mastodon - Link to source

The most thought proving article I have read this week:

A Norwegian bus company wants to know if their buses could be abused by China in the case of war.

So they drive two buses deep into a limestone mine to isolate them from the internet and forensically investigate how they work.

In the mine, investigators discover a Chinese kill switch which could destroy all Chinese buses.

In Denmark, that is 57 percent of the bus fleet.

Source (Danish):

zetland.dk/historie/svNwC3c5-a…

Dybt i et norsk fjeld blev en kinesisk bybus splittet ad. En status på vores frygt

En kinesisk bus blev nøje analyseret for mystiske signaler.
Kaare Sørensen (Zetland)
in reply to MarjorieR

mastodon - Link to source

MarjorieR

@titanmanfred just to amplifiy this point. Nearly all internet connected devices have a kill switch.

Teslas have a kill switch
Your ISP supplied router has a kill switch
Your phone has a kill switch
Your Windows computer has a kill switch
Your programmable bed has a kill switch
Your robot vacuum has a kill switch
Your MS Mail account and your Bank account has a kill switch (ask ICC judges)
Your data in the US owned cloud (even if hosted in Europe) has a kill switch
F35 planes, NATO donated to Ukraine, have a kill switch.
Your Polish locomotive has a kill switch (activated if you try and use an independent repair shop).
All these have been mentioned in the news and in the Fediverse recently.

Most of these are controlled by US or Chinese companies. Particularly with Trump in charge and alll the tech Billionaires subbing him are you sure that the American ones are less lilkely to be used against you by the USAian companies than the Chinese companies to disable your kit and maybe your life?a

@Manfred
This entry was edited (3 months ago)
in reply to Randahl Fink

mastodon - Link to source

Osma Suominen

US made John Deere tractors also have a kill switch and it has been used to disable some of them (in this case tractors stolen by Russian troops) remotely:

orchardandvine.net/news/john-d…

edition.cnn.com/2022/05/01/eur…

(EDIT: this was also mentioned briefly in the Danish article linked above)

John Deere ‘Kill Switch’ Renders Stolen Tractors Useless

John Deere has struck a blow against the Russian Army, in its war of aggression in Ukraine.
orchardandvine.net
This entry was edited (3 months ago)
in reply to Randahl Fink

mastodon - Link to source

jesterchen42

To be honest: I'd love a broad scale analysis of this. Few days ago it as a vacuum cleaner, now buses...

Test this in all things. From mobile phones to cars (don't care if Chinese, US or German), smart beds (well... actually leave these ones out. Who buys a bed that needs internet?!), switches, routers, water pumps, ....

I bet they'll find stuff in too many places.

in reply to Randahl Fink

mastodon - Link to source

Nicolas Fournier

@ArtHarg

you have plenty of this, everywhere
one of my favorite is farmers using hackers to be able to self-repair their tractors...

copperhilltech.com/blog/farmer…

Farmers Are Hacking Their Tractors Because of a Right to Repair Ban

For decades, American farmers have been at the mercy of agricultural equipment manufacturers, who have locked down their tractors with proprietary software, restricting repair options and forcing owners to seek expensive, manufacturer-approved servic…
Copperhill
@Arthur van der Harg
in reply to Randahl Fink

mastodon - Link to source

The Penguin of Evil

@thierry_van_kerm which is also a risk even if the supplier is honest. It's how the Russians destroyed a whole load of satellite kit just before Ukraine kicked off. Compromise the vendor downloads and ship firmware that physically burns the flash memory. At that point it's probably a PCB swap to restore for most users. A PCB that won't be stocked in bulk, probably uses components no longer manufactured and cannot trivially be mass manufactured again.
@Thierry Van Kerm
in reply to Randahl Fink

mastodon - Link to source

Bernard

with reference to some comments below, the USA is far worse on this topic. They call it intelectual property rights. Which makes you hand over all the sensor data of the John Deer plough, seeder or harvester to the USA mothership. Which is then sold to hedge funds to hedge against the price of the harvest you as a farmer have invested in and worked hard for. So your farm data is used by biljonairs to increase their wealth at the expense of the farmers doctorow.medium.com/about-thos…

Medium

Medium
in reply to Randahl Fink

mastodon - Link to source

slotos

Reminds me of Polish train manufacturer bricking their trains located close to independent repair shops.

