Russian programmer claims he hacked Wi-Fi on popular high-speed train in 20 minutes, gaining access to passenger data

On the technology-oriented social site Habr, an individual writing under the username keklick1337 has claimed that he was able to hack into the public Wi-Fi network provided on a popular high-speed Russian rail route, gaining access to a database of passenger data. The user boarded a Sapsan train from St. Petersburg to Moscow and subsequently decided to try hacking its wireless network out of boredom, he wrote.

The programmer noticed that in order to access the Wi-Fi network on a Sapsan train, passengers must input their car number, their seat number, and the last four digits of the identification document they used to reserve their seats. Keklick1337 concluded that if the Sapsan system has the ability to verify the authenticity of that information, it must store each passenger’s ticket order data locally.

Using the network scanner Nmap and publicly available exploits, keklick1337 said he was able to hack into that data within 20 minutes, and that was “only because their server was lagging.” The programmer found that the Sapsan train’s Wi-Fi network included a large number of open portals, all of which were connected to a single server whose RAM, or working memory, was severely overburdened. On the train’s disk space, the programmer claimed, there was a database of information received from current and former passengers stored as a series of text files.

“This is all set up terribly, identical passwords everywhere […] Russian Railways, fix all this. I’ll check it again in a couple of months,” keklick1337 wrote. The programmer also said he had previously found another vulnerability in a Russian Railways system, and the company responded by quietly correcting the error without rewarding him for finding it.

Russian Railways spokespeople responded to the news of the alleged hacking by announcing an internal investigation. Company representatives also pushed back against the hacker’s claims that he had been able to obtain identifying passenger data. What was really hacked, Russian Railways claimed, was a special network that provides a range of news and entertainment options to passengers. That network, the representatives explained, is not connected to the internal Russian Railways network even though accessing it requires passengers to submit the identifying information keklick1337 cited.