Forgot your password?
typodupeerror
Transportation Security

It's Easy To Hack Traffic Lights 144

Posted by Soulskill
from the looking-forward-to-the-mobile-app dept.
An anonymous reader notes coverage of research from the University of Michigan into the ease with which attackers can hack traffic lights. From the article: As is typical in large urban areas, the traffic lights in the subject city are networked in a tree-type topology, allowing them to pass information to and receive instruction from a central management point. The network is IP-based, with all the nodes (intersections and management computers) on a single subnet. In order to save on installation costs and increase flexibility, the traffic light system uses wireless radios rather than dedicated physical networking links for its communication infrastructure—and that’s the hole the research team exploited. ... The 5.8GHz network has no password and uses no encryption; with a proper radio in hand, joining is trivial. ... The research team quickly discovered that the debug port was open on the live controllers and could directly "read and write arbitrary memory locations, kill tasks, and even reboot the device (PDF)." Debug access to the system also let the researchers look at how the controller communicates to its attached devices—the traffic lights and intersection cameras. They quickly discovered that the control system’s communication was totally non-obfuscated and easy to understand—and easy to subvert.
This discussion has been archived. No new comments can be posted.

It's Easy To Hack Traffic Lights

Comments Filter:
  • Old news (Score:4, Informative)

    by neglogic (877820) on Friday August 22, 2014 @08:52AM (#47728255)
    This was central to the plot of the Italian Job. The real Napster took care of it.
    • This only proves that Italian traffic lights are easy to hack.

    • ptphpt... Zero Cool did it while the real Napster was still in diapers.

    • The 'Italian Job' was the first thing I thought of when I read that as well. It's got to be done, sorry, but "You're only ment to blow the bloody doors off" :-)
      • by k6mfw (1182893)
        same with me, hacking traffic lights and reminded me of Benny Hill as the professor inserting hacked tape into the control system deck. Michael Caine said to the other members of his team though professor had "interesting reading material" to not make fun of him because he is very important for the job. I saw the movie last month (previously saw it in 1970s), featured the Mini Coopers that were screamers (back in the days almost all small cars were slow), Italian constantly honking horns (most in those litt
      • by rHBa (976986)
        Sorry, mis-moderated...
  • by sinij (911942) on Friday August 22, 2014 @08:55AM (#47728285) Journal
    It is scary how many industries (e.g. autos, "smart" electronics, control systems) are decades behind state of the art security. We will have a lot of growing pains to get out "only computer guys need to do this".
    • by Mr D from 63 (3395377) on Friday August 22, 2014 @09:07AM (#47728393)
      From TFA,

      In fact, the most upsetting passage in the entire paper is the dismissive response issued by the traffic controller vendor when the research team presented its findings. According to the paper, the vendor responsible stated that it "has followed the accepted industry standard and it is that standard which does not include security."

      Don't blame the vendor, blame the standard. The vendor that includes security in his bid will have a higher price and lose to the vendor that doesn't.

      • by sinij (911942) on Friday August 22, 2014 @09:20AM (#47728475) Journal
        "Acceptable industry standard" is not a standard, it is status quo. You have to blame municipalities for complete lack of understanding of these security concerns.

        Next, script kiddies causing couple fender-benders and every municipality having to upgrade traffic light systems at a "I want it yesterday" premium. Then higher property taxes to pay for such monumental lack of planning and foresight.
        • by Chris Mattern (191822) on Friday August 22, 2014 @09:22AM (#47728495)

          And who will be blamed? Why, the researchers who discovered this incredible negligence, of course! "If you hadn't shown the hackers how to do it, we never would have this problem!"

          • by sinij (911942)
            This is indeed the likely outcome of this debacle. If it comes to court, I will personally pitch-in for defense fund.

            Still, it is surprising that nobody looked into these systems before. The technology to do so existed for many years.
        • by Mr D from 63 (3395377) on Friday August 22, 2014 @09:27AM (#47728537)
          Most of those who do the purchasing are required to enforce the standards. Deviating, even with the intent of improvement, can bring unintended consequences and blame. For instance, add security, then all of the sudden maintenance access doesn't work because its different, complaints and blame fly. Just one possible example of many things that can happen, thus they have standards and are required to use them.
        • by aaarrrgggh (9205)

          "Standard of Care" would be the correct term.

        • by Belial6 (794905)
          This is just a "on a computer" issue. If I want traffic lights to behave badly, I could easily do it without connecting into the automation side of it. A few colored LED disks attached in front of the existing lights and I get the same effect with no hacking involved. It is like people worrying that their car's drive by wire breaking system will get hacked because they believe it is so much more likely than having their break line cut.
          • by sinij (911942)
            If I can mess with your drive-by-wire system remotely, then yes, it is A LOT more likely to happen than having line cut.
          • by omnichad (1198475)

            I think it's a bit more likely to go undetected if you do it wirelessly.

