How Wi-Fi Vulnerabilities Could Bring Our Trains to a Standstill

Throughout the world, wireless technologies are intrinsically connected with a growing number of industries, including critical infrastructure. Data centres, water treatment facilities, manufacturing, telecommunications networks and energy are just a handful of critical services, networks and infrastructure that are at risk of cyber threats.

Yet only a few wireless protocols can defend against certain types of attacks. There are a multitude of attacks, such as frequency jamming, that can be easy to execute methods of interfering with wireless communications, getting past protocols limited defences.

One such wireless protocol, RadioRippleControl, is used to send signals to manage streetlights, control power grid operations, deliver weather forecasts, synchronise time, and perform other functions. In Australia, electricity suppliers in New South Wales and Queensland are using radio ripple control during off-peak times, in order to remotely control devices such as hot water systems and street lighting.

In a recent report, researchers were able to use a simple, inexpensive method to directly influence the distribution of energy to a portion of the power grid. Due to the lack of encryption, the Ripple Control Protocol has no confidentiality or authentication, meaning any attacker has visibility into the contents of the transmission and can also re-transmit captured messages to the receiver.

Although they started by building their own antenna out of part of a wireless phone charger, they eventually learned that the capability is easily reproduced using a Flipper Zero, a small commercial device widely available.

After the researchers were able to influence the local power distribution, they surveyed the grid to determine how much power from impacted devices is fed into the grid, and whether or not they could generate enough instability to cause a cascading disruption. Although it’s still only a theory, and highly speculative, the researchers claim that an attacker could cause some cascading power grid interference with these simple, low-complexity wireless transmissions.

A recent example of such wireless insecurity happened in Poland in August 2023, where attackers transmitted a series of three consecutive tones at 150.100 megahertz, and the train control system interpreted it as the “radio-stop,” then halted. The attackers were able to impact about 20 trains across Poland.

In spite of these long-standing issues with wireless protocols, their place in today’s tech stack is solidified. There are many use cases where wired connectivity is not an option, or it’s not feasible to add overhead for security. In some cases, the improvements needed to resolve these types of issues are years or decades away from being implemented. Some require massive financial investment, planning, and permits, and could be large capital projects involving many aspects that prevent them from moving forward with fixes.

When Wi-Fi hit the marketplace, it was widely vulnerable to many attacks. Despite numerous efforts to improve the security of wireless networks, many are still vulnerable.

This reality is one of several that security researchers were able to quantify in the latest 2H 2024 Security Research Report, which studied over 50,000 live Wi-Fi networks and determined that 94 percent of them were susceptible to Deauthentication attacks.

This just outlines wireless networks, and doesn’t account for the growing number of devices with communication capabilities. Any device installed with Bluetooth or cellular connections, enabling configuration, remote management, predictive maintenance or any other benefits, may be susceptible. This challenge isn’t going away and will only scale into the future.

Daisy-chaining – a method where a hacker exploits one compromised system to gain access to another connected system – shows that one weakness can together enable attackers to reach places they otherwise couldn’t. For example, the Russian GRU was caught red-handed in the Netherlands attempting to break into Wi-Fi, and in another separate incident, was also caught daisy-chaining attacks across multiple Wi-Fi systems to get closer to its real target.

The complexity of the transport protocols, combined with the advanced capabilities of attackers, highlights the need for holistic security that can traverse multiple mediums where threat actors operate.

Without visibility extending into the wireless sphere as well as the Ethernet, it’s more challenging to defend. Attempting to piece together a forensic story across disparate tools can make otherwise mundane tasks overly complex.

Having deep visibility into the assets on these networks, as well as the hygiene of the network infrastructure, is the first step to identifying and managing risks associated with wireless and communications technologies.

Prioritising which vulnerabilities to fix first and hardening the target is usually the next step, and then hunting and mitigating any threats that are present follows. In all of these steps, having the right tool for the job is crucial for making the effort cost-effective, manageable, and scalable.

Matt Wilson is Director of Regional Sales in Australia and New Zealand for Nozomi Networks.

Last Updated on March 24, 2025 by Matt Wilson