It's Easy To Hack Traffic Lights 144
An anonymous reader notes coverage of research from the University of Michigan into the ease with which attackers can hack traffic lights. From the article:
As is typical in large urban areas, the traffic lights in the subject city are networked in a tree-type topology, allowing them to pass information to and receive instruction from a central management point. The network is IP-based, with all the nodes (intersections and management computers) on a single subnet. In order to save on installation costs and increase flexibility, the traffic light system uses wireless radios rather than dedicated physical networking links for its communication infrastructure—and that’s the hole the research team exploited. ... The 5.8GHz network has no password and uses no encryption; with a proper radio in hand, joining is trivial. ... The research team quickly discovered that the debug port was open on the live controllers and could directly "read and write arbitrary memory locations, kill tasks, and even reboot the device (PDF)." Debug access to the system also let the researchers look at how the controller communicates to its attached devices—the traffic lights and intersection cameras. They quickly discovered that the control system’s communication was totally non-obfuscated and easy to understand—and easy to subvert.
Old news (Score:4, Informative)
Re: (Score:2)
This only proves that Italian traffic lights are easy to hack.
Re: (Score:3)
This only proves that Italian traffic lights are easy to hack.
Who cares? No one pays attention to Italian traffic lights anyway. A red light is not even a suggestion; it's an insult.
Re: (Score:2)
This only proves that Italian traffic lights are easy to hack.
but how many young techies know how to hack something like this,
http://www.wired.com/wp-conten... [wired.com]
Re: (Score:2)
ptphpt... Zero Cool did it while the real Napster was still in diapers.
Re: Old news (Score:1)
Re: (Score:3)
Re: (Score:2)
Welcome to the Information Age! (Score:5, Insightful)
Re:Welcome to the Information Age! (Score:5, Informative)
In fact, the most upsetting passage in the entire paper is the dismissive response issued by the traffic controller vendor when the research team presented its findings. According to the paper, the vendor responsible stated that it "has followed the accepted industry standard and it is that standard which does not include security."
Don't blame the vendor, blame the standard. The vendor that includes security in his bid will have a higher price and lose to the vendor that doesn't.
Re:Welcome to the Information Age! (Score:5, Insightful)
Next, script kiddies causing couple fender-benders and every municipality having to upgrade traffic light systems at a "I want it yesterday" premium. Then higher property taxes to pay for such monumental lack of planning and foresight.
Re:Welcome to the Information Age! (Score:4, Insightful)
And who will be blamed? Why, the researchers who discovered this incredible negligence, of course! "If you hadn't shown the hackers how to do it, we never would have this problem!"
Re: (Score:2)
Still, it is surprising that nobody looked into these systems before. The technology to do so existed for many years.
Re:Welcome to the Information Age! (Score:4, Insightful)
Re: (Score:2)
"Standard of Care" would be the correct term.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I think it's a bit more likely to go undetected if you do it wirelessly.
Re: (Score:1)
And how exactly would a simple password result in a higher price?
They are using standard IP software (as evidenced by the fact that the "attackers" could join without the slightest effort), and I'm sure that software has the option of requiring a password to join the network. All they had to do is tick the box, pick a password, and hardcode the password into the traffic lights software. I know, not the best solution, but surely better than using no password at all.
So don't tell me cost was the reason. Basic
Re: (Score:2)
And how exactly would a simple password result in a higher price?
That completely misses the point, even if adding a simple password were the answer. If a standard is not sufficient, it should be changed. Don't blame the buyer or the vendor. For things like traffic lights, you want them all to be as alike as possible to save costs, be it purchasing requirements, maintenance and troubleshooting, and operation. That is why there are standards and why they are followed and why there are costs associated with deviating from the standard.
Re: (Score:2)
What makes you think there are standards? I can almost guarantee that you're vendor-locked the moment you start building the system.
Re: (Score:2)
Why do I think there are standards? For one, the article refers to them, albeit vaguely. For two, purchasing standards or requirements for commonplace items such as stoplights typically fall under some type of code/standard/requirement system, and that makes sense when you want to make sure equipment is similar throughout a large system or state. Be that for vendor lock, or simple management simplicity, you
Re: (Score:2)
It would cost more to cover therepy for their employees. When the customer calls 3 times a day and says "I don't remember if the password is 1234 like my luggage of 4321 like my ATM (or is that the other way around), could you set it to something i'll remember?" it takes a huge effort and creates a lot of stress to refrain from answering "I doubt it"
Re: (Score:2)
And how exactly would a simple password result in a higher price?