      • And how exactly would a simple password result in a higher price?

        They are using standard IP software (as evidenced by the fact that the "attackers" could join without the slightest effort), and I'm sure that software has the option of requiring a password to join the network. All they had to do is tick the box, pick a password, and hardcode the password into the traffic lights software. I know, not the best solution, but surely better than using no password at all.

        So don't tell me cost was the reason. Basic

        • And how exactly would a simple password result in a higher price?

          That completely misses the point, even if adding a simple password were the answer. If a standard is not sufficient, it should be changed. Don't blame the buyer or the vendor. For things like traffic lights, you want them all to be as alike as possible to save costs, be it purchasing requirements, maintenance and troubleshooting, and operation. That is why there are standards and why they are followed and why there are costs associated with deviating from the standard.

          • by omnichad (1198475)

            What makes you think there are standards? I can almost guarantee that you're vendor-locked the moment you start building the system.

            • You can have vendor lock with or without standards. Standards can often contribute to vendor lock.

              Why do I think there are standards? For one, the article refers to them, albeit vaguely. For two, purchasing standards or requirements for commonplace items such as stoplights typically fall under some type of code/standard/requirement system, and that makes sense when you want to make sure equipment is similar throughout a large system or state. Be that for vendor lock, or simple management simplicity, you
        • by sjames (1099)

          It would cost more to cover therepy for their employees. When the customer calls 3 times a day and says "I don't remember if the password is 1234 like my luggage of 4321 like my ATM (or is that the other way around), could you set it to something i'll remember?" it takes a huge effort and creates a lot of stress to refrain from answering "I doubt it"

        • by AK Marc (707885)

          And how exactly would a simple password result in a higher price?

          The training and SOPs for new processes, at the very minimum. Perhaps new control systems for the "secure" interface, at the cost of billions.

    • by nine-times (778537) <nine.times@gmail.com> on Friday August 22, 2014 @09:30AM (#47728569) Homepage

      No, it's scary how much we still don't care about security. These things could definitely be fixed, we just don't care to fix them. We don't demand security in the first place, we aren't willing to pay for security, and we aren't really willing to fix security when it's broken. People will run around looking for blood for 5 minutes when it's discovered that there are huge security flaws, but nobody will fix them.

      Remember all the news when it was discovered that a person could easily and untraceably hack voting machines? Do you think that was ever fixed? The way we use credit cards is insecure. Most email is unencrypted. We use Social Security Numbers as both an identifier and a form of authentication.

      Most of what we do is completely insecure, and it's actually kind of amazing how rarely people take advantage of it. But it's really disturbing that we aren't remotely willing to secure things that would be relatively easy to secure, and would solve lots of problems.

      • by Lumpy (12016) on Friday August 22, 2014 @09:48AM (#47728713) Homepage

        "we aren't willing to pay for security" It's worse than that. IT also stems from the fact that people in charge. The guys making big bucks making decisions are horribly undereducated.

        If you ask the guy that is in charge of the city's traffic lights to explain in detail how the system works he will NOT be able to tell you. We as a society do not put in leadership positions the best and brightest. WE instead promote those that can suck up the best and schmoose the best.

        And it's now biting us in the ass because the decision makers in general are dumb as a box of rocks. And when faced with a problem they simply say "I dont know" or try to scream how we need more laws instead of actually learning what the problem is and fixing it.

        • people charge of traffic lights are engineers but not likely to be EE's or tech people. They may know some what about how they work but maybe not the deep tech parts. The engineers in charge are traffic / construction engineers.

          • by TWX (665546)
            Civil engineers that design traffic flow systems are looking at the problem from a macro-scale, and from a traffic-perspective, not from a security or physical device perspective.