So far, the only people suffering for this decision are the people that helped unbrick the trains in question.

hackaday.com/2023/12/14/polish…

This is not a China phenomenon but a greed one. Not to say that Chinese government doesn’t enjoy the results, just that I doubt they had to actively instruct anyone to include these kill switches.

Polish Train Manufacturer Threatens Hackers Who Unbricked Their Trains

A week ago we covered the story of a Polish train manufacturer who was caught using software to brick their products after they had been repaired by in independent railway workshop. Now 404 Media h…
Hackaday
in reply to Randahl Fink

mastodon - Link to source

NoBorg

European option:

"The extensive network of IVECO BUS and IVECO service points guarantees support wherever a vehicle is operating worldwide. The manufacturer employs more than 5,000 people and has five factories, located in Annonay and Rorthais in France, in Vysoké Myto in the Czech Republic, and in Brescia and Foggia, in Italy."
ivecobus.com/france/La-Marque

La Marque - En route vers le changement | IVECO BUS |

IVECO BUS, acteur clé du transport public. Découvrez notre entreprise, nos équipes, et comment nous menons le changement.
www.ivecobus.com
in reply to Randahl Fink

mastodon - Link to source

NoBorg

Sad story, Alstom Aptis was manufacturing good electrical buses in Alsace, France, but due to low demand, they cease activities in 2021.
European Union countries should give priority to EU products so that OUR companies don't close and to prevent sad surprises.

fr.wikipedia.org/wiki/Alstom_A…

Alstom Aptis — Wikipédia

Contributeurs aux projets Wikimedia (Fondation Wikimedia, Inc.)
in reply to Graeme 🏴󠁧󠁢󠁳󠁣󠁴󠁿

mastodon - Link to source

Slyence

@pa27 thats a bunch of bullshit

Here’s what can happen:
You can get cut off from software updates
You can get cut off from American made parts

But guess what - America needs the parts made in evey f35 partner nation to keep their jets flying too

The program forces everyone to play nice

@Graeme 🏴󠁧󠁢󠁳󠁣󠁴󠁿
in reply to Randahl Fink

mastodon - Link to source

Kerplunk

A Norwegian bus company wants to know if their buses could be abused by China in the case of war.
in the mine, investigators discover a Chinese kill switch which could destroy all Chinese buses.

BOLLOX

Thank you for replicating the ridiculous accusations. A sim card and update box was found.
That system is used in thousands of buses, trains, cars, tesla for example can be switched off from usa as can john deer tractors.

in reply to 65dBnoise

mastodon - Link to source

Paco Hope

I think @65dBnoise has a point. I’m pretty sure the same sort of feature is built into nearly every “smart” lightbulb and “smart TV.” The issue is not the nationality of the software developer. It’s the whole notion of being dependent on some cloud service, generally.

If the authors think war is the only reason the company would use that kill switch (or even the most likely reason) try repairing a bus with unapproved parts or trying to make unauthorised modifications to the software running on the bus. Or maybe just try not paying the bill.
@randahl

@Randahl Fink @65dBnoise
in reply to Mike Spooner

mastodon - Link to source

Paco Hope

@shelldozer C’mon. Be realistic. If the Danish rep in the UN condemns the treatment of Uighurs in China, the Chinese bus manufacturer is not going to retaliate by bricking a bunch of buses in Denmark. The diplomatic fallout would be extreme.

The point is well taken that once it’s possible to brick these buses at all, it is possible to do that for a trivial reason. And what they discovered is that it is possible. But that doesn’t make it likely that they would do this for a trivial reason.

Sadly, I can’t figure out how to pass that article through a translator so I haven’t read it. When I hand it to google translate on my phone, Danish still comes out.
@65dBnoise @randahl

@Randahl Fink @65dBnoise @Mike Spooner
in reply to Randahl Fink

gush - Link to source

Tak!

