some of the text you easily
find when you Google rayway attack
news um I mean big ones of course one to
cry is in there think everyone knows
that um and the first three are actually
real it security attacks we have
ransomware in Germany Sweden and Italy
but they all just affected the ticketing
system so they're not like real rare
security attacks we're looking for but
just the system around then we had
sabotage and the emergency stop in
August um there were actually affecting
the operations so train stopped but you
couldn't really call that an IT security
attack because sabotage is just cutting
cables and the emergency stop was
jamming
signals um there also was a DS attack
and that seems uh that it actually
affected um the the operations so they
needed to stop so that one might
classify as a rway uh security as a r
security attack and and um well I don't
know how to classify fixing a train also
uh well hacking a train the one you
heard yesterday because um but you also
find it if you look for
aex okay so I think security by un
sexiness doesn't hold uh people are
interested in attacking the
network okay then what people also tell
you is but nobody can access our Network
any way it's closed we don't need to do
anything I call that security by the
tale of the closed
Network well I already mentioned the
Portland emergency stop um where 20
trains stopped and they were just
jamming the system and actually um the
uh trans uh the wireless transmitting
system here is so old that they could
really just Jam the system and the train
stopped so not really much effort
required so I don't believe in the tale
of the closed network but uh yeah people
do next thing we encounter because uh as
I said before standardization is um
something you use to achieve safety is
uh that they say it's secure because
it's
standardized and for that one we want to
look at a concrete
example
so we want to look at ertms etcs the
European Train control system which is
being standardized and that's for
example
controlling um in in ulink the
connection between the radio PL Center
sending out movement authorities to the
train so that could actually tell the
train you need to do an emergency stop
or you can go forward for the next 10
kilom at speed something
something so several layers we have gsmr
Euro radio and the application
layer and then there's something else I
encountered by trying to read all this
documentation which is several thousand
of pictures and you try to find
something in there I call it security by
paper it's really
annoying luckily for me um there's a
nice paper uh from cha at all and they
explain an attack against this deck and
I want to explain at least parts of this
attack to you and this attack is already
6 years old so it's uh really
old okay so um as I said before we have
uh the stack we have underlying gsmr
which is providing some encryption uh
why do I say some because gsmr is gsm
for R and it's basically
GSM um and there are enough texts about
GSM so yeah and then in Euro radio we
have a message authentication code we
will look at that later and then on the
application layer European Train control
system uh we can send out the movement
Authority or emergency stop for example
so emergency stop is also a movement
Authority so how does the attch work
first you uh read the gsmr
communication then you need to attack
and decrypt
that um then you need to find collisions
so like for the Mac I just showed you
then you can recover part of the Euro
radio key and then you can produce your
forged
message so I'm actually interested in
the recover part of the Euro radio
key okay so let's look how that looks
like like so the Mac is done by triple
Ds that's actually nice I mean n says
it's only uh valid for for legacy
products until uh
2023 but I mean we can say that's a
legacy product so it's still not
deprecated for the next 5 days um but
anyway triple Ds is is not so bad okay
so let's look at that MEC and let's look
at this um message so this is an example
message how the acknowledgement message
from a train could look like um time is
in there the lengths some padding um the
types and then to calculate the Mac it's
actually broken into four into two 64bit
uh blocks and it's triple Ds with um
um CBC mode um sorry I explained that in
a in a sec so what you expect is that
each block is actually encrypted by
triple
Ds and then it's exort with the next
block and then you do another triple
D so that's what you expect that's not
what's happening because for the first n
minus one blocks so in my example it's
just one but could be more they just use
triple D with K1 K1 K1 which is
basically DS with K1
um and that's a problem because D is not
secure especially not with 64
bits so next step of the attack was we
want to find a collision what happens if
we find a collision so we now have two
messages who produce the same Mech and
then we Mak the assumption that the
Collision is not happening um during the
triple Ds round in the end but before
and then we get the equation um well
that equation I'm not going to read it
out and we already know all the messages
because we uh were able to decrypt uh
GSM and um there's only one unknown
value uh and that's a
K1 so we can now Pro Force the 64 bits
of K1 and that should take us a few days
and we have part of the Euro radio key
and that can be used for uh producing a
forged
message
so let's talk about the feasibility of
that
attack I think that part I just showed
you is pretty
feasible um and I hope you believe me
just from following the
slides finding a collision the authors
of the paper so I'm mostly talking about
uh what they are presenting um they
already did some
estimates um sorry um so they estimated
that you or not estimates
calculations um that you need around 10
to the power of 8
messages and with a 1% chance you can do
find them in 45 days and 50% chance of 8
