Student hacked Taiwan high‑speed rail to trigger emergency brakes
Patch your TETRA parameter rotation policy to enforce quarterly changes and audit verification layers.
Patch your TETRA systems to rotate parameters quarterly and audit verification layers.
Summary
A 23‑year‑old university student in Taiwan used software‑defined radio (SDR) equipment to intercept and decode TETRA parameters for the Taiwan high‑speed rail (THSR) network, enabling him to transmit a high‑priority “General Alarm” signal that triggered emergency brakes on four trains for 48 minutes on April 5.
The TETRA system had been in use for 19 years with static parameters that were never rotated, allowing the hacker to bypass seven verification layers and impersonate legitimate beacons. Police seized 11 handheld radios, an SDR, and a laptop from the suspect’s residence, and THSR logs identified the unauthorized beacon as the source of the emergency signal.
The incident has sparked criticism of negligence and calls for improved parameter rotation policies, as the unassigned radio beacon that triggered the brakes was not missing but likely cloned, prompting a review of security controls.
Key changes
- 23‑year‑old student used SDR to intercept and decode TETRA parameters for Taiwan high‑speed rail (THSR).
- The attack halted four THSR trains for 48 minutes on April 5 by transmitting a high‑priority “General Alarm” signal.
- THSR’s TETRA system had been in use for 19 years with static parameters that were never rotated.
- Seven verification layers were bypassed, allowing the student to impersonate legitimate beacons.
- An unassigned radio beacon triggered emergency brakes, prompting THSR to investigate logs.
- Police seized 11 handheld radios, an SDR, and a laptop from the suspect’s residence.
- THSR logs identified the unauthorized beacon and confirmed the signal came from an unassigned device.
- The incident prompted criticism of negligence and calls for improved parameter rotation policies.