Presented at
DEF CON 32 (2024),
Aug. 11, 2024, 2 p.m.
(45 minutes).
In this study, we delve into the darker aspects of railway technology, revealing how easily accessible domestic hardware tools can compromise the seemingly infallible robustness of signaling systems. We demonstrate how these accessible technologies can be utilized to devise strategies that potentially threaten train circulation in Spain. Our research presents a critical analysis of the vulnerabilities present in the railway signaling systems, highlighting the ease with which these systems can be tampered with, using tools that are readily available to the general public. Through a combination of theoretical insights and practical demonstrations, we offer a comprehensive overview of the risks associated with such vulnerabilities.
Our findings aim to raise awareness among stakeholders in the railway industry, prompting a reevaluation of current security measures and encouraging the adoption of more stringent protections against such threats. This paper contributes to the ongoing discussion in the cybersecurity community, offering valuable insights into the potential risks facing modern transportation infrastructures and suggesting avenues for future research and development in railway system security.
We consider this work to be innovative on a type of system that has been present for over half a century in railway infrastructures. Therefore, the references provided are primarily about the operation of the systems and relevant news concerning them.
1. [link](https://www.sepsamedha.com/on-board-systems/asfa/)
2. [link](http://www.railway-technical.com/signalling/train-protection.html)
3. [link](https://www.seguridadferroviaria.es/recursos_aesf/4CAB0E7F-4C5F-404A-A2DC-3E033FDD2BC9/144051/033ETASFAdigital2008.pdf)
4. [link](https://www.linkedin.com/pulse/asfa-digital-sepsamedha/)
5. [link](http://electronicapascual.com/blog/?p=3129)
6. [link](https://en.wikipedia.org/wiki/Punktf%C3%B6rmige_Zugbeeinflussung)
7. [link](https://en.wikipedia.org/wiki/Intermittent_inductive_automatic_train_stop)
8. [link](https://en.wikipedia.org/wiki/Santiago_de_Compostela_derailment)
9. [link](https://en.wikipedia.org/wiki/Contr%C3%B4le_de_vitesse_par_balises)
10. [link](https://www.eldiario.es/sociedad/alvia-adif-renfe-asfa-digital_1_5758584.html)
11. [link](https://www.diariodenavarra.es/noticias/navarra/2022/03/31/25-aniversario-accidente-tren-uharte-arakil-522467-300.html)
12. [link](http://descargas.adif.es/ade/u18/GCN/NormativaTecnica.nsf/v0/E9811579073E406CC1257E81003BDD76/$FILE/ET%2003.365.008.6_2015.pdf?OpenElement)
13. [link](http://descargas.adif.es/ade/u18/GCN/NormativaTecnica.nsf/v0/E875C349AD1DE569C125840B00379B26/$FILE/ET%2003.365.008.6%20ASFA%20Digital%20Embarcado+M1+M2.pdf?OpenElement)
14. [link](https://www.youtube.com/watch?app=desktop&v=2zY_zlOoieE)
Presenters:
-
Gabriela (Gabs) Garcia
Gabriela (Gabs) García is a university professor and mentor, Secure Software Developer and coding and cybersecurity instructor for organizations such as LinkedIn, Cyber Hunter Academy and Kschool. She teaches, whether that's in a lecture hall or over the internet, about software development, with a keen eye for secure practices. She is a speakers in several hacking CONs like DEF CON USA, ROOTEDCON etc.
Gabriela is also an active member in hacker communities such as HackMadrid%27 and Hack%27, both at home in Spain and across the world. And as an independent professional, she gets to work with a wide variety of clients, crafting custom cybersecurity solutions to fit their specific needs.
-
David Meléndez
- R&D Enginner and Red Team Member, Innotec Security at Accenture
David Melendez is an R&D Enginner and Red Team member at Innotec Security Part of Accenture, with over twelve years of experience in cybersecurity and hardware hacking. He has a proven track record of presenting his groundbreaking investigations at prestigious conferences around the world, including DEF CON, BLACKHAT, and ROOTEDCON.
David is also a drone creator and author of the book "Hacking with Drones," which showcases his innovative use of drones in cybersecurity research. With his passion for pushing the boundaries of technology, David is constantly seeking new ways to improve the security and functionality of embedded systems.
Similar Presentations: