I hacked a train toilet

&gt; Of course, there is a reason for the separation of the closing and locking functions, but not the opening and unlocking functions: it avoids a Denial of Service attack where someone can just press “close” and then jump out before the door closes. If the interior “close” button automatically locked the door, this would result in the toilet becoming permanently inaccessible.<p>This was done in my elementary school (~7-15yo) &quot;back in my times&quot;, with analog doors with hand-turned locks. Those door locks usually had a &#x27;screw-like&#x27; interface on the outside (similar to this: <a href="https:&#x2F;&#x2F;m.media-amazon.com&#x2F;images&#x2F;I&#x2F;51KhCg9ZDFL.jpg" rel="nofollow">https:&#x2F;&#x2F;m.media-amazon.com&#x2F;images&#x2F;I&#x2F;51KhCg9ZDFL.jpg</a> ), so one of the kids would &quot;have to pee&quot; 5 minutes before the end of the lesson, go to the toilets and lock all the doors from outside with a screwdriver&#x2F;swiss army knife so all of the toilet stalls would seem occupied.

I have actually been in a situation where the motorized door started opening when I was doing my thing. On a train in Sweden.<p>I had the handle in reach so I tried to push it back, but eventually I had to prioritize getting my trousers on.<p>Also in this kind of car the toilet is wider than a usual double seat so there were actually seats outside facing the toilet.<p>Rather embarrasing situation but we are all born naked so it was mostly a fun story.<p>I have no idea what happened, i was not curious enough to go back and investigate, I just got back into my seat and tried to look invisible.

We had these payphones years ago, some of them still exist but time is running out.<p>Probably the first attempt at a digital payphone in Australia.<p>What we found is that if you held down the language button (IIRC a flag with an L on it), before and as you are lifting the handset, the payphone will display &quot;Out of Order&quot; and you could replace the handset and the message would persist until the handset is lifted again.<p>Of course this was high school, and so we took a purely scientific approach to ruining a lot of peoples lives.<p>If you had a bank of 3 payphones, and you took 2 out of commission in this manner, no one would investigate the out of order handsets long enough to reverse the condition. So you would get a very long line behind the working handset.<p>However if you took all 3 offline, angry telephony consumers would test the handsets and restore them to working order.<p>It was a repeatable study on almost every bank of payphones in our town.

&gt; Of course, there is a reason for the separation of the closing and locking functions, but not the opening and unlocking functions: it avoids a Denial of Service attack where someone can just press “close” and then jump out before the door closes. If the interior “close” button automatically locked the door, this would result in the toilet becoming permanently inaccessible.<p>There was a class of rolling stock used on UK lines (I encountered them over near Bradford IIRC) that had precisely that misdesign for the inside close button.<p>I had to be really careful using those because my natural reflex is to hit &#x27;close&#x27; on my way out for tidiness&#x27; sake, and I think I actually -did- the first time I used one of those and only realised what I&#x27;d done to my fellow commuters immediately after I heard the click.

&gt; Of course, there is a reason for the separation of the closing and locking functions, but not the opening and unlocking functions<p>There’s also a psychological aspect to performing the separate action of locking.<p>There are trains in Denmark that only have the ’close’ button. Quite jarring the first time.

People definitely got confused by the old design, but I don&#x27;t understand why they didn&#x27;t go with the obvious fix: just add an unlock button.<p>Or use a mechanical lock that people can obviously trust.<p>The worst designed toilet lock I ever saw was some kind of weird button you push to lock it. It was so untrustworthy (in the sense that you couldn&#x27;t tell if it had really locked) that the owners had put up a sign explaining exactly what to do to lock the door and that yes it really was locked.

Was there anything wrong, with the good old mechanical locks in train toilets?<p>I have seen so many (elderly) people struggle to properly use the fancy electric ones (and lots of embarrassment, with doors that were indeed not locked) and apparently some people have fun, intentionally disabling them. You know, some people sometimes just have a urgent buisness and are in need of a working toilet on a train.