            It's the job of the designer/implementer to put the security into the system. In that sense the vendor and manufacturer should be held liable, not the customer.
          • I once knew a traffic-light engineer who was an EE with a BS. I mentioned that I thought it was annoying not to have sensors on lights in rarely-used cross streets, since it wastes a lot of gas to have the main throughway traffic constantly stopping for no reason, not to mention wasting people's time. He said that if you put in a sensor, people will get used to the light always being green, and in the rare case it turns red they will tend not to stop and will cause more accidents. He was very strongly opp

            • by cnaumann (466328)

              You would be surprised how conditioned you can become to traffic patterns always being a certain way. I nearly caused an accident last week when I turned left in front of a car that was going straight. I am a good driver... why did I do that? The intersection was where two small neighborhood roads intersect the main road. After I screwed up, I realized that In the last 25 years, I had _never_ seen a car go straight through that particular intersection. I unconsciously assumed that he was waiting for the

              • by tlhIngan (30335)

                You would be surprised how conditioned you can become to traffic patterns always being a certain way. I nearly caused an accident last week when I turned left in front of a car that was going straight. I am a good driver... why did I do that? The intersection was where two small neighborhood roads intersect the main road. After I screwed up, I realized that In the last 25 years, I had _never_ seen a car go straight through that particular intersection. I unconsciously assumed that he was waiting for the lig

            • Unfortunately, those sensors sometimes fail. With no "call," then one direction may never get a green light. (Of course, if this happens, then the tech will call an engineer to get a timing plan, then go out and reprogram the faulty controller, if it's not networked.) Freezing conditions, et c. can ruin in-ground loop sensors, and optical sensors can become befuddled by fog, snow and sun. Radar-based sensors are becoming more common, and because they're mounted on an arm or on a pole, they can be replace
              • by omnichad (1198475)

                I was stuck at a faulty red light with a sensor once. I waited for almost 5 minutes, wanting to call the police out to get me out of the stop light. Yes, I'm pedantic enough to annoy my wife like that. I knew that backing up and pulling forward would work, but it shouldn't have been necessarily.

            • by sl149q (1537343)

              Well our local municipal engineering department obviously has not read that memo.

              We have various lights that are always green and switch on demand when a car approaches on the side street.

              I'll note that the counter argument is that people using those roads get used to them always being green, but also get used to them switching quickly to red when a car approaches from the side street.

            • by AK Marc (707885)
              The issue with any traffic engineer, is that there's actually no science supporting traffic engineering. It's voodoo. And if you say that to anyone who deals with traffic, they act like you dessicated their shrine. Sure, some individual parts have science (traffic flow). But when proven false (California flows better than stated, other places worse) they will persist on using the proven wrong models, rather than trying to solve for reality.

              A human factors study into lights, and having the colors/flashi
        • I don't know. I my experience, a lot of poor security isn't caused by incompetence. It's caused by someone saying, "But that will cost more money..." or "That will take too much time..." or "But I want to buy from this supplier because the owner is my brother-in-law..."

          I mean, they don't necessarily say those things out loud, but those are often the reasons. It's not necessarily that they're too dumb to understand that it's bad security. They just don't care. They're not thinking about the potential f

        • by jafac (1449)

          Not only is it that the guys making big bucks making decisions are horribly undereducated: they won't pay for security because that would cut into THEIR compensation (to have to pay competent engineering staff). So not only are they undereducated, they have a conflict of interest that promotes horrible engineering practices.

      • by Belial6 (794905)
        You can not secure the lights. It is simply impossible without placing security guards at every corner.
        • Did you not read the summary, even?

          The network is IP-based, with all the nodes (intersections and management computers) on a single subnet. In order to save on installation costs and increase flexibility, the traffic light system uses wireless radios rather than dedicated physical networking links for its communication infrastructure ... The 5.8GHz network has no password and uses no encryption; with a proper radio in hand, joining is trivial. ... The research team quickly discovered that the debug port was open on the live controllers and could directly "read and write arbitrary memory locations, kill tasks, and even reboot the device.

          Yes, ultimately physical security is always an issue. They can try to make the devices difficult to access, but as you've pointed out, that's always going to be a problem.

          But this is a different level of "insecure". These things are controlled through open, unencrypted wireless networking. There are no passwords. It's like the difference between saying, "Your home is never completely secure, since someone can always break a window or crowbar the door open," vs. "Let's

      • by omnichad (1198475)

        The US is finally moving to chip and pin for credit cards by next fall.

      • These things could definitely be fixed, we just don't care to fix them.

        And we don't even have the tools do to so. How many languages let you write:

        secure char[] myPassword

        much less:

        secure objectType myObject

        and have the language memset its memory to zero (or shred, etc.) for you when the variables go out of scope?

        It's hard to do security right even if you're really trying. Anybody know if C++2014 made any gains here?

      • Most of what we do is completely insecure, and it's actually kind of amazing how rarely people take advantage of it. But it's really disturbing that we aren't remotely willing to secure things that would be relatively easy to secure, and would solve lots of problems.

        It is almost like we are under the rule of a third world tin pot dictatorship. The top of the control pyramid can't hear anything because control is all that matters and the bottom can't teach the top anything because the top already hires the "best and brightest" (read: best friends and shiniest coins). Heh. Gotta love what power does does to most individuals.