The training and SOPs for new processes, at the very minimum. Perhaps new control systems for the "secure" interface, at the cost of billions.
Re:Welcome to the Information Age! (Score:4, Insightful)
No, it's scary how much we still don't care about security. These things could definitely be fixed, we just don't care to fix them. We don't demand security in the first place, we aren't willing to pay for security, and we aren't really willing to fix security when it's broken. People will run around looking for blood for 5 minutes when it's discovered that there are huge security flaws, but nobody will fix them.
Remember all the news when it was discovered that a person could easily and untraceably hack voting machines? Do you think that was ever fixed? The way we use credit cards is insecure. Most email is unencrypted. We use Social Security Numbers as both an identifier and a form of authentication.
Most of what we do is completely insecure, and it's actually kind of amazing how rarely people take advantage of it. But it's really disturbing that we aren't remotely willing to secure things that would be relatively easy to secure, and would solve lots of problems.
Re:Welcome to the Information Age! (Score:5, Insightful)
"we aren't willing to pay for security" It's worse than that. IT also stems from the fact that people in charge. The guys making big bucks making decisions are horribly undereducated.
If you ask the guy that is in charge of the city's traffic lights to explain in detail how the system works he will NOT be able to tell you. We as a society do not put in leadership positions the best and brightest. WE instead promote those that can suck up the best and schmoose the best.
And it's now biting us in the ass because the decision makers in general are dumb as a box of rocks. And when faced with a problem they simply say "I dont know" or try to scream how we need more laws instead of actually learning what the problem is and fixing it.
people charge of traffic lights are engineers but (Score:2)
people charge of traffic lights are engineers but not likely to be EE's or tech people. They may know some what about how they work but maybe not the deep tech parts. The engineers in charge are traffic / construction engineers.
Re: (Score:2)
It's the job of the designer/implementer to put the security into the system. In that sense the vendor and manufacturer should be held liable, not the customer.
Re: (Score:2)
I once knew a traffic-light engineer who was an EE with a BS. I mentioned that I thought it was annoying not to have sensors on lights in rarely-used cross streets, since it wastes a lot of gas to have the main throughway traffic constantly stopping for no reason, not to mention wasting people's time. He said that if you put in a sensor, people will get used to the light always being green, and in the rare case it turns red they will tend not to stop and will cause more accidents. He was very strongly opp
Re: (Score:2)
You would be surprised how conditioned you can become to traffic patterns always being a certain way. I nearly caused an accident last week when I turned left in front of a car that was going straight. I am a good driver... why did I do that? The intersection was where two small neighborhood roads intersect the main road. After I screwed up, I realized that In the last 25 years, I had _never_ seen a car go straight through that particular intersection. I unconsciously assumed that he was waiting for the
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
I was stuck at a faulty red light with a sensor once. I waited for almost 5 minutes, wanting to call the police out to get me out of the stop light. Yes, I'm pedantic enough to annoy my wife like that. I knew that backing up and pulling forward would work, but it shouldn't have been necessarily.
Re: (Score:2)
Well our local municipal engineering department obviously has not read that memo.
We have various lights that are always green and switch on demand when a car approaches on the side street.
I'll note that the counter argument is that people using those roads get used to them always being green, but also get used to them switching quickly to red when a car approaches from the side street.
Re: (Score:2)
A human factors study into lights, and having the colors/flashi
Re: (Score:2)
I don't know. I my experience, a lot of poor security isn't caused by incompetence. It's caused by someone saying, "But that will cost more money..." or "That will take too much time..." or "But I want to buy from this supplier because the owner is my brother-in-law..."
I mean, they don't necessarily say those things out loud, but those are often the reasons. It's not necessarily that they're too dumb to understand that it's bad security. They just don't care. They're not thinking about the potential f
Re: (Score:2)
Not only is it that the guys making big bucks making decisions are horribly undereducated: they won't pay for security because that would cut into THEIR compensation (to have to pay competent engineering staff). So not only are they undereducated, they have a conflict of interest that promotes horrible engineering practices.
Re: (Score:1)
Re: (Score:3)
Did you not read the summary, even?
The network is IP-based, with all the nodes (intersections and management computers) on a single subnet. In order to save on installation costs and increase flexibility, the traffic light system uses wireless radios rather than dedicated physical networking links for its communication infrastructure ... The 5.8GHz network has no password and uses no encryption; with a proper radio in hand, joining is trivial. ... The research team quickly discovered that the debug port was open on the live controllers and could directly "read and write arbitrary memory locations, kill tasks, and even reboot the device.