years so why do I think that's
relevant because um as I said before
we're moving into uh the area where we
have more communication Wireless more
standardization so we're broadening our
our Tech surface and we're sending out
more messages so my guess would be that
will become quicker because we will have
more messages in the
network okay then we have uh gsmr and uh
GSM um yeah so that's basically GSM
A51 encryption that's broken there are
lot of attacks out there um I think it's
also feasible to to do that and that was
also shown in the papers proof of
concept and for producing a ma for the
movement Authority that's a little bit
more complicated and if you're
interested in that I refer to the paper
due to the uh time
okay so security by standardization in
principle that's a really nice idea um
but we have a problem if we fix our
crypto algorithms in there and if we
don't allow for change so you need to
have the option to say okay we know that
algorithm is not secure anymore and we
need to switch to a newer one and
especially in this standard um it is
even like hard written it's not just use
triple DF as standardized by someone
else but they specified how it needs to
be
implemented okay let me tell you another
story 5 years ago uh I went to INR so if
you're interested in rail go to INR
really nice can talk to people and there
was a really nice guy with a
box and this box was pretty secure and
we asked hey cool so why is it secure
and he said we have two keys
and he showed us the two
keys so we SP no no it says here you're
doing cyber security so what are you
doing and he said uh oh sorry that's
security by a second lock so then we
asked for cyber security and then we
said we will add security
later I call that security by
futurz and I also have an example for
that so we're going to look at the
Ruster
protocol um it's the rail safe transport
application protocol it has two layers
um it's communicating between the
interlocking and the tracksite equipment
for
example um and the layers
are okay sorry not going there and then
can see what's coming next so uh I
wanted to look at the rusta protocol and
then I encountered another security
mechanism which I call security by pay
wall because a rusta NM costs you
€18 usually you find someone who's
willing to pay that for you most likely
your um
employer and now we can look at the
protocol after we paid the €
1228 and then we have a redundancy layer
and a z Heights and retransmission layer
so uh redundancy layer has some header
some data and a cyclic reny code nothing
interesting there but the Zs and
retransmission layer provides you uh
with the zah heads code cool let's look
at the zahad
code it's an md4 with an initialization
vector and
options okay let's look at the
options option one h no um yeah option
one is a zero B
Cod and must be used if one of the
communication Partners is not safety
critical so the safety Integrity level
zero indicates it's not safety
critical um okay no security option two
is a standard option we have a 8 by zits
code and it's the first half of an
md4 we already know that md4 is
vulnerable to Collision attacks and we
do have certain degrees of freedom in
the messages if we only use eight bytes
um instead of the 16 bytes of md4 it
gets even more vulnerable to a
collision um and then we have option
three which is a full
md4 um but that's also vulnerable to
pre-image Texs so if you know the hash
algorism and we know it md4 um and you
know the hash value which you can just
read out then you can calculate back to
the in initialization vector and if you
have the initialization Vector you can
just use that to well kind of sign any
message you
have and then there's something else and
was also pointed out in a paper by H at
all um if the implementation follows the
example given in the rusta norm then the
initialization vctor will not have 60
random bytes but only eight and the
other eight are just taken from the norm
like the standardized initialization
vector and that might make it even
easier to break something
there well to be honest if you look in
the RFC
1320 it also tell already tells you that
you might not want to use md4 for well
there's no reason against by the way
that's from
1992 uh implementing very high security
digital sign scheme
but it was designed to be exceptionally
fast um it is at the edge in terms of
risking successful Crypt analytica
text but to be
honest the riv people they also state in
their rusta Norm that the communication
via open networks threatened by
unauthorized access is out of scope so
Russa was never intended to do any
security and
we can imagine like Rasta is this really
nice fence around our house and it's
very successfully having for the last
year prevented anybody accidentally
stepping on our flower
beds and then someone came and said oh
cool I already have that fence I want to
be more secure against burglar so I'm
going to lock the
fence that's not how the burglar thinks
so adding security later will not
work security by
futurized a lot of security
mechanisms but what's actually happening
if we talk to them and we tell them that
we want to do
[Applause]
security so usually the communication
goes like this we say okay please do
security and he says okay I'm not
convinced any it's security I'm going to
use the md4 or sh 256 or whatever you
want and we say oh no you cannot use the
md4 um what's missing in this
conversation is the misconceptions the
rare engineer might have and I had the
luck to speak to a couple of rare
engineers in the uh 3 months ago and I
learned when there is a security they
hear we want them to do
cryptography and when they hear
cryptography they think what was that
again something to do with Email
encryption they want me to encrypt my
stuff and then they think okay
encryption
algorithms uh yeah sh 256 I heard that
one
before so we're doing a pretty bad job
