'A ticking time bomb': US trains are vulnerable to a simple 13-year-old known security vulnerability - here's what you need to know

Date:
Tue, 15 Jul 2025 20:03:00 +0000

Description:
A long-ignored flaw in US train systems allows remote braking with cheap radios, raising serious safety concerns after over a decade of denial and delay.

FULL STORY

A critical flaw in the wireless systems used across US rail networks has remained unresolved for more than a decade, exposing trains to remote interference.

The vulnerability affects End-of-Train (EoT) devices, which relay data from
the last carriage to the front of the train, forming a link with the Head-of-Train (HoT) module.

Although the issue was flagged in 2012, it was largely dismissed until
federal intervention forced a response.

Ignored warnings and delayed responses

Hardware security researcher Neils first identified the flaw in 2012, when software-defined radios (SDRs) began to proliferate.

The discovery revealed that these radios could easily mimic signals sent between the HoT and EoT units.

Since the system relies on a basic BCH checksum and lacks encryption, any device transmitting on the same frequency could inject false packets.

In a concerning twist, the HoT is capable of sending brake commands to the
EoT, which means an attacker could stop a train remotely.

This vulnerability is still not patched, Neils stated on social media, revealing it took over a decade and a public advisory from the Cybersecurity and Infrastructure Security Agency (CISA) before meaningful action was taken.

The issue, now catalogued as CVE-2025-1727, allows for the disruption of U.S. trains with hardware costing under $500.

Neils's findings were met with skepticism by the American Association of Railways (AAR), which dismissed the vulnerability as merely theoretical back
in 2012.

Attempts to demonstrate the flaw were thwarted due to the Federal Railway Authority's lack of a dedicated test track and the AAR denying access to operational sites.

Even after the Boston Review published the findings, the AAR publicly refuted them via a piece in Fortune .

By 2024, the AARs Director of Information Security continued to downplay the threat, arguing that the devices in question were approaching end-of-life and didnt warrant urgent replacement.

It wasnt until CISA issued a formal advisory that the AAR began outlining a fix. In April 2025, an update was announced, but full deployment is not expected until 2027.

The vulnerability stems from technology developed in the 1980s, when
frequency restrictions reduced the risk of interference, but todays
widespread access to SDRs has altered the risk landscape dramatically.

Turns out you can just hack any train in the USA and take control over the brakes, Neils said, encapsulating the broader concern.

The ongoing delay and denial mean US trains are probably sitting on a keg of gunpowder that could lead to serious risks at any time.

Via TomsHardware

======================================================================
Link to news story: https://www.techradar.com/pro/a-ticking-time-bomb-us-trains-are-vulnerable-to- a-simple-13-year-old-known-security-vulnerability-heres-what-you-need-to-know

$$
--- SBBSecho 3.28-Linux
* Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)