Connect with us

Rail & Road

Critical cyber flaw linked to EoT module ignored in US rail systems for 12 years, fix not expected until 2027

Published

on


[Article updated to add CISA quote at paragraphs 5, 6 and 7]

A critical cybersecurity vulnerability affecting American train systems has gone unaddressed for over a decade, despite early warnings dating back to 2012. The issue, tied to End-of-Train (EoT) modules that transmit telemetry data wirelessly from the rear to the front of freight trains, was first identified by hardware security researcher Neils in 2012. He shared details last week on X, formerly Twitter, noting the risk emerged when software-defined radios (SDRs) became more accessible, allowing attackers to potentially intercept or spoof EoT communications.

Yet for years, the Association of American Railroads (AAR) refused to act on the findings. As recently as 2024, the AAR’s Director of Information Security downplayed the threat, arguing the devices were nearing end of life and didn’t warrant urgent attention. The attacker could remotely take control of a train’s brake controller from a significant distance using hardware costing less than US$500. This access could enable brake failure, potentially causing derailments, or allow for a shutdown of the entire national railway system.

Frustrated by the inaction, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a formal advisory just days ago, forcing the AAR to finally acknowledge the issue publicly. The group announced a plan to replace vulnerable systems in April, but implementation is crawling. The earliest deployment date is projected for 2027.

The delay raises questions about risk management across critical infrastructure sectors and why it took public pressure for a systemic vulnerability to get any traction.

“The End-of-Train (EOT) and Head-of-Train (HOT) vulnerability has been understood and monitored by rail sector stakeholders for over a decade,” Chris Butera, CISA’s acting executive assistant director for cybersecurity, wrote in an emailed statement. “To exploit this issue, a threat actor would require physical access to rail lines, deep protocol knowledge, and specialized equipment, which limits the feasibility of widespread exploitation—particularly without a large, distributed presence in the U.S.”

Butera noted that while the vulnerability remains technically significant, CISA has been working with industry partners to drive mitigation strategies. 

He added that “Fixing this issue requires changes to a standards-enforced protocol, and that work is currently underway. CISA continues to encourage manufacturers to adopt Secure by Design principles to reduce the attack surface and ensure resilient communications systems for operators.”

In the advisory, CISA identified a ‘weak authentication’ vulnerability in the remote linking protocol used between End-of-Train and Head-of-Train devices, affecting all versions currently deployed across U.S. rail systems. “Successful exploitation of this vulnerability could allow an attacker to send their own brake control commands to the end-of-train device, causing a sudden stoppage of the train, which may lead to a disruption of operations, or induce brake failure.”

The protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation. It is possible to create these EoT and HoT packets with a software-defined radio and issue brake control commands to the EoT device, disrupting operations or potentially overwhelming the brake systems.

The vulnerability has been assigned CVE-2025-1727. It carries a CVSS v3 base score of 8.1, indicating high severity. Under the newer CVSS v4 system, it has been rated with a base score of 7.2.

Neil Smith and Eric Reuter reported this vulnerability to CISA.

The agency added that the AAR is pursuing new equipment and protocols that should replace traditional End-of-Train and Head-of-Train devices. The standards committees involved in these updates are aware of the vulnerability and are investigating mitigating solutions.

The AAR Railroad Electronics Standards Committee (RESC) maintains this protocol, which is used by multiple manufacturers across the industry, including Hitachi Rail STS USA, Wabtec, Siemens, and others. 

CISA called upon users of EoT/HoT devices to contact their device manufacturers with questions. The advisory follows recent estimates that around 25,000 freight locomotives will require Head-of-Train (HOT) system upgrades, while roughly 45,000 EOT devices are currently in use across the national fleet.

“I reported this in 2012 when I was very active with ICS-CERT, doing embedded industrial control security research. ICS-CERT was scrappy and new, but were a great group that did everything they could to help resolve critical infrastructure vulnerabilities,” Neils wrote in his X thread, adding that “2012 to 2016 was a stalemate between ICS-CERT and the American Association of Railways (AAR). Everything is just ‘theoretical’ when you’re reversing a protocol in a lab using simulated radio traffic, and the AAR would only acknowledge the vulnerability if we could prove it IRL.”

