cross-posted from: https://scribe.disroot.org/post/5486763
In a revelation that has sent shockwaves through Europe’s public transportation sector, Norwegian authorities have uncovered hidden remote-access capabilities in electric buses manufactured by Chinese company Yutong. These features, including concealed SIM cards and software backdoors, allow for potential remote shutdowns from abroad, prompting an urgent review of cybersecurity protocols in critical infrastructure.
The discovery came during routine security tests conducted by Ruter, Oslo’s public transport operator, on a fleet of newly acquired Yutong buses. According to reports, the buses contain embedded systems that enable remote diagnostics, software updates, and even control over battery and power systems—capabilities that could theoretically halt operations from thousands of miles away in China.
This incident highlights growing concerns over supply chain vulnerabilities in the era of connected vehicles, where electric buses represent a key component of sustainable urban mobility. Industry experts warn that such hidden features could be exploited not just by manufacturers but by malicious actors, raising alarms about national security in an increasingly digitized transport landscape.
…
Details emerged from a security audit initiated after Ruter tested the buses’ connectivity features. As reported by Scandasia, hidden remote-access SIM cards were found, allowing unauthorized external control. “We have identified risks related to remote access that could potentially affect the operation of the buses,” a Ruter spokesperson stated in the article.
…
Broader Implications for Transport Security
Norway’s case is not isolated. Similar concerns have surfaced in other sectors, but this marks a significant escalation in public transport. According to Cybernews, the remote control extends to the buses’ diagnostics module and battery systems, potentially allowing for mass disruptions.
The Norwegian government, as detailed in a report by Anadolu Ajansı, is now reviewing cybersecurity risks across all public transport assets. “Manufacturer access allows buses to be stopped from China,” Ruter confirmed, prompting immediate action to mitigate threats.
Industry insiders point to this as a wake-up call for Europe. A recent article in Focus on Travel News noted that Norway is investigating these buses after finding they can be remotely accessed, raising broader concerns about foreign-made critical infrastructure.
…
You somehow have managed to ignore the current review much of the EU is undergoing with regard to the software infra that is used and who maintains it. The West is going through some shit right now over your exact point - so why the whataboutism?
Well. Buses and trucks are usually not as tightly integrated as, say, the operating system of a computer, or the inverter of a photo voltaic system. So to disable this telemetry and over the air update capability, you can simply unplug the connectivity ECU (or its fuse). It will likely trigger a warning indication on the driver instrument cluster, but that’s it.
An easy fix like this is not really there for windows or other Microsoft infrastructure.
And to your point that things are being done to reduce the dependency on Microsoft… I have yet to see any serious efforts in this direction. All I have read about are relatively small instances.
I’d say the whole of French police is a tad above a neglect able instance.
You are absolutely right. But they are working on it for I think 20 years now. Which is really great, but not a new development based on recent political discussions.