Michał Kowalczyk

Not everything that Newag does is bad.

For instance, we would like to congratulate them on making the shortlist of the European SLAPP Contest 2025!

www.the-case.eu/latest/the-p...

A disgusting and abject betrayal by the US. A decision that will save the US approximately zero dollars and will very directly kill countless Ukrainians

U.K. orders Apple to let it spy on users’ encrypted accounts Secret order requires blanket access to protected cloud backups around the world, which if implemented would undermine Apple’s privacy pledge to its users.

Snooper's Charter realized. "The British government’s undisclosed order, issued last month, requires blanket capability to view fully encrypted material, not merely assistance in cracking a specific account, and has no known precedent in major democracies."

Huge story from @joemenn.bsky.social

This looks huge, a bug allows loading custom microcode into AMD CPUs! Great for reversing CPU internals, but also breaks AMD-SEV and others...

"[...] representatives of this group of hackers, commonly referred to as "ethical hackers", though theft and home invasion have nothing to do with ethics—but well, I understand, ethical hackers, because that's what they call themselves [...]" (a certain Polish MP)

"Hacker", as we in the bizz know well, carries different meanings for different people, and this can cause hilarious misunderstandings. Yesterday, the second part of an ongoing documentary about issues in NEWAG trains that were analyzed by Dragon Sector was aired. [...] gynvael.coldwind.pl?id=799

Awaria (nie)kontrolowana | Seria zagadkowych awarii na kolei i równie zagadkowe zachowanie polityków poprzedniej i obecnej władzy. Dlaczego sprawa, która dotyczy bezpieczeństwa... | By Czarno na biały... Seria zagadkowych awarii na kolei i równie zagadkowe zachowanie polityków poprzedniej i obecnej władzy. Dlaczego sprawa, która dotyczy bezpieczeństwa...

The second part of the TVN24 reportage about the train locks will air today 20:30 CET! (Polish only, unfortunately)
www.facebook.com/czarnonabial...

Od niedziałających pociągów do SLAPP-u - Sieć Obywatelska Watchdog W grudniu 2023 roku głośno było  o zainstalowanych w pociągach produkowanych przez Newag blokadach, które uniemożliwiały uruchomienie maszyn po naprawach w niezależnych od producenta serwisach. Zaczęł...

If you're following NEWAG vs Dragon Sector suits: Citizens Network Watchdog Poland ("independent, apolitical and non-profit organization in the form of a watchdog & think-do-tank") filed an amicus brief with the court urging the court to dismiss the case as a SLAPP
siecobywatelska.pl/od-niedziala...

Od niedziałających pociągów do SLAPP-u - Sieć Obywatelska Watchdog W grudniu 2023 roku głośno było  o zainstalowanych w pociągach produkowanych przez Newag blokadach, które uniemożliwiały uruchomienie maszyn po naprawach w niezależnych od producenta serwisach. Zaczęł...

Sieć Obywatelska Watchdog wydała ciekawy komentarz dotyczący naszej sprawy, analizując ją pod kątem bycia SLAPP-em - siecobywatelska.pl/od-niedziala...

From sabotaging trains to conquering Tricore: Michał Kowalczyk ( @mkow.bsky.social ) and Jakub Stepniewicz (MrTick) take you on a deep dive into RE challenges—500KB of machine code, Ghidra bugs, and embedded adventures. https://re-verse.sessionize.com/session/778969 #REverse2025 #HardwareHacking

Nowa odsłona skandalu na kolei. Newag pozywa posłankę. "Nie możemy dłużej tego tolerować" Newag Nowy Sącz — jeden z największych producentów taboru kolejowego w Polsce złożył do sądu prywatny pozew przeciwko posłance partii Razem Paulinie Matysiak. Przedsiębiorstwo należące do jednego z na...

Newag just sued the Polish parliament member who was investigating the train case 🤡
wiadomosci.onet.pl/krakow/nowa-...

Exact quote of Polish ex-Minister for Infrastructure about Dragon Sector: (translation mine) "representatives of the group of hackers, so called "ethical hackers", despite that stealing and robbing houses has nothing to do with ethics" (???)

Potężne zamieszanie w Sejmie po skandalu z pociągami Newagu. "Posłowie chcą zamieść temat pod dywan" Służby specjalne od dwóch lat wiedzą o skandalu z dziwnymi usterkami w pociągach Newagu, firmy kontrolowanej przez biznesmena Zbigniewa Jakubasa. Jednak w czwartek posłowie sejmowej infrastruktury, na...

Good summary of yesterday's Infrastructure Committee meeting in Polish Parliament (PL only, but translation should work). We were compared to house burglars (because we're **hackers**) and the meeting was closed without giving us and other guests a chance to speak.

[PL] www.onet.pl/informacje/o...

6. Custom feeds on Bluesky are the first implementation of algorithmic choice. Instead of using a single black-box For You algorithm, you can create and subscribe to your own.

Now, there are over 50k+ custom feeds on the network! Check them out:

bsky.app/feeds

YouTube video by M4 Studio The Big Swap: The Russian Spies Posing As an Innocent Argentine Family

We are kicking things off with a series on the spies, crooks and hit-men released back to Moscow in the recent prisoner swap.
Let's start with the improbable identification process of the Russian illegals posing as an Argentine family in Slovenia: youtu.be/3TTFrYqZFZo?...

Biden approves Ukraine’s use of long-range U.S. weapons inside Russia, reversing policy The Biden administration will allow Kyiv “limited” use of the ATACMS long-range missile system to strike enemy positions in Kursk, a significant reversal of U.S. policy.

NEW: Biden's approval for Ukraine to use the powerful ATACMS long-range weapon for limited strikes inside Russia is in response to North Korea's deployment of thousands of troops to aid Moscow's war effort & is a significant reversal of U.S. policy.
www.washingtonpost.com/national-sec...

One of the best summaries of the train case legal proceedings is now available in English!
rys.io/en/175.html

Chcecie być objęci nadzorem ABW? Zapraszamy na Oh My H@ck 2024! Nie pożałujecie ;)

omhconf.pl

Z pozwu przeciwko członkom Dragon Sector: NEWAG zwrócił się do ABW o usunięcie artykułów oraz "objęcie szczególnym nadzorem wszystkich uczestników konferencji Oh my Hack"

Some notes from analyzing the bash part obfuscation of the xz/liblzma part – link leads to the part I found most interesting – it was added in 5.6.1:
gynvael.coldwind.pl?lang=en&id=7...

This might be the best executed supply chain attack we've seen described in the open, and it's a nightmare scenario: malicious, competent, authorized upstream in a widely used library.

Looks like this got caught by chance. Wonder how long it would have taken otherwise.

NEWAG's digital sabotage of Dolny Śląsk's trains - what were they thinking? - Jon Worth In the past couple of days, my Mastodon feed has been full of astonishment about how three Polish IT specialists discovered digital sabotage attempts in trains built by manufacturer NEWAG. The origina...

I've written a piece setting the amazing work by 3 guys investigating NEWAG's digital sabotage of its Impuls trains in the wider railway context.

I try to explain *why* NEWAG behaved as it did, and what the rail industry can learn now the problem has been discovered jonworth.eu/newags-digit...