In 2016, Neils published an article in the Boston Review detailing how the Federal Railroad Administration (FRA) did not operate its own test track facility, and how the Association of American Railroads (AAR) routinely blocked security-related testing that could expose vulnerabilities. The AAR later responded with a dismissive rebuttal in Fortune magazine. “I burned out on this for a while after that article. I felt like this was never going to see the light of day, and I was not going to win against big corp lobbying.”

In 2018, Eric Reuter independently found the same vulnerability, “but only gave a talk at defcon on reverse engineering the protocol. I’d highly recommend checking out PyEOT if you want specifics on RE’ing this vulnerability.”

Neils added that “In 2024, I noticed that ICS-CERT had re-orged a few times and I decided to open a new ticket with them to see what ever happened to this? Did they just give up?”

“No one really knows what happened to it, BUT they were 100% behind getting it right this time. We went back and forth with vendors and the AAR for a few months trying to get the right parties involved to address this issue,” he mentioned. “AAR’s Director of Information Security decided this was not that big of a deal, and they were not going to do anything about it as the devices and protocol were ‘end of life’ which is ironic because they are still in use today. AAR walked away from talking to CISA multiple times.”

He tweeted that “CISA finally agreed with me that publication would be the only remaining option to pressure AAR to fix this issue. And it kinda worked. In April, they announced 802.16t will replace the EOT/HOT vulnerable protocol. When will this happen by? 2027 at best.”

Earlier this year, following reports of a major cyberattack on Ukrzaliznytsia, Ukraine’s state-owned railway operator, Kyiv’s central railway station was unusually crowded on a Monday morning. Long lines formed as dozens of travelers waited to buy tickets for domestic and international routes. The cyberattack disrupted digital services, including the mobile app used for ticket purchases, though train schedules remained unaffected, according to a statement from Ukrzaliznytsia.

Source link

Rail & Road

£5m of Government funding for 26 innovative rail projects to boost passenger experience

Published

on

By


  • First of a Kind competition winners will deliver innovative projects aimed at increasing safety, reducing bridge strikes and incorporating AI technology
  • Previous winners’ projects are already being used across the railways, improving efficiency, safety and reliability
  • £5m Government funding demonstrates commitment to boosting passenger experience, encouraging more people to choose rail and driving economic growth

Twenty-six cutting-edge projects aimed at improving passenger experience on the railway have launched, supported by a multimillion funding package by the Department for Transport.

In partnership with Innovate UK, working closely with Network Rail and train operators, the First of a Kind competition offers grant funding for innovative projects to be tested on the railway, to give them a better chance at being bought by train operators, freight companies and Network Rail.

Given the Transport Secretary’s clear direction to put passengers at the heart of every journey, this year’s winning projects focus on improving safety at the platforms, passenger safety and reducing incidents of vehicles hitting railway bridges. Through working closely with Network Rail and train operators, these innovations will help to improve rail services and infrastructure where it’s needed most.

Among the winning projects is IntelliPan Network, which will reduce delays for passengers by using AI to detect faults on overhead lines, eliminating dangerous, service-disrupting dewirements.

Another successful project, SafeRide 5G, will empower passengers to report incidents using their own devices safely and privately via onboard Wi-Fi, boosting response times and removing key barriers to reporting, improving passenger safety.

Twenty-six successful projects will be supported with £5 million in funding from the Department of Transport, demonstrating the Government’s commitment to trialling innovative technology to modernise our railway and boost the passenger experience. These projects will help to deliver better services for passengers, encouraging more people to take the train and supporting growth as part of the Government’s Plan for Change.

Enjoying this article? Sign up for our FREE newsletter!

Rail Minister Lord Peter Hendy said:

“The winners of this competition are taking cutting-edge technology to address some of the biggest challenges facing the rail industry, making a railway that works better for the people and goods using it.

“These innovations are putting safety, reliability and passenger experience first, like IntelliPan Network using AI to detect faults on overhead lines, reducing disruption caused by dangerous dewirements.

“Through this funding, we are building a platform on which innovation can thrive, giving new technologies a chance to succeed and driving economic growth as part of the Plan for Change.”