EX at explaining to them
what we really want them to do because
they never understand why they should
encrypt you can see whether the point is
moving or whether the train is moving or
stopping and we don't want them to
encrypt we want them to do Integrity
protection in most cases so we have here
really we have a problem uh in
explaining to them what the goals
are and that s because most likely we
have a common goal we want to have safe
and secure Railways running very
efficiently and we can just go to
holidays or transport Goods because it's
a great way of Transport it's very
convenient very fast and environment
friendly and we also must not forget
that they also have expertise they know
how to keep the system safe and we know
how to make the system
secure so it would be great um if we
could use that and actually that's
already happening
so a new security standard is coming up
for rways and it's based on some proven
operational technology security standard
and it actually provides static and
dynamic
requirements so we we're moving away
from this we fixed it 30 years ago and
then it has to work but we can start to
change things we're taking that into
account
now then we have uh we're moving from
the communic ation via UDP to
communication via TLS I mean I just said
that we don't really care about
encryption but obviously we want to have
security and depths we want to have
every layer secured and if we uh encrypt
the layers not everything is readable
anymore and then there's also um some
best practices so the ulink Standard
Security Service and I'm not sure
whether I mentioned uling before so it's
a
European um so they're moving towards
more standardized interfaces uh and
everything that's basically UL links or
one of them is UL links and that
contains public key
infrastructure uh identity and access
management things backup so yeah things
we already
know
so please try to work together with them
try to learn each other's language a
little bit and just be excellent to each
other thank
you
[Music]
thanks gya for this nice talk um I would
be almost uh lert to ask you where you
got those nice images from the hand
drawings they're cool but let's let's
keep that aside do we have internet
questions not yet you can line up at the
yeah microphones microphone number one
please hi k yeah uh thank you very much
for your talk I have a question
concerning your basic assumption that
would be that this security is needed to
uh ensure a safe operations but aren't
there any systems in place that are kind
of redundant that also stop a train once
the communications is uh hacked yeah
basically so safety is ensured and the
safe state for train is just to stop so
um so usually the rare Engineers is uh
happy if the trend just stops but we
also want to move into this please
provide uh so the going on with your
operation yeah but the biggest fail is
uh passengers being pissed but not
passengers being dead right okay that's
off first
goal okay microphone number
two hey thanks for the talk um I was
wondering um like when md4 appeared on
that screen I think bunch of the crypto
people in this room were cringing a bit
um and I was wondering is this a it is
insecure because the standard is that
old or is it an it is insecure because
we didn't know better and if it's the
latter you mentioned uh learn each
other's languages um how can we make
sure in those standardization committees
that this kind of expertise is there
when it's
needed so question was why was md4 in
the standard in the first
place well and and how to get the
expertise into the standardization
committees I I think parts of that is
already happening so um yeah I'm I'd be
glad if I get more people interested in
in uh doing security for Railways
because I think it's a really cool field
uh um and I think we we need more people
uh with with also the it security
expertise in the field um so I think
it's it's already partially happening
that people are moving there um and md4
at that
time it it might be seen like a good
idea and they didn't follow the idea
that you use more proven
cryptography um and actually they choose
something very recent I don't know why
they did that
thanks okay microphone number four hi uh
thank you for presentation I'm in cyber
security of the trains for the last 5
years we do pentesting of the trains and
I can confirm that your cases are not
anecdotal you can actually steal the
train we physically did that
[Laughter]
uh uh so that's that's the first first
part uh second part uh what is your view
um let's say for last for next 10 years
is it going to be better or worse and
then I will tell my
opinion I'm a very optimistic person so
I hope it's getting
better yeah that what we do not
share actually I do believe in next 5
years it will be much worse because of
the convergence because the OT nit
systems are now nearly the same and and
the new trains we testing are just the
running data centers it's it's data
centers on the rails but after some big
[ __ ] happening I believe it will get
better yeah yeah usually
unfortunately you need a big [ __ ] first
uh but then yeah it moves faster okay
thank you thanks thanks for the insights
uh microphone number three please so you
mentioned TLs but isn't that just
security by tunneling Legacy protocol
over crypto basically um and not really
security by
Design well basically currently we're
using
UDP um or a lot of UDP
and um I think that TLS gives you just
another line of defense if you cannot
just easily decrypt the um the lowest
layer
um but yeah you still have the other
Legacy protocols going there thanks okay
now microphone number one please uh hi
earlier you were talking about a Euro
key that you were extracting is this a
key that's rotated or is this one key
forever in every
device um uh the Euro radio key Euro
radio key yeah um actually that's a
session key so you also if you want to
