{"guid":"68160267-a6a5-4a41-8a51-d8735c8aa338","title":"Breaking \"DRM\" in Polish trains","subtitle":"Reverse engineering a train to analyze a suspicious malfunction","slug":"37c3-12142-breaking_drm_in_polish_trains","link":"https://events.ccc.de/congress/2023/hub/event/breaking_drm_in_polish_trains/","description":"We've all been there: the trains you're servicing for a customer suddenly brick themselves and the manufacturer claims that's because you've interfered with a security system.\n\nThis talk will tell the story of a series of Polish EMUs (Electric Multiple Unit) that all refused to move a few days after arriving at an “unauthorized” service company. We'll go over how a train control system actually works, how we reverse-engineered one and what sort of magical “security” systems we actually found inside of it.\n\nReality sometimes is stranger than the wildest CTF task. Reality sometimes is running `unlock.py` on a dozen trains.\n\nThe talk will be a mix of technical and non-technical aspects of analysis which should be understandable for anyone with a technical background. We’ll briefly explain how modern EMUs look like inside, how the Train Control \u0026 Monitoring System works, and how to analyze TriCore machine code.","original_language":"eng","persons":["Redford","q3k","MrTick"],"tags":["37c3","12142","2023","Hardware \u0026 Making",""],"view_count":122435,"promoted":false,"date":"2023-12-27T23:00:00.000+01:00","release_date":"2023-12-28T00:00:00.000+01:00","updated_at":"2026-04-04T01:30:04.383+02:00","length":3705,"duration":3705,"thumb_url":"https://static.media.ccc.de/media/congress/2023/12142-68160267-a6a5-4a41-8a51-d8735c8aa338.jpg","poster_url":"https://static.media.ccc.de/media/congress/2023/12142-68160267-a6a5-4a41-8a51-d8735c8aa338_preview.jpg","timeline_url":"https://static.media.ccc.de/media/congress/2023/12142-68160267-a6a5-4a41-8a51-d8735c8aa338.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/congress/2023/12142-68160267-a6a5-4a41-8a51-d8735c8aa338.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_trains","url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_title":"37C3: Unlocked","conference_url":"https://api.media.ccc.de/public/conferences/37c3","related":[],"recordings":[{"size":null,"length":null,"mime_type":"text/vtt","language":"eng","filename":"68160267-a6a5-4a41-8a51-d8735c8aa338-eng.vtt","state":"state-4","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2025-08-26T15:25:03.131+02:00","recording_url":"https://cdn.media.ccc.de/congress/2023/68160267-a6a5-4a41-8a51-d8735c8aa338-eng.vtt","url":"https://api.media.ccc.de/public/recordings/74782","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":null,"length":null,"mime_type":"text/vtt","language":"-","filename":"68160267-a6a5-4a41-8a51-d8735c8aa338--.vtt","state":"translated","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2025-06-21T20:02:01.556+02:00","recording_url":"https://cdn.media.ccc.de/congress/2023/68160267-a6a5-4a41-8a51-d8735c8aa338--.vtt","url":"https://api.media.ccc.de/public/recordings/84704","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":56,"length":3705,"mime_type":"audio/mpeg","language":"deu","filename":"37c3-12142-deu-Breaking_DRM_in_Polish_trains_mp3-2.mp3","state":"new","folder":"mp3-translated","high_quality":false,"width":0,"height":0,"updated_at":"2023-12-28T10:18:28.766+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/mp3-translated/37c3-12142-deu-Breaking_DRM_in_Polish_trains_mp3-2.mp3","url":"https://api.media.ccc.de/public/recordings/72244","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":37,"length":3705,"mime_type":"audio/opus","language":"deu","filename":"37c3-12142-deu-Breaking_DRM_in_Polish_trains_opus-2.opus","state":"new","folder":"opus-translation","high_quality":false,"width":0,"height":0,"updated_at":"2023-12-28T10:18:04.478+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/opus-translation/37c3-12142-deu-Breaking_DRM_in_Polish_trains_opus-2.opus","url":"https://api.media.ccc.de/public/recordings/72243","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":600,"length":3705,"mime_type":"video/webm","language":"eng-deu-fra","filename":"37c3-12142-eng-deu-fra-Breaking_DRM_in_Polish_trains_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2023-12-28T13:28:42.909+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/webm-hd/37c3-12142-eng-deu-fra-Breaking_DRM_in_Polish_trains_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/72249","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":276,"length":3705,"mime_type":"video/webm","language":"eng-deu-fra","filename":"37c3-12142-eng-deu-fra-Breaking_DRM_in_Polish_trains_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2023-12-28T11:08:19.001+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/webm-sd/37c3-12142-eng-deu-fra-Breaking_DRM_in_Polish_trains_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/72247","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":277,"length":3705,"mime_type":"video/mp4","language":"eng-deu-fra","filename":"37c3-12142-eng-deu-fra-Breaking_DRM_in_Polish_trains_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2023-12-28T10:18:49.116+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/h264-sd/37c3-12142-eng-deu-fra-Breaking_DRM_in_Polish_trains_sd.mp4","url":"https://api.media.ccc.de/public/recordings/72245","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":56,"length":3705,"mime_type":"audio/mpeg","language":"eng","filename":"37c3-12142-eng-Breaking_DRM_in_Polish_trains_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2023-12-28T10:16:10.363+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/mp3/37c3-12142-eng-Breaking_DRM_in_Polish_trains_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/72239","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":38,"length":3705,"mime_type":"audio/opus","language":"eng","filename":"37c3-12142-eng-Breaking_DRM_in_Polish_trains_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2023-12-28T10:15:50.875+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/opus/37c3-12142-eng-Breaking_DRM_in_Polish_trains_opus.opus","url":"https://api.media.ccc.de/public/recordings/72238","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":703,"length":3705,"mime_type":"video/mp4","language":"eng-deu-fra","filename":"37c3-12142-eng-deu-fra-Breaking_DRM_in_Polish_trains_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2023-12-28T10:09:54.294+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/h264-hd/37c3-12142-eng-deu-fra-Breaking_DRM_in_Polish_trains_hd.mp4","url":"https://api.media.ccc.de/public/recordings/72232","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":587,"length":3705,"mime_type":"video/mp4","language":"fra","filename":"37c3-12142-fra-Breaking_DRM_in_Polish_trains.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2023-12-28T10:09:38.100+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/h264-hd/37c3-12142-fra-Breaking_DRM_in_Polish_trains.mp4","url":"https://api.media.ccc.de/public/recordings/72231","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":587,"length":3705,"mime_type":"video/mp4","language":"deu","filename":"37c3-12142-deu-Breaking_DRM_in_Polish_trains.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2023-12-28T10:09:22.984+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/h264-hd/37c3-12142-deu-Breaking_DRM_in_Polish_trains.mp4","url":"https://api.media.ccc.de/public/recordings/72230","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"},{"size":587,"length":3705,"mime_type":"video/mp4","language":"eng","filename":"37c3-12142-eng-Breaking_DRM_in_Polish_trains.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2023-12-28T10:09:08.096+01:00","recording_url":"https://cdn.media.ccc.de/congress/2023/h264-hd/37c3-12142-eng-Breaking_DRM_in_Polish_trains.mp4","url":"https://api.media.ccc.de/public/recordings/72229","event_url":"https://api.media.ccc.de/public/events/68160267-a6a5-4a41-8a51-d8735c8aa338","conference_url":"https://api.media.ccc.de/public/conferences/37c3"}]}