Previous competition winners are already being used widely across the railways, like the Portable Track Geometry Measurement System, which provides immediate track information to engineers to speed up the lifting of speed restrictions or line closures, getting passengers to their destinations quicker.

Mike Biddle, Executive Director for Net Zero at Innovate UK, said:

“The innovations receiving support through this competition will contribute to a more accessible, safer, and efficient railway system throughout the UK. The competition highlights the importance of collaboration with industry partners and focuses on delivering high-maturity demonstrations, ensuring seamless integration into the existing railway infrastructure.

“Delivered by Innovate UK, the UK’s innovation agency, on behalf of the Department for Transport, the FOAK rail programme seeks to identify and support outstanding, innovative solutions. Funded organisations will showcase the creativity and impact of their ideas through live demonstrations.”

The twenty-six successful projects have today started work on the new technologies, with testing to take place over the coming months. A full list of winners can be found here.

Want to get more great stories from across the rail industry sent straight to your inbox? Click here to sign up for our weekly newsletter!





Source link

Continue Reading

Rail & Road

More trains, more seats and quicker journeys as rail industry announces December 2025 timetable

Published

on


Thursday 4 Sep 2025

More trains, more seats and quicker journeys as rail industry announces December 2025 timetable

Region & Route:
National

The rail industry has announced the biggest timetable change on the East Coast Main Line (ECML) in more than a decade, which will provide more trains, thousands of extra seats per day and quicker journeys, as part of a wider set of timetable changes across the network this December. 

Launching on Sunday 14 December 2025, the new timetable is the result of £4billion invested on the ECML over the past decade, including the East Coast Upgrade, and will:

  • Improve connectivity between Yorkshire, the North East, Scotland and London, including reductions in journey times to long distance services;
  • Bring additional LNER services on Sundays between Bradford Forster Square and London King’s Cross;
  • Enable all passing services which are operated by Greater Anglia, Great Northern, Thameslink, and CrossCountry, to call at the new Cambridge South station when it opens in early 2026;
  • Enable a new hourly fast service with Northern between Leeds and Sheffield, and additional services between Middlesbrough and Newcastle;
  • Increase TransPennine Express services between Newcastle and Edinburgh Waverley to eight trains per day in each location Monday-Saturday and 7 trains in each location on Sunday;
  • Deliver more frequent East Midlands Railway services between Nottingham and Lincoln, doubling from one train per hour to two trains per hour Monday to Saturday, providing over 2,000 extra weekday seats and 2,500 extra Saturday seats;  

Crucially, the new timetable will include growing capacity with more than 60,000 extra seats across the route each week, and better connectivity, including faster services from London to Edinburgh (just over four hours) and London to Leeds (just over two hours).

The new timetable follows close collaboration between Network Rail, ECML passenger and freight train operators, and other rail industry partners. Whilst the vast majority of services will commence in December 2025, to enable a smooth introduction a small number of services will be introduced in a phased way in 2026.

Ellie Burrows, Eastern regional managing director, Network Rail, said: “The new timetable will unlock thousands more seats, more frequent trains, and quicker journeys along the East Coast Main Line. Our priority now as an industry is to reliably deliver this transformative timetable in December, setting us on the right path to provide further journey improvements in the future for the passengers and communities we serve.”

Rail Minister Lord Peter Hendy said: “Through more seats, more trains and faster journeys, this new timetable will see the biggest increase to intercity services along the route in a decade and will unlock growth along the whole of the East Coast Main Line.

“Growing capacity and improving passenger experience will encourage more people to choose rail, boosting the economy and delivering on the Government’s Plan for Change.”

In addition to the ECML, the December 2025 timetable will see enhancements on other parts on the network too, including:

  • Running more Avanti West Coast services from Euston, including more trains between London and Liverpool;
  • More independent services from Grand Central, Hull Trains and Lumo, including provision for a new Stirling to London service; 
  • Transport for Wales will introduce two trains an hour between Chester and Wrexham, Monday to Saturday, along with a new timetable on the Heart of Wales line between Swansea and Shrewsbury, lifting the through service to five trains each day, and finally the first ever Transport for Wales Sunday service to Coryton.