The most thought-provoking thing about this article is that it highlights the absolutely wild level of sinophobia in scandinavia.

My wife's Volvo has remote firmware update functionality, is that a Swedish killswitch? Every one of the tens of thousands of Teslas in Denmark has remote update functionality, is that an American killswitch? Modern BMWs have remote update functionality, are those German killswitches?

I personally hate the techbroization of modern cars, and I believe that every one of these features should be regulated out of existence, but

it's amazing how this kind of stuff is accepted and normal in every part of our lives until a company based in China does it, and suddenly it's "😱 THE CHINESE GOVERNMENT HAS KILLSWITCHES IN OUR BUSSES 😱"

🙄

This entry was edited (3 months ago)
in reply to Tak!

mastodon - Link to source

Randahl Fink

@Tak Not wanting remote kill switches in products has nothing to do with sinophobia. I am against ALL remote kill switches from ANY country that my country could potentially go to war with.

After Donald Trump has threatened to invade Greenland, I find it deeply problematic that Danish politicians continue to use American iPhones. That does not make me anti-American. It just makes me conscious of the very real security risks Donald Trump represents.

@Tak!
in reply to Randahl Fink

mastodon - Link to source

Perrin42

I think the point is that every device that supports OTA updates has this sort of "remote kill switch". If Apple or Google wanted to disable your phone remotely, they could push out an update that did that. Same with Volvo, Tesla, Rivian, Chrysler, HP, Roomba, Sony... If it can be updated remotely, it can be disabled remotely.
This entry was edited (3 months ago)
in reply to Randahl Fink

hometown - Link to source

an interesting bean

@Tak the article doesn’t claim to have found a “remote kill switch” but rather posits that OTA updates could be used as such. Which is almost certainly true. But did the Norwegian government want a different arrangement? did they ask for the opportunity to audit OTAs and sign them for distribution to their fleet? Because big municipal buyers could almost certainly work with these companies to get these things. It’s just not a priority for most government purchasers to add complexity and would be an ongoing expense in IT infrastructure
@Tak!
in reply to Randahl Fink

mastodon - Link to source

Marcel

@Tak Apart from the security risks, it started, I think, with greed - greed by companies who say: you may think you own that device, but no, we control it, we tell you how to use it. It's as simple as software as a service so instead of buying Word or Excel once, you have to pay for it every year. And it's how HP can decide to brick your printer if you put in any brand of ink except theirs. How software companies can force you to buy a new phone just to use basic functionality.
@Tak!
in reply to Randahl Fink

mastodon - Link to source

Ben Aveling

Not the first time “rogue devices, including cellular radios, were discovered in Chinese-made power inverters“ m.economictimes.com/news/inter… @randahl

Chinese 'kill switches' found in equipment at US solar firms trigger national security fears. What are the

Engineers have discovered 'kill switches' embedded in Chinese-manufactured parts on American solar farms, raising fears Beijing could manipulate supplies or 'physically destroy' grids across the US, UK and Europe.
ET Online (Economic Times)
@Randahl Fink
in reply to Randahl Fink

glitchsoc - Link to source

KasTas

well, translation does not sound that scary and specific:

> " The Chinese electric bus contains a computer that, among other things, controls the bus's battery and engine, so the bus can most efficiently drive around Oslo. And this computer is – via a small sim card – on the Internet, so it can send information and sometimes retrieve an update back. For yes, a bus can be updated in exactly the same way as your phone."

TL;DR: remote tracking and updates which can be used maliciously

in reply to Randahl Fink

mastodon - Link to source

Daniel Molkentin

Sorry, unless we suddenly start to take non-elective OTA updates without safeguards such as independently reviewed, reproducible source code builds as the theoretical but very possible general threat that they are, I fail to see how this is special. Even more so because @briankrebs boosted it.

Vendor-forced OTA updates are an accepted practice. Attack the practice, not the practitioner.

