Student stopped Taiwanese high-speed trains after hacking into radio system

Contents

In Taiwan, a 23-year-old student has been arrested for triggering an alarm in the local railway company's digital radio system using “Software Defined Radio” (SDR) and various handheld radios. This caused four high-speed trains to stop automatically, resulting in delays of about three-quarters of an hour. Local media report that authorities are now reviewing the system's security, while the student faces a prison sentence of up to 10 years.

According to reports, the perpetrator was able to infiltrate the railway company's digital radio system. This system uses the TETRA radio standard, also common in Germany, for encrypting digital public safety radio communications. Massive vulnerabilities in TETRA (Terrestrial Trunked Radio) were discovered back in 2023. The radio standard, developed in Europe, was suspected of having an intentionally integrated backdoor to weaken the encryption of the export version of TETRA, making communication easily eavesdroppable.

Radio system first eavesdropped, then radio device programmed

It is not known whether the Taiwanese student exploited this vulnerability. However, according to police, the student connected the SDR, purchased online, between a laptop and an antenna to eavesdrop on the railway radio, decrypt the parameters, and program them into one of the handheld radios. Reportedly, a friend also provided him with some critical parameters of the “Taiwan High Speed Rail” Corporation (THSR) system, as the Taiwanese portal UDN reports.

Using this, the student was able to trigger a “general alarm” in the THSR system on the evening of April 5th, a signal of the highest priority in TETRA. The four nearby high-speed trains, which regularly reach speeds of around 300 km/h, were automatically instructed to perform a manual emergency stop. This led to delays of 48 minutes after the safety of the tracks could be verified and confirmed.

Questions about the radio system's encryption

Details of the compromise of the THSR radio system are unclear or have not yet been disclosed. Observers suspect, however, that the THSR's TETRA radio system was either not encrypted, allowing the perpetrator to simulate a legitimate signal. Or the THSR radio system is only superficially encrypted, for example with TEA1 (TETRA Encryption Algorithm 1), an outdated stream cipher algorithm for digital trunked radio. This algorithm has the vulnerabilities known since 2023, allowing the student to overcome it.

The police were able to identify the perpetrator using TETRA logs and surveillance cameras. When the THSR control center attempted to confirm the triggered alarm with the sender via radio, the person gave contradictory answers and turned off the radio. An inspection of the THSR radios revealed that the alarm was triggered externally, leading to the police being informed. TETRA logs allowed the radio signals to be located, and surveillance cameras in the area identified the student. During the subsequent arrest and search of his rented apartment, in addition to the laptop and SDR, eleven handheld radios were seized.

Incident leads to investigation of railway security

The student was later released on bail of the equivalent of 2700 Euros, but faces up to ten years in prison for violations of Taiwan's Railway Act and Criminal Code. His immediate explanation, that he “had it in my pocket and accidentally pressed the button,” seems unconvincing.

Meanwhile, Taiwan's Ministry of Transportation and Communications promises a report on how the security of the railway communication system can be improved after this incident. According to Taipei Times, an opposition politician in parliament demanded a comprehensive security review of the railway system, “if a college student could hack into a system as sophisticated as that of the high-speed rail system”. The government states it is working on this and plans to present the report in about a month after its completion.

(fds)