Comment Re:Remote exploit? (Score 1) 53
If it is a passive signal, it seems like the only thing preventing that is a lack of transmit power, at least to within the limits of the curvature of the earth (or, depending on frequency, maybe not even beyond that limit).
It's 220 MHz. Not super fancy. 5-15 mile (7-25 km) range.
Unless it's straight down from overhead (satellites, drones, etc.), in which case the curvature of the earth goes away as a factor, and you're just left with attenuation.
And it's hard to overestimate the potential for financial loss if someone remotely cracked into a SpaceX satellite and manipulated its SDR to send such a signal from space.
No, that ain't gonna happen. You'd need a huge amount of signal (kilowatts for many minutes?) delivered from low-earth orbit to overcome a fairly high-power signal generated only a few miles/km away.
Wait, overpower another signal? That's a new detail.
First, I would assume that such a signaling mechanism would use some sort of spread spectrum or frequency hopping approach to allow multiple senders, or else you'd kind of have a signal-shaped mess on your hands, unless the wattage is *really* small, because presumably a train would "see" more than one signal/switch point at any given time. And if it is really small, that makes it easier to overcome.
Second, if this is PTC we're talking about here, I don't think there are PTC signals on every mile of track all across the country. They put that stuff where it is needed, e.g. near curves with slow speeds. Anywhere else, there would presumably be no signal to overcome, making the threshold for detection way lower.
From a quick Google search (which might not be accurate, given that I didn't dig into the results deeply), PTC receivers on a train can detect signals as small as -95 dBm. A SpaceX satellite can push 34.47 dBm (though whether it can do it at that frequency or not, I couldn't say). You'd have about 5.5 dB of atmospheric attenuation at that frequency and about 92 dB of free space path loss. So given line-of-sight from space through open air, I think getting the signal to be detected by a train should be feasible in the absence of an interfering signal from the ground, with a fairly sizable noise margin, but I could be understanding the math wrong.
That said, even if you had to overwhelm a multi-watt signal, such that a satellite was infeasible because of the signal loss, that would still leave drones, balloons, things left by the side of the track, things hanging from bridges, etc. After all, sending out a few watts from the ground is really no big deal. I've seen handheld CB radios with that much output (different frequency, but you get the point).
So I think you're overestimating how hard this would be to exploit. But I could be wrong. I'm not an RF engineer, and I don't really have the desire to spend a lot of time researching this. Again, my gut says if nobody has exploited this to cause chaos, it means nobody cares enough to bother, which is probably good, because it means there are way fewer terrorists, etc. than we've been led to believe.
Even if the attack requires two-way communication, the attacker still wouldn't need to be close to the train; the signal generator would. Nothing prevents someone from maliciously dangling a battery-powered or solar-powered, cellular-capable pod off the edge of a highway bridge that crosses a railroad track and being half a continent away when actually triggering it.
Give me a break. An evil-doer would have to dangle a lot of battery-operated jammers everywhere along the line, and then all it'd do is slow the darned train down, safely.
Can PTC not completely stop a train? I thought it could. If so, then there's no reason you couldn't completely stop the train. It isn't hard to transmit a signal for a couple of miles in that frequency band. A watt or two should be adequate, plus whatever you need to overcome any other signals if there are any at that particular spot.
This feels like it would be a great Bond movie plot. Someone stops a train and robs it using a drone with a fake PTC signal.