Critical Railway Braking Systems Open to Tampering

Summary

Researchers demonstrated that legacy train protection systems can be spoofed or tampered with using very simple, low-cost hardware and publicly available information. The Spanish ASFA signalling system — and other balise-based systems worldwide — rely on inductive coupling between trackside balises and passing trains. Because many of these systems were designed decades ago with no built-in security, attackers can reproduce or alter balise signals to issue false speed or stop commands.

The researchers used improvised components (copper-wound cans, capacitors, inexpensive signal generators) to replicate balise signals and stop or control a train. They warn similar attacks could affect modern digital systems (ERTMS/ETCS) too, via jamming, spoofing, relay attacks or tampering, though those systems add layers of complexity and continuous communication.

Key Points

Legacy train protection systems like ASFA are largely analog and were not built with cybersecurity in mind, leaving them open to simple spoofing attacks.
Balises are passive trackside beacons that communicate with trains by inductive coupling; tampering with balise signals can trigger false speed/stop commands.
Researchers recreated balise signals using inexpensive, readily available materials, demonstrating an attacker does not need sophisticated tools.
Wiring and physical protections for balises are often minimal, making physical access and tampering feasible for motivated attackers.
Modern systems (ERTMS/ETCS) add digital features and continuous communication, which improve functionality but introduce new attack vectors such as jamming, spoofing and data manipulation.

Context and Relevance

This research highlights a critical intersection of physical and cyber risk in rail infrastructure. Railway signalling underpins safety for high-speed and commuter networks; weaknesses in balise-based systems can cause life-threatening situations or service disruption. The findings are relevant to transport operators, OT security teams, national regulators and equipment vendors because many networks still run decades-old signalling hardware and upgrades are costly and slow.

As rail networks modernise, attention must focus on both securing legacy assets and hardening digital upgrades against novel threat types. The report is timely for anyone responsible for critical infrastructure resilience and supply-chain decisions affecting signalling equipment.

Author style

Punchy: the story is a clear wake-up call. The researchers’ demo is simple but stark — major systems can be undermined with junk-bin electronics, public docs and a motivated actor. If you’re in OT or critical infrastructure, read the detail; this isn’t theoretical.

Why should I read this?

Short version: because it shows how little effort it can take to mess with trains. If you work in transport, industrial security or any role that touches operational tech, this saves you time — someone else did the messy, hands-on research and flagged the exact weak spots. Worth a quick read so you know what to push your suppliers and regulators about.

Source

Source: https://www.darkreading.com/ics-ot-security/critical-railway-braking-systems-tampering