@BrianKrebs
in reply to BrianKrebs

mastodon - Link to source

Daniel Molkentin

@briankrebs point taken, but the article is baity to the point of being false. They did not find a backdoor, unless all auto-OTA devices are considered backdoored (which is an assumption most of us professionals work under, but not the articles' general public audience). With a headline like this, I would expect an actual remotely triggerable reverse shell tbh.
@BrianKrebs
in reply to shironeko

mastodon - Link to source

BrianKrebs

@shironeko @danimo I think the honest answer to your question is the entire industry is a race to the bottom, and comparing the relative security of devices does not offer a very wide range. That said, not all router makers, e.g., ship devices w/ years-old Linux vulnerabilities, or make major updates but use the same revision numbers etc. Or have a history of including undocumented user accounts, etc. Not saying TP-Link is guilty of all that, but the truth is most consumer-grade devices are best wiped and equipped w/ open source firmware. It's a horrible market all around.
@Daniel Molkentin @shironeko
in reply to Randahl Fink

mastodon - Link to source

Daniel Molkentin

Honestly, with the Cloud Act and similar laws in place and tech companies obediently submitting to the Trump Administration, I don't really trust any product from the US, and I am saying this with a lot of US tech on my desk. I don't see why I should trust US products any more than I trust Chinese ones.

If it would serve his purpose, Trump would jump in Putins' lap in a heart beat and abadon Kyjiw. Right now, he's just heartbroken about his imaginary best buddy.

@briankrebs

@BrianKrebs
This entry was edited (3 months ago)
in reply to Randahl Fink

mastodon - Link to source

Viðrir

To be fair: All Tesla's, and probably many other EV's on the market today have this same functionality.

It's not a "kill switch" directly, it's that the busses support OTA with full admin-rights directly from the manufacturer without user envolvement that could theoretically be used as a kill switch.

Now, if you read further on the "Lion Cage" project, that is scary shit.

in reply to Randahl Fink

mastodon - Link to source

Kevin C 🎬

Version of the story from The Guardian.

Danish authorities in rush to close security loophole in Chinese electric buses theguardian.com/world/2025/nov…

Danish authorities in rush to close security loophole in Chinese electric buses

Investigation launched after discovery that Chinese supplier had remote access to vehicles’ control systems
Miranda Bryant (The Guardian)
in reply to Randahl Fink

mastodon - Link to source

scotty86 🇺🇦🕊️

They didn’t find a kill switch. What they found was a built-in SIM card - something that's legally required in some countries and present in most modern vehicles - and the ability to perform OTA updates, which is also standard today. And yes, any modern connected vehicle can technically be disabled through a software update if the manufacturer chooses to do so.
in reply to Randahl Fink

mastodon - Link to source

Jack Poller

I just wrote a similar article about Israel banning Chinese cars from the military...

securityboulevard.com/2025/11/…

Why Israel Just Banned 700 Chinese Cars from Its Military—And What It Means for Security - Security Boulevard

In early November, the Israeli Defense Forces made a decision that sent ripples through defense and cybersecurity circles worldwide: withdraw every In early November, the Israeli Defense Forces made a decision that sent ripples through defense and cy…
Jack Poller (Security Boulevard)
in reply to Randahl Fink

mastodon - Link to source

Beelbeebub

Ok I read the translated article and it seems that what they found was the computer that controls the battery and inverter had a sim card in to to allow for firmware updates.

In theory the firmware could be updated to kill the bus but I couldn't see any mention of a function in the existing firmware kill the bus.

This "update firmware to kill" vulnerablity is present in any hardware that can be updated.

Sometimes it happens inadvertently when apple/Google brick a load of phones.

in reply to Randahl Fink

mastodon - Link to source

Yop32

And that is why being electronically independent make sense. Unfortunately not is not always possible but these tests are easy to perform by forensics. That being said, include a clause in the contract specifying remote kill switches, investigate the product you are buying and return them if you find something related.

