A primer on TETRA mission-critical radio network authentication flaws
Source Reddit NetSec
Discussion
In April 2026, a security incident occurred on Taiwan High Speed Rail's (THSR) TETRA mission-critical radio network when a student maliciously transmitted an unauthorized emergency alarm message. This caused several trains to halt temporarily. The attack exploited fundamental authentication flaws in the TETRA network, including lack of message-level authenticity and integrity guarantees and absence of re-authentication during roaming. The attacker cloned a legitimate radio identity using parameters obtained via software-defined radio captures and insider assistance. The incident demonstrated the feasibility of disrupting critical infrastructure operations through relatively simple radio network attacks.
r/netsec (opens in a new tab)u/2ROT130 points0 comments
tl:dr;
- Contrary to popular belief among vendors, system integrators, and asset owners: network authentication in TETRA mission-critical radio networks does not provide authenticity & integrity guarantees at the individual message level.
- To make matters worse: base stations don't require a re-authentication whenever a radio is roaming from one cell tower to the next.
- This allows for traffic injection attacks: both voice and data. The latter is particularly worrying for SCADA WAN scenarios or where voice & alarming functionality can disrupt operations at such as at airports, harbors, railway operators, and civil defense siren systems.
- The 2026 attack on Taiwan High Speed Rail's TETRA network, leading to the emergency stop of several trains, shows a mild example of possible impact: https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1