Mailing List
Mailing List
Sign Up Here
Like, follow & share: visit DrayTek UK's Facebook page visit DrayTek UK's Twitter page visit DrayTek UK's Linkedin page

24th April 2015

Blog:Can trains and planes be hacked?

Can trains and planes be hacked?"Networking", in the context of computing, is the linking up two or more devices in order that they can communicate with each other, or with a central control point, locally or over a wide area.

In the area of M2M (Machine to Machine) this is clearly advantageous with respect to efficiency, monitoring and control. For railways signalling, for example, a line controller having realtime visibility of traffic, signals and switching points means that capacity can now be greater than ever, and problems quickly averted. Compare this to 100 years ago, when signals and points were turned by hand, according to printed timetables - there was no realtime agility. Later, the telegraph, telephone and motorised points improved matters, but now in the 21st century, plans are afoot to fully upgrade the whole of the UK's national rail network so that everything is controlled by a central network. I like trains - everyone does (surely?), but are we ready for cyber trains ?

The introduction of ERTMS

ERTMS (European Rail Traffic Management System) is a system which will actually do away with line-side signals altogether - drivers will no longer have to look out of the window for signal lights as the trains will automatically slow and stop. Signal maintenance will no longer be required and Network Rail (the UK's rail infrastructure organisation) estimate that ERTMS will save up to 40% of cost. It also means that a driver cannot accidentally go through a red light or move the train when required to wait (See 'SPAD and SPAR'). Such incidents have led to serious accidents and fatalties on British railways and around the world.

The ERTMS system can also automatically predict stopping distances, acceleration times and adjust their speed to keep accurately to schedules.  The central ETCS computer creates buffer zones on each track - an area which a specific train is in and long enough to include its own stopping distance, the stopping distance of any other train, and ensuring that it is maintained even with trains stopping at stations. Instead of 800 control centres currently around the country (the modern equivalent of old track-side signal boxes), there would be just 12 control centres.  This accuracy and reliability is claimed to allow for up to 40% more rail capacity.

How Safe is it?

ERTMS is already in use elsewhere in the world and in some parts of the UK already. As above, an isolation zone is created for each train, and every train continuously indicates its position back to the control centre.  It has multiple failsafes and communication redundancy so an adverse incident through failure is unlikely. That is accidental failure; the issue, however of deliberate failure through hacking is another issue.

Could it be hacked?

Anything 'could' be hacked. Recent headlines covered Professor David Stupples's claims that the systems might be vulnerable to attack. He says that the system is well protected against external attack but it could be vulnerable to malware which gets onto the internal systems somehow (as seen in the Target Hack). Such malware could get in via staff being tricked, coerced or corrupt. Theoretically, corrupted code could misdirect trains, cause them to start or stop and cause accidents; even simpler, an internal DoS attack could interfere with communication.   Prof. Stupples doesn't actually claim that there is viable threat or vulnerability within the system - he's just saying that it might be vulnerable - which is true, but you  don't need to be a Professor to say that, nor limit it to train systems specifically  He says that he spoke out to raise awareness of the risk so that it is allowed for,  but then goes on to state that "Governments aren't complacent" and that "we make sure the right controls are in place" (in his role as commercial advisor).  So in summary, he's raising awareness, for people who are already aware and who have already engaged him and cybersecurity experts to make sure the right controls are in place so, to be honest, it does seem to be a bit of a non-story.


What about road and air?

Plane in flightTrain systems are only one area of infrastructure; energy (gas and electricity), road and air traffic systems are all evolving continuously - increasing efficiency and capacity, but also complexity. Some systems just aren't robust at all - for example the University of Michigan claimed that many traffic light systems in the USA are easy to hack.

Security researcher Chris Roberts was banned from all United Airlines flights after claims about hacking on-board systems , although United also claim that Roberts' methods could not hack the on-board system (quite possibly, the most he could do was interfere with the in-seat Linux based entertainment system. It is indeed hard to believe that there is an accessible connection through to the flight control systems, though there must be some linkage to provide the in-seat maps and navigation/flight info. Either way, whilst many are angry over his ban, I don't really want the guy next to me fiddling with any on-board systems...even if the worst thing he can do is make my screen play a continuous loop of The Shawshank Redeption (which would be pretty terrible in itself).  The American Government Accountability Office cites in-flight WiFi and onboard networks as a potential vulnerability in their 2015 report and the FAA has issued new warnings about being vigilant about passengers acting suspiciously.

However sophisticated the security, there could be always sophisticated systems for compromising them, particularly if the attack is state sponsored by an agency with huge resources. That was alleged of the Stuxnet attack which affected internal systems of Iranian nuclear facilities and other national infrastructure. This goes way beyond civic infrastructure - as IoT grows and every element of our life is computerised and connected, the rise of the machines comes ever closer.

To retain confidence in safety, our governments and the organisations running our infrastructure need to be aware of the risks and then expend all appropriate money and effort on making the systems as robust and immune as possible. Actually, while we might not be very impressed with those at the front lines of government (the politicians), there are fortunately foot soldiers working for government working hard and smart.


Plane image courtesy of nokhoog_buchachon; Train Image courtesy of sritangphoto, both at

Note : This article is an editorial piece and does not necessarily reflect the views of DrayTek Corp, its staff or any associated person or company. The information is provided in good faith based on publicly available information however has not been independently verified. As such, no reliance, commercial or otherwise should be placed on the information which is provided for discussion or interest only.


Add a comment to this article

In the below box, you can add comments which you consider might be helpful to other users reading this article:

(As you'd like it to appear on the comment)

NOTE : All comments are reviewed before publication and may not be posted or may be redacted if the editors do not consider them helpful. The use of offensive or obscene language, copyrighted material, or advertising or promotion or linking to any other product or service is prohibited. By submitting your comment, you confirm that you are the original author and assign copyright of the content to DrayTek indefinitely and irrevocably.