Jacqueline Starr, Executive Chair and Chief Executive Officer of Rail Delivery Group said: “We’re pleased to support the introduction of this major update to this year’s December timetable and we continue to work closely with industry partners on its implementation. Customers can look forward to more trains and quicker journeys, boosted by the biggest change in more than a decade to East Coast Main Line services.

“In the long-term, this timetable will bring more services, and a more resilient railway that meets the needs of today’s customers.”

The full list of December timetable changes will be published on the journey planner tool on the National Rail website from late September. Meanwhile, passengers can find out what the ECML timetable means for their local area by using the dedicated ECML microsite https://ecmltimetable.info.

About Network Rail

We own, operate and develop Britain’s railway infrastructure; that’s 20,000 miles of track, 30,000 bridges, tunnels and viaducts and the thousands of signals, level crossings and stations. We run 20 of the UK’s largest stations while all the others, over 2,500, are run by the country’s train operating companies.

Usually, there are almost five million journeys made in the UK and over 600 freight trains run on the network. People depend on Britain’s railway for their daily commute, to visit friends and loved ones and to get them home safe every day. Our role is to deliver a safe and reliable railway, so we carefully manage and deliver thousands of projects every year that form part of the multi-billion pound Railway Upgrade Plan, to grow and expand the nation’s railway network to respond to the tremendous growth and demand the railway has experienced – a doubling of passenger journeys over the past 20 years.

Follow us on Twitter: @networkrail
Visit our online newsroom: www.networkrailmediacentre.co.uk





Source link

Continue Reading

Rail & Road

Minister Freeland says industry leaders agree to build with as much Canadian steel and aluminum as possible

Published

on


The federal government’s plan to “build Canada” is going to require “a lot of steel,” and “a lot of aluminum,” Transport Minister Chrystia Freeland said Tuesday. And, she said, industry leaders in rail, maritime and ship-building agree as much of that steel and aluminum as possible should come from Canada. 

Freeland spoke to reporters outside the office of steelmaker ArcelorMittal Dofasco in Hamilton’s industrial sector following a private meeting about building Canadian ferries and rail infrastructure. She said the meeting involved representatives from those sectors, steel companies, related unions and elected officials including Ontario Premier Doug Ford. Some participants were in-person and others, like the premier, attended virtually.

“This was about really putting them together with the steel industry, putting them together with the aluminum industry, to be sure that as you’re building Canada, we are using Canadian steel, we are using Canadian aluminum,” Freeland said.

She did not share details or forthcoming actions but said the meeting was “productive” and “practical.” Participants discussed existing barriers to building in Canada and how the government can help, Freeland said.  

Freeland spoke alongside local Liberal MPs Aslam Rana (Hamilton Centre), John-Paul Danko (Hamilton West—Ancaster—Dundas), Lisa Hepfner (Hamilton Mountain) and Sima Acan (Oakville West) as well as Etobicoke North MP John Zerucelli, who is the Secretary of State for Labour. 

When asked about a recent decision by B.C. Ferries to purchase Chinese-built ships, Freeland said she was “encouraged and inspired” by the enthusiasm she heard for building more in Canada.

She added Ontario builders will be part of that effort. 

WATCH | B.C. Ferries President spoke ahead of the Made in Canada Ferries and Rail Summit:

B.C. Ferries President speaks at the Made in Canada Ferries and Rail Summit today

B.C. Ferries CEO Nicolas Jimenez speaks at the national Made in Canada Ferries and Rail summit today. He aims to address the challenges of building vessels at home and defend the company’s decision to contract ferries from overseas.

Canadian-made steel and aluminum faces a 50-per-cent tariff at the U.S. border. In response to the ongoing trade war, labour, industrial and political leaders have suggested bolstering the Canadian market, including in Hamilton. 

In response, Canada placed duties on $60 billion worth of U.S. goods. Many of those tariffs were removed as of Monday, though some remain on non-CUSMA (Canada-United States-Mexico Agreement)-compliant goods — including steel and aluminum products.

The federal government has pledged related supports, such as a three-year, $450-million program to help businesses overcome trade challenges, which Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, announced while visiting Hamilton manufacturer Hooper Welding in late August.



Source link

Continue Reading

Trending

Copyright © 2025 AISTORIZ. For enquiries email at prompt@travelstoriz.com