Yes, ultimately physical security is always an issue. They can try to make the devices difficult to access, but as you've pointed out, that's always going to be a problem.
But this is a different level of "insecure". These things are controlled through open, unencrypted wireless networking. There are no passwords. It's like the difference between saying, "Your home is never completely secure, since someone can always break a window or crowbar the door open," vs. "Let's
Re: (Score:2)
The US is finally moving to chip and pin for credit cards by next fall.
Re: (Score:2)
These things could definitely be fixed, we just don't care to fix them.
And we don't even have the tools do to so. How many languages let you write:
secure char[] myPassword
much less:
secure objectType myObject
and have the language memset its memory to zero (or shred, etc.) for you when the variables go out of scope?
It's hard to do security right even if you're really trying. Anybody know if C++2014 made any gains here?
Re: (Score:2)
Most of what we do is completely insecure, and it's actually kind of amazing how rarely people take advantage of it. But it's really disturbing that we aren't remotely willing to secure things that would be relatively easy to secure, and would solve lots of problems.
It is almost like we are under the rule of a third world tin pot dictatorship. The top of the control pyramid can't hear anything because control is all that matters and the bottom can't teach the top anything because the top already hires the "best and brightest" (read: best friends and shiniest coins). Heh. Gotta love what power does does to most individuals.
Re: (Score:2)
You know, I've thought about why this is the case, and here are a couple of thoughts that I had:
1) With all we've found out about big businesses cooperating with the NSA, I wouldn't be too surprised if the NSA had, in some ways, actively discouraged security and encryption.
2) I think part of the problem is coming up with, agreeing on, and an implementing a set of standards. We don't do standards anymore. Everyone has little walled gardens. We're not going to come up with better email standards, for exa
Re: (Score:2)
I recon if you were trying to convince someone to take security of critical infrastructure, one way to do it would be to show them Die Hard 4.0 (best example I know of when it comes to hackers breaking into infrastructure) and say "this may only be a Hollywood movie but do you want to be the one who said "no" to better security when that shit happens for real?"
Re: (Score:3)
I know what the reply will be:
"The hackers would have gotten in no matter what we would have done."
Re: (Score:2)
Haha I see you also work in a business where you have this kind of discussion often!
Re: (Score:1)
Re: (Score:3)
I agree with you. I am a Controls Engineer. Until recently, my controls security was decades behind. Fortunately, Stuxnet happened, our CEO noticed the news stories and started asking questions and took an interest. A small group of controls engineers and an IT person who also did the controls network at the small plants he supports made a team, did research, made recommendations and were given money to start securing our network properly.
We need to start realizing security through obscurity is no secur
Re: (Score:2)
The thing is, the "hole" is not about being wireless, that's just stupid fear mongering. The hole is in not having security in the first place. You can indeed have highly secure wireless networking. The trick is in getting the customers to demand security instead of thinking of it as an inconvenient hassle.
Re: (Score:3)
Single stoplight can easily add +10 minutes of traffic to my commute. I imagine once Metasploit module for this comes out, some script kiddie would be able to turn everyone's commute to living hell for a considerable period of time.
Re: (Score:2)
I started to rebut your comment... but then actually came to agree. The cost of fixing this problem is huge; any traffic light pedestal could be an entry point from a "trusted" point on the system, and I have seen several in Los Angeles unlocked. Effectively the problem is reduced to if you have physical access to the machine there isn't much you can do for security.
Re: (Score:2)
There is one option; the PLCs fail to a "safe" mode and ignore the network if the validation PLC (not networked) detects an anomaly. Stoplight timing is out the window, but green lights in all directions would not be possible.
Re: (Score:2)
Everything from the elevator control panel to SCADA have no place being remotely accessible! If you do need remote functionality, you better secure it!
Re: (Score:3)
A tree limb falls on a vehicle and kills the driver. When asked about it, the county highway department issued a statement saying that tree had never shown any intent to fall before and hence there was no reason to suspect that it would fall this time. The public can feel safe knowing that trees do not have any particular interest in killing you. If they wanted to do, they could have fallen on you years ago when you went to the grocery store.
Re: (Score:3)
"Since a clean room will eventually devolve into a dirty room, there's no point in cleaning it."
Re: (Score:2)
Nothing will be done until the vulnerability is exploited, and even then it will be measured against a cost/benefit actuarial table.
I would certainly hope so. If government isn't doing cost-benefit analysis of spending decisions, it's being grossly irresponsible.
Re: (Score:2)
Yes, for a moment there I utterly ignored the impeccable reputation of government.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
"Not really that scary unless you are paranoid.