These mechanical hacks are always fun to discover. Although, that poor soul waiting for the toilet, just to find that it was locked with nobody inside - that could be you.<p>These things are harder to test. It’s not just software and state machines.<p>And then there are the truly dangerous mechanical “hacks”. Eg the radiology machine that incorrectly dosed radiation. Therac-25.

I don’t understand why we have to put microcontrollers in everything. I think a toilet on a train is basically the same use case as a toilet on a plane and all the planes I’ve been on, all had an old fashioned sliding lock mechanism that works totally ok. I wonder if the train bathroom the poster describes has a timer to avoid people from occupying the bathroom for the complete duration of the journey, and that’s why a mechanical lock won’t work?

UK train toilets are a classic in the bad design book. You have people who haven&#x27;t locked the door being exposed to the carriage, you have people unable to close the door and people unable to open the door. And that&#x27;s if you manage to get to the toilet and it hasn&#x27;t been ruined by a previous occupant.

&quot;Amusingly this is not the first DoS vulnerability I&#x27;ve found on a train — but that will have to wait for another article.&quot;<p>Don&#x27;t say more.

&gt; Modern trains in the UK have disabled toilets with power-operated doors.<p>Did anyone else find this sentence hard to grok? I was trying to work out why the UK had stopped modern train power-operated door based toilets from working for a moment.

A traditional sliding deadbolt[1], which cannot be locked while the door is open since the tongue will prevent the door from closing completely, takes very little force to operate (for those arguing that this overly complex design is &quot;because accessibility&quot;), and can be combined with a switch to prevent the power operated mechanism from attempting to move the door if the lock isn&#x27;t all the way open (i.e. the switch actuates before the tongue protrudes.)<p>But in this case they clearly attempted to complicate things as much as possible, so no surprise that additional edge-case bugs and points of failure were also introduced.<p>[1] <a href="https:&#x2F;&#x2F;i.redd.it&#x2F;3mclitgdus6b1.jpg" rel="nofollow">https:&#x2F;&#x2F;i.redd.it&#x2F;3mclitgdus6b1.jpg</a>

The fact that not all trains say please lock the door and the bad UX mean I&#x27;ve seen plenty of people open the door and when they shouldn&#x27;t have.

Always lovely to see a reminder that electromechanical (non-software) systems can also be hacked. This is the sort of stuff &quot;place hackers&quot; use to get into buildings.

&gt;<i>The problem with this design is that most people don&#x27;t understand state machines, and this design confused a lot of people who were unable to lock the door correctly, or believed they&#x27;d locked the door when they hadn&#x27;t.</i><p>no, the problem was that it&#x27;s a stupid state machine that even conducting experiments with you can&#x27;t be sure how it works unless you&#x27;re Shrodinger&#x27;s cat and and you have Shrodinger outside the door and you can communicate

This isn&#x27;t a hack

bad design... almost as bad as most software.

Guy moves like some archenemy from a game :D.

Denial of Shitter attacks are always unethical.<p>For real though, this is a cool idea and hack, but only a real bastard would put the toilet out of action deliberately. Of course that sort of person does happen to frequent British trains and this is hence valuable research.During the Polish train hacking debacle it was suggested that saboteurs be charged with harming vital national infrastructure, I hope that toiletblockers would be similarly indicted.

I would probably not use the word hacked here, more ruined – Yes, if we use things out of their intended use, block doors, forces switches even though locked, hold switches in intermediate states, it will ruin things.<p>Maybe this is why toilets never work on trains when I need them. What a shame...

ha! this reminded me of 1969 when i rode from my english boarding school to my parent&#x27;s flat in paris, france. my dad was working from the UK embassy, helping to organise the RAF stuff at the paris airshow. i was about 15.<p>i got down to dover and across the channel ok, but at calais the trains were all screwed up. i had a seat reserved but it was filled with an elderly frenchwoman in full black regalia who womanfully resisted all efforts of me and the train conductor to pry her out of it.<p>i retreated to the loo (train was packed) and spent the next hour or so pretending dire gastric problems.