If you are a country this should be mandatory

in reply to Randahl Fink

mastodon - Link to source

Marcel

@ScottMGS As 'alarmist' as the post sounds, there is reason to worry, of course - remote updates/command can be abused, and it actually does happen. I also recall the inverters used in many solar installations at one point could be accessed and shut down remotely, by the manufacturer. That definitely is a vulnerability. Shutting down all renewable power is an increasing security risk.
tomshardware.com/tech-industry…
@ScottMGS
in reply to Randahl Fink

mastodon - Link to source

Juan Per¢ent,🇲🇽 🍉,🇻🇪

railway-technology.com/news/th…
Polish on Polish Train kill switches. Maybe this is more of anabuse of IP issue than a security/defense issue.

The story of the great Polish train hack 

Polish rolling stock company Newag has alleged its train systems were illegally hacked, making four of its trains unsafe.
Patrick Rhys Atack (Railway Technology)
in reply to Randahl Fink

mastodon - Link to source

dragonfrog

saying they "found a kill switch" is a bit alarmist IMO.

They found that over the air firmware updates are supported. Yes the manufacturer could in principle ship broken firmware, but there's no indication they built functionality specifically to disable the buses - unlike, say, European and North American car manufacturers, which build in features specifically designed for dealerships to disable a car if the buyer misses payments, sold *as a feature* to dealerships.

in reply to Randahl Fink

mastodon - Link to source

Nicole Parsons

These kill switches are likely embedded in every chip-enabled product.

It's a national security problem. Spyware, control, & sabotage all in one.

But it's also part of a fossil fuel disinformation campaign to undermine renewable energy.

It's for accelerated planned obsolescence in household appliances, phones, computers, routers, vehicles, satellites, home heating, public lighting, electric grids, and solar & wind electricity generation.

reuters.com/sustainability/cli…

1/

in reply to Winfried Angele 🇺🇦🇪🇺

friendica (DFRN) - Link to source

Blaise

@Winfried Angele 🇺🇦🇪🇺 @JP Mens @Randahl Fink They weren't looking for the SIM card, they were looking for *any* external communications. Every electronic device has the potential to carry a transceiver, whether for good or evil. They were going to a place guaranteed to have no other RF transmissions at all so that they could know that anything they detected came from the bus.

Afterward, having found nothing else, they examined the potential attack vectors exposed by the SIM card.

@Randahl Fink @JP Mens @Winfried Angele 🇺🇦🇪🇺
in reply to Randahl Fink

mastodon - Link to source

Hotspur🏳️‍🌈🇺🇦

This clicks with my support for the right-to-repair movement here in the US and elsewhere...consumers should be able to repair their purchases, replace batteries, etc. themselves or by a third party, rather than being forced to go back to the dealer or simply discard it and buy a new product.

And related to that....the ability to turn off updates or sever connections should they see fit.

in reply to Randahl Fink

mastodon - Link to source

Rich Stein (he/him)

Two articles in English:
- cybernews.com/security/norway-…

- aa.com.tr/en/europe/oslo-tests…

Oslo tests reveal Chinese electric buses can be switched off remotely

Public transport operator Ruter says manufacturer access allows buses to be stopped from China, prompting Norway to review cybersecurity risks in public transport - Anadolu Ajansı
www.aa.com.tr
in reply to Randahl Fink

mastodon - Link to source

Number6

Doesn't the SIM card have to connect to a specific, paid-for network? So who is paying for the network?

If there's a way to get a working SIM card without paying, I'm very interested.

I suppose the next step is that the Chinese will require the SIM card to be in place to operate. Which means the bus will stop if you drive through a 0-bar location. And the drive won't be able to call for help because her phone will also have no connection.

in reply to Randahl Fink

glitchsoc - Link to source

Luigi Muffingione

per the article, there is no more of a kill switch than in any other electronic product that accepts updates over the internet. It is also not “Chinese” except that manufacturer is in China. In fact, the article even starts off with an example of a hypothetical US military ordering Apple to brick all Danish phones, an example which is different in no functional way than the bus scenario.
in reply to Christian Schwägerl

mastodon - Link to source

Jan Wildeboer 😷

It could be noticed by the manufacturer when in broad daylight (see the polish train story), which could trigger countermeasures. Blocking all possibilities for connections creates a reproducible environment. Quite standard stuff. You could also use a big enough faraday cage. @randahl
@Randahl Fink
This entry was edited (3 months ago)
⇧