The effort to kill someone is far less than the effort needed to hack the traffic lights."
Indeed. I'd prefer it if they'd sell an 'always green' gadget on aliexpress for 25 bucks.
What are they waiting for? (Score:2)
Deaths? multiple injured people? Why isn't that secured in the first place? With all the news about stuff getting *hacked*, why are they still doing this?
Re:What are they waiting for? (Score:4, Insightful)
Deaths? multiple injured people? Why isn't that secured in the first place? With all the news about stuff getting *hacked*, why are they still doing this?
They are waiting for the first part, because unless there is a big uproar about it (which there won't be until it gets abused enough to cause deaths) it costs too much money to fix.
How this is a surprise to anyone by now is a surprise to me, this has been standard operating procedures with pretty much everyone since computers have come out. That is, security is non existent or an afterthought. Paying money to make sure everything is secure for any sort of attacks/compromise/whatever takes away from the bottom line, so shareholders don't like that stuff. And management is kissing the shareholders ass, so it's not as important.
Now for government work, it's a bidding process and well, you aren't going to make any money on the job by having to hire some sort of computer type to make sure the system is secure. And since the contract probably didn't state it needed to be done, well, this is what we have.
So wait until it gets abused bad enough to kill people, nothing will get done.
Re: (Score:3, Interesting)
I remember this crossroads in the 1990s. Would firms in general focus on security, even though the worst threats at that time were college students looking to rm -rf / a box or two for kicks.
It came out worse than I could imagine. I heard the "security has no ROI" mantra many a time (although the past couple places I worked at, they actually take it seriously.) When working as a consultant, I asked companies what they had for something if they were hacked. The response was, "We will call Geek Squad or I
Re: (Score:2)
How this is a surprise to anyone by now is a surprise to me, this has been standard operating procedures with pretty much everyone since computers have come out.
Computers?
http://www.motherjones.com/pol... [motherjones.com]
Re: (Score:2)
You can't be serious. Fixing something after it's been done wrong is even more expensive than doing it right the first time. Take the current example of traffic signals. Physical access is a huge problem. How do you address that? Work out a new design and retrofit hardware and software. Not free. Not anywhere is that even approaching cheap.
Re: (Score:2)
They don't care. There was a very dangerous intersection that people wanted stop signs at for years and asked several times and were denied. Until there was a major nasty accident that happened and the news covered it and got word that the city ignored requests for stop signs, the light of public anger was finally pointed at them and they suddenly had the signs installed.
Your city does not care one bit if you die or even if 100 people die, they only care if they look good to the public. This is the p
Re: (Score:1)
Re: (Score:2)
Because the CEO already got theirs and they can just step down and keep their share of the profits. Leave it for the corporation to handle without them.
Re: (Score:2)
This right here. The problem with any "unsafe" scenario is that these lights are usually logic controlled by PLCs or some such. I had a professor in college that used to work for one of the state roadway departments and he did work on traffic light controllers for a while. Most of them have to physically prevent anything like that from being possible just like how a civil engineer is supposed to prove their bridge is safe within x parameters. From what I understand this isn't even a concern for all traf
Re: (Score:2)
Interesting points. The amber light timings though I would think should have a hard floor/ceiling inside the PLC. Not sure how much adjustment you could do because when the PLC write happens it has certain limits for the logic to even recognize what is told to it via input. The cameras are a very intriguing point and probably the most dangerous. I vaguely recall a story on slashdot a while back about the camera networks though having terrible security, but don't remember the details.
White hat application to cycling (Score:2)
Re: (Score:1, Offtopic)
Re: (Score:2)
Balanced for a different velocity (Score:2)
Your city's stoplights are balanced for a different speed.
Or they are balanced for the same speed in a different direction. On a two-way street whose signals are timed for 30 mph eastbound at a particular part of the day, westbound traffic is going to have a problem.
Or perhaps they are balanced for a different speed, the speed of the type of vehicle driven by the majority. Most signals are timed for people who drive cars, which means cyclists tend to hit more reds.
What would happen? (Score:2)
My home town [waldport.org] only has one traffic light (and didn't get a left turn lane until after I moved away). I wonder what sort of damage hackers could do with that... Chaos where US 101 meets highway 34....
Re: (Score:2)
Your home town probably doesn't have a network-connected traffic light, either, since it only has one light to work with and there's not much point. Unless there's some compelling reason to do otherwise, these systems are only replaced when they fail. If you live in a major metro area then sure, there's reasons to upgrade before failure, involving traffic management.