to do that attack uh like really do that
attack you also have to take into
account that a session change and so on
so that makes it a little bit harder uh
to crack there's some some fix key then
they calculates a session key and that
one you can extract part of that so it's
not too
bad just part of IT
Tech thanks microphone number four
please yeah thank you um the new
standards you mentioned do you know of
any efforts to add future
proof um encryptions change overs like
and for now the new encryption and
algorithms we consider safe but in the
future maybe we want to change them
again so this md5 md4 problem that we
now have we maybe have in the future
with SAA or something like this um I
mean I didn't check the standards but I
think yes they do that's what I
understand under the static and dynamic
requirements and uh industry is
discussing that and taking into account
that you need to be able to uh also
switch to newer uh cryptography
algorithms so they are
aware okay now microphone number three
please I would like just to comment on
the md4 topic um that's mainly because
the implementation of this algorithm is
NE to be done in the safety processor
with a special operating system and so
on and people tend to go for easy
implementation of algorithms instead of
doing Shard just doing md4 because it
has to be validated certified afterwards
that's the main reason why md4 was
picked and the IV is just used to
separate interlocking sections from one
another and on the TLs topic I would
like to comment that I think that's the
most sophisticated protocol we have
right now um for end to end security and
um in the end what is https doing there
it's doing a using a very old protocol
just wrapping security around it and
then everybody's using it for online
banking or yeah hopefully in the future
also for your health records instead of
yeah whatever the guys come up with
thanks okay thanks um the internet has
woken up the internet is asking uh you
mentioned the session key how long is
the session
um I'm not sure sorry I cannot answer
that I I think in the paper they
mentioned something that it's
different and that it's couple of
days okay something that can be read
probably somewhere okay microphone
number one uh thanks coming from the
other side as the col before also in OT
we've been deploying um IDs systems
mainly like noomi dragas Clarity you
name it um directly at the train because
as you said they're like moving data
centers already um my question to you
would be have you talked to the rail
guys or like what's your Insight on this
afterthought basically or like you just
monitor the trains and not really the
system right like it's a local solution
to a global
problem so what would be your your
Insight on this on how to tackle this
I'm sorry for me a train is basically
just a big black box because they have
so many different equipment in there
that it's at least as complex as the
rest of the system especially if they
for example go cross border they need to
be equip fall of the different uh inuse
standards so um for me train and track
side are completely different worlds
also they I I cannot really say much
about that so would it be feasible to
have some kind of European train CT or
something where you have like a global
or like a European sock because it's
just monitoring
right yeah but currently I mean the
since the network has been growing over
years and over uh decades you still have
all of these old protocol s and and
completely different Technologies in use
um I don't I think that's like really a
problem or that makes it also so very
special because we're we're now trying
to move into a more standardized
approach and if you have standardized
traffic it's uh I guess um much easier
to to monitor that
um but
with with this fragmented Network I
don't see how that would be feasible
currently I'd hope like we see roll out
of um of the uling stard that at some
point you you'd start to at least start
to monitor the the newer communication
parts of the system thanks okay thanks
um next question microphone number four
please thanks first for the great talk
so I have two questions first of all all
yesterday and during the year several um
um breaks of the Tetra um protocol had
been shown so I know that uh as critical
infrastructure rail wave system was
affected Al also by it so do you know by
such cases and how do you mitigate it
it's my first question the second one um
I'm also busy in the um standards and
regul uh regularization part in another
area but I know of the challenges so I
would be curious to know about this
Dynamic requirements how do you want to
verify that this Dynamic um are um hold
really thanks okay thanks for the
question so first question was uh about
the chetra uh attacks on Tetra Network
and how that's affecting R sorry I have
no clue um it's it's sorry the the
network is really huge so I have to say
I'm my my knowledge is like limited to
okay what area um and the second
question was how how you do about
Dynamic requirements and standards I
think it's basically forward referencing
another standard and uh ensuring in the
standard that you say for your product
you need to be equipped with the option
to uh change cryptography and your
cryptography options for example are
written in the actual current standard
from most likely n um something like
this okay but then the obligation is is
lost you know then you refer to another
one and then you're gone so this I
wanted to know it that's the answer
standardization has its own legal
problems thank
you all right thank you everybody for
the questions we're getting close to the
closing time actually um I cannot really
admit more questions but kadya is going
to be available you can talk to her I'm
sure outside somewhere and continue the
lovely discussion we had here but now
for now big Applause for Kya again
[Applause]
[Music]
thanks