Taiwan High Speed Rail Emergency Stop Caused by SDR Attack
A 23-year-old student in Taiwan caused a significant disruption to the Taiwan High Speed Rail Corp (THSRC) operations last month, leading to the emergency halt of four high-speed trains. On April 5, THSRC’s control center received an emergency signal from what appeared to be a maintenance radio device, resulting in a 20-minute stoppage across the affected trains, according to Cyber News - Erez Dasa.
The student, an amateur radio enthusiast, reportedly used a Software-Defined Radio (SDR) device to analyze THSRC’s radio signals. Cyber News - Erez Dasa indicates he then downloaded and analyzed the collected data, subsequently creating a similar radio transmission system using his own equipment. This setup allowed him to transmit an emergency signal to the control center, directly triggering the train stoppages.
The student has since been arrested and released on a NT$100,000 (Taiwanese dollar) bail. This incident highlights a critical vulnerability in critical infrastructure: the potential for low-cost, accessible technology like SDR to disrupt essential services. It underscores the need for robust, encrypted, and authenticated communication protocols, even in seemingly isolated operational technology (OT) environments.
What This Means For You
- If your organization relies on unencrypted or easily replicable radio communication for critical operational controls, this incident is a stark warning. You need to immediately review your wireless communication protocols for operational technology (OT) and critical infrastructure. Assess your exposure to SDR-based signal spoofing and ensure robust authentication and encryption are in place for all control signals.
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
THSRC SDR Attack - Emergency Signal Transmission
Written by SCW Threat Desk