Re: (Score:1)
Well, the security through scarcity will not slow them down. The meanies will just steal your stop signs and pee in Eckman creek, which are totally insecure and unguarded. This is a good thing. In most towns police guard the traffic lights and issue tax bills at random under the guise of security.
Hell, in some places, like where Eric Garner lived, packs of police officers will hunt you like wolves and beat you to death. Yup, if I were the ex janitor at the D.O.T. who found out how to hack a street light, I
Re: (Score:2)
What's the point of this? (Score:1)
What is the point of this "research"? To prove that there are still many systems in our world that can be hacked easily? No shit.
The thing is that sometimes there is no incentive to hack things because it is a lot of work for very little gain, until some other asshat on the interwebs shows people how it can be done. Then the effort to hack it becomes less (as there is not a manual), and thus the freqnency of it occurring increases. I may exaggerate a little when call this a form of sponsored vandalism... bu
They Might be Giants (Score:2)
Re: (Score:2)
And so on in that fashion for several more verses...
Cool! (Score:2)
Security... (Score:1)
I wonder if this means... (Score:2)
Re: (Score:2)
Flashing reds is probably a failsafe mode. You could give yourself a green, but it won't fix them for anyone else.
A lot of easy things are illegal (Score:5, Insightful)
Its probably easy to build a device that gives you green lights as though you were an emergency vehicle. This is definitely illegal.
While I think its irresponsible to design computer systems without basic and reasonable security measures, technology is not the final answer to antisocial behavior. Hacking somebody else's systems is illegal and wrong. Finding (sometimes ) esoteric ways to do it and making it easy for bad guys is just plain foolish.
My friend Neil and I have a law: You know you have enough security when you can't do your job anymore. Requiring the average stop light electrician to now be a computer networking security expert requiring tons of tech support would certainly drive up taxes.
Antisocial behavior is why we have laws and there is a reason we should obey them.
Re: (Score:2)
Hey! I speed occasionally and I own a firearm or two *BUT* I don't shoplift or shoot everyone that pisses me off. So does that mean I'm only halfway antisocial?
Bringing security flaws that could get us killed to light in public view is NOT antisocial behavior. Hacking said systems and actually manipulating them to cause mayhem *IS* antisocial behavior.
Software security is VERY important. Anything can be hacked but irresponsibly making it blatantly easy for people to control these systems and cause loss
Re: (Score:2)
My friend Neil and I have a law: You know you have enough security when you can't do your job anymore.
As a "security guru" and a Heinlein fan, I love to twist some words that Mr. Heinlein wrote:
My job is to help you do, in a safer manner, what you were going to do anyway, not to prevent you from doing it in the first place.
This was concerning an exchange of a Mr. Harriman to his lawyer with me speaking from the lawyer's point of view.
Re: (Score:2)
Its probably easy to build
The cost of building a device doesn't necessarily include R&D costs. It's possible someone else has already done the work for you.
Re: (Score:2)
We can do this. It's not that hard. Some work is not right.
Apparently engineers and scientists need to be reminded that everyone needs a moral compass. Consider the golden rule. Would your actions make our world a better place for our children.
Re: (Score:2)
I believe the poster was talking about the devices which imitate the strobe on emergency vehicles that triggers the green. A much simpler protocol and fairly easy to detect and engineer with low-cost equipment. Someone from around here (Tennessee) was charged with making such a device a few years ago.
So What? (Score:1)
Re: (Score:2)
It's a lot easier to get caught when breaking into the padlock than when driving by with an RF device.
Don't emergency vehicles use this? (Score:2)
Re: (Score:3)
Re: (Score:3)
It's called signal preemption. Opticom [gtt.com] is IR-based, and in fairly common use. There are several other systems available for signal preemption, including:
There may be others, but these are the ones I'm familiar with.
So when are we going to hear (Score:1)
Re: (Score:2)
This is really not much different from simply (for example) removing traffic signs.
I recall that some kids removed a stop sign as a prank, (Florida, mid 90's?) There was a bad accident and the result was a man slaughter charges and something like 20 year sentences.
Crosswalk hacks (Score:3)
Reminds me of the time when that list of crosswalk-button hacks was published - it created quite a stir [bbspot.com].
As Always (Score:2)
As always, when something gets hacked, we find out it was for the stupidest reasons. You can just log into a Wi-Fi network and dump the entire memory of the traffic light through a debug port that was left open? I mean sure, everything can be hacked, but this is just handing the entire system to the hackers. Just like nearly every other "hack" that goes on in the real world.
This is just like when a web forum gets "hacked" because somebody with an axe to grind guessed the admin's password was actually "PaSsW