        • You know, I've thought about why this is the case, and here are a couple of thoughts that I had:

          1) With all we've found out about big businesses cooperating with the NSA, I wouldn't be too surprised if the NSA had, in some ways, actively discouraged security and encryption.

          2) I think part of the problem is coming up with, agreeing on, and an implementing a set of standards. We don't do standards anymore. Everyone has little walled gardens. We're not going to come up with better email standards, for exa

    • by jonwil (467024)

      I recon if you were trying to convince someone to take security of critical infrastructure, one way to do it would be to show them Die Hard 4.0 (best example I know of when it comes to hackers breaking into infrastructure) and say "this may only be a Hollywood movie but do you want to be the one who said "no" to better security when that shit happens for real?"

      • by mlts (1038732)

        I know what the reply will be:

        "The hackers would have gotten in no matter what we would have done."

    • I think I read somewhere that traffic lights are designed so that it is impossible for both sides to get a simultaneous green light. They have some kind of physical switch that enforces this. In other words, even if the system is hacked, you can't make cars crash by changing all the lights to green. That doesn't mean that a hacker can't cause some problems by making the lights stay red for 10+ minutes or other such mischief.
    • by Rogue974 (657982)

      I agree with you. I am a Controls Engineer. Until recently, my controls security was decades behind. Fortunately, Stuxnet happened, our CEO noticed the news stories and started asking questions and took an interest. A small group of controls engineers and an IT person who also did the controls network at the small plants he supports made a team, did research, made recommendations and were given money to start securing our network properly.

      We need to start realizing security through obscurity is no secur

    • by Darinbob (1142669)

      The thing is, the "hole" is not about being wireless, that's just stupid fear mongering. The hole is in not having security in the first place. You can indeed have highly secure wireless networking. The trick is in getting the customers to demand security instead of thinking of it as an inconvenient hassle.

  • Deaths? multiple injured people? Why isn't that secured in the first place? With all the news about stuff getting *hacked*, why are they still doing this?

    • by Nyder (754090) on Friday August 22, 2014 @09:10AM (#47728413) Journal

      Deaths? multiple injured people? Why isn't that secured in the first place? With all the news about stuff getting *hacked*, why are they still doing this?

      They are waiting for the first part, because unless there is a big uproar about it (which there won't be until it gets abused enough to cause deaths) it costs too much money to fix.

      How this is a surprise to anyone by now is a surprise to me, this has been standard operating procedures with pretty much everyone since computers have come out. That is, security is non existent or an afterthought. Paying money to make sure everything is secure for any sort of attacks/compromise/whatever takes away from the bottom line, so shareholders don't like that stuff. And management is kissing the shareholders ass, so it's not as important.

      Now for government work, it's a bidding process and well, you aren't going to make any money on the job by having to hire some sort of computer type to make sure the system is secure. And since the contract probably didn't state it needed to be done, well, this is what we have.

      So wait until it gets abused bad enough to kill people, nothing will get done.

      • Re: (Score:3, Interesting)

        by mlts (1038732)

        I remember this crossroads in the 1990s. Would firms in general focus on security, even though the worst threats at that time were college students looking to rm -rf / a box or two for kicks.

        It came out worse than I could imagine. I heard the "security has no ROI" mantra many a time (although the past couple places I worked at, they actually take it seriously.) When working as a consultant, I asked companies what they had for something if they were hacked. The response was, "We will call Geek Squad or I

      • by Hentai (165906)

        How this is a surprise to anyone by now is a surprise to me, this has been standard operating procedures with pretty much everyone since computers have come out.

        Computers?

        http://www.motherjones.com/pol... [motherjones.com]

    • by Lumpy (12016)

      They don't care. There was a very dangerous intersection that people wanted stop signs at for years and asked several times and were denied. Until there was a major nasty accident that happened and the news covered it and got word that the city ignored requests for stop signs, the light of public anger was finally pointed at them and they suddenly had the signs installed.

      Your city does not care one bit if you die or even if 100 people die, they only care if they look good to the public. This is the p

    • by Belial6 (794905)
      Because the very nature of traffic lights make them insecure. It is physically impossible to secure traffic lights without placing an actual human guard at each corner.
    • by omnichad (1198475)

      Because the CEO already got theirs and they can just step down and keep their share of the profits. Leave it for the corporation to handle without them.

