NR train stations wifi display terrorism message after cyber-security incident

[whole diary]

[ChrisB]

From The Metro, via MSN

Several major UK^▸ (United Kingdom) train stations appear to be showing terrorism-related messages after being hacked in a major ‘cyber-security’ incident.

London Euston, Manchester Piccadilly and 11 other stations managed by Network Rail appear to have had their Wi-Fi hacked by a third party.

Those attempting to log into Network Rail’s service have been met with a webpage titled ‘we love you, Europe’, which contains Islamophobic messages and details of several terrorist attacks which have taken place in the UK, including the 2017 Manchester Bombing.

The Wi-Fi is still down this morning and an investigation is ongoing.

It is understood that other organisations have been impacted too.

Other stations hit by the hack are London Victoria, Birmingham New Street, Glasgow Central, Leeds City, Liverpool Lime Street, Bristol Temple Meads, Edinburgh Waverley, Reading and Guildford.

List of affected stations
The cyber incident is affecting 19 stations.

Network Rail Wi-Fi is available at the following stations.

Birmingham New Street
Bristol Temple Meads
Edinburgh Waverley
Glasgow Central
Guildford
Leeds
Liverpool Lime Street
London Bridge
London Cannon Street
London Charing Cross
London Clapham Junction
London Euston
London King’s Cross
London Liverpool Street
London Paddington
London Victoria
London Waterloo
Manchester Piccadilly
Reading
St Pancras station is unaffected, Network Rail said.

It was first understood that 20 stations were affected, but Network Rail has since confirmed that 19 Network Rail-managed stations are affected.

The third-party provider of Wi-Fi at the stations is thought to be Telent.

Telent provides ICT and communications services across transport, emergency services, higher education, network providers and the public sector, its website says.

From MyLondon, via MSN

includes -
Passengers trying to log into the Wi-Fi service at London Euston and Victoria Stations, as well as Manchester Piccadilly and other major UK travel hubs, were met with a webpage about terror incidents in the UK.

The page, seen by MyLondon, writes 'We love you, Europe' and appears to have an Islamophobic message, with details about Islamic extremist terror attacks in the UK.

Network Rail confirmed the Wi-Fi services were suspended as enquiries take place.

I'm surprised that Network rail use the same wifi network across all the stations.

[Mark A]

It'll be one system and remotely managed (by Telent) perhaps.

Mark

[ChrisB]

As these stations aren't close enough that one user might wander direct from one to another directly, there's little point in being one network - may as well each have their own so hackers only get into one at a time

[Ollie]

There has been an update to this;

From Sky News - Man who works for WiFi company arrested after train passengers receive Islamophobic messages https://news.sky.com/story/train-passengers-receive-islamophobic-messages-after-cyber-attack-13222280

[Chris from Nailsea]

Thanks for that update, Ollie. 

[grahame]

As these stations aren't close enough that one user might wander direct from one to another directly, there's little point in being one network - may as well each have their own so hackers only get into one at a time

There is sense in code and infrastructure singularity from a support viewpoint - change and maintain in one place with automated propagation.   Efficiency, consistency for the user, etc.

[Electric train]

The public WiFi at Network Rail managed stations is a totally separate system to Network Rail internal IT systems, even to the extent it is "air gapped" and not just reliant on a software firewall.