OggS +. = kOpusHead8 OggS +. Qv*OpusTags Lavf58.45.100 language=eng handler_name=SoundHandler encoder=Lavc58.91.100 libopus major_brand=isom minor_version=512" compatible_brands=isomiso2avc1mp41 author=Redford, q3k, MrTick genre=lecture% title=Breaking "DRM" in Polish trainsQ copyright=Licensed to the public under http://creativecommons.org/licenses/by/4.0 album=37C3 artist=Redford, q3k, MrTick description=We've all been there: the trains you're servicing for a customer suddenly brick themselves and the manufacturer claims that's because you've interfered with a security system. This talk will tell the story of a series of Polish EMUs (Electric Multiple Unit) that all refused to move a few days after arriving at an “unauthorized” service company. We'll go over how a train control system actually works, how we reverse-engineered one and what sort of magical “security” systems we actually found inside of it. Reality sometimes is stranger than the wildest CTF task. Reality sometimes is running `unlock.py` on a dozen trains.OggS +. ƴ&ay;.,.#%! :qw%!O ^i@A9*SyrtGcn7dNCw0mi~D-sxj52p@n]?W2Yw{'XmkM^iN>u&N`5)CRB4< v3b[nVTVJ80yFwSKZ d#%8ud`\d#ƈ(d G 7 E ȫ2' sP *%&<#k]+0P3YK=;@:D@,`F과w[0ѣh(8ș!rGU9>BI4s 7(qW3wKFs.SkK9e&CB3+FmzM C`oab5#+8[м.\p1#P=^.%L閘d9g5jee˔3- $}Ǟ(Twc(>'*=Fv ͌ıɗGz/jۥا%}R F.?m3kΝszϜr''vvhl){AT }' ɿ]7:zlIq'Z#eD{$6 TbeFq;{B{o0 /0Þ%CE It >-2A4:U qzF6k{M2r)Pz.ܥaT4N5}heǩ8w;UQ<0go,PIYDYs$-0*5Ms&YiUN\{ יH3 Ěa