  • So can cyclists use this to proceed through an intersection with miscalibrated vehicle sensors without having to wait several minutes for a motor vehicle to pull up behind? I don't know about other countries, but not every US state has a dead red law [pineight.com] allowing one to proceed with caution through a malfunctioning signal.
    • Re: (Score:1, Offtopic)

      by sinij (911942)
      I personally want to take Sicilian gondola everywhere I go, rowing it is good for your health and it is perfectly green. I advocate for all bike lanes to be turned into waterways to accommodate my craze.
    • by Greyfox (87712)
      Hah. In my town the traffic lights seem to be designed so that traffic stops at every goddamn one of them. I wonder if they could be fixed. I'm already not liking where this train of thought is going heh heh.
  • My home town [waldport.org] only has one traffic light (and didn't get a left turn lane until after I moved away). I wonder what sort of damage hackers could do with that... Chaos where US 101 meets highway 34....

    • by drinkypoo (153816)

      Your home town probably doesn't have a network-connected traffic light, either, since it only has one light to work with and there's not much point. Unless there's some compelling reason to do otherwise, these systems are only replaced when they fail. If you live in a major metro area then sure, there's reasons to upgrade before failure, involving traffic management.

    • by Anonymous Coward

      Well, the security through scarcity will not slow them down. The meanies will just steal your stop signs and pee in Eckman creek, which are totally insecure and unguarded. This is a good thing. In most towns police guard the traffic lights and issue tax bills at random under the guise of security.
      Hell, in some places, like where Eric Garner lived, packs of police officers will hunt you like wolves and beat you to death. Yup, if I were the ex janitor at the D.O.T. who found out how to hack a street light, I

    • by freeze128 (544774)
      I'm just surprised that you even have INTERNET ACCESS.
  • by Anonymous Coward

    What is the point of this "research"? To prove that there are still many systems in our world that can be hacked easily? No shit.

    The thing is that sometimes there is no incentive to hack things because it is a lot of work for very little gain, until some other asshat on the interwebs shows people how it can be done. Then the effort to hack it becomes less (as there is not a manual), and thus the freqnency of it occurring increases. I may exaggerate a little when call this a form of sponsored vandalism... bu

  • Red means stop. Do not go. No, no, no. Green in all directions means go. Oh no, Oh no, Oh no.
    • by GTRacer (234395)
      Or, Monty Python:

      I like traffic lights,
      I like traffic lights,
      I like traffic lights,
      No matter where they've been.

      I like traffic lights,
      I like traffic lights,
      I like traffic lights,
      But only when they're green.

      And so on in that fashion for several more verses...

  • No more reasons to be late at work.
  • ... is a job best done by people who understand it. Yet the security czar of the US Government bragged in an interview that since he didn't know anything about security he was better able to deal with it.
  • I can fix the the flashing reds that happen all. the. damn. time. In my hometown.
    • by omnichad (1198475)

      Flashing reds is probably a failsafe mode. You could give yourself a green, but it won't fix them for anyone else.

  • by TomGreenhaw (929233) on Friday August 22, 2014 @10:53AM (#47729333)
    Its easy to exceed the speed limit. Its easy to shop lift. Its easy to buy a gun and shoot somebody.

    Its probably easy to build a device that gives you green lights as though you were an emergency vehicle. This is definitely illegal.

    While I think its irresponsible to design computer systems without basic and reasonable security measures, technology is not the final answer to antisocial behavior. Hacking somebody else's systems is illegal and wrong. Finding (sometimes ) esoteric ways to do it and making it easy for bad guys is just plain foolish.

    My friend Neil and I have a law: You know you have enough security when you can't do your job anymore. Requiring the average stop light electrician to now be a computer networking security expert requiring tons of tech support would certainly drive up taxes.

    Antisocial behavior is why we have laws and there is a reason we should obey them.
    • by ogdenk (712300)

      Hey! I speed occasionally and I own a firearm or two *BUT* I don't shoplift or shoot everyone that pisses me off. So does that mean I'm only halfway antisocial?

      Bringing security flaws that could get us killed to light in public view is NOT antisocial behavior. Hacking said systems and actually manipulating them to cause mayhem *IS* antisocial behavior.

      Software security is VERY important. Anything can be hacked but irresponsibly making it blatantly easy for people to control these systems and cause loss

    • My friend Neil and I have a law: You know you have enough security when you can't do your job anymore.

      As a "security guru" and a Heinlein fan, I love to twist some words that Mr. Heinlein wrote:

      My job is to help you do, in a safer manner, what you were going to do anyway, not to prevent you from doing it in the first place.

      This was concerning an exchange of a Mr. Harriman to his lawyer with me speaking from the lawyer's point of view.

  • Wireless security doesn't mean much when people already have easy physical access to all of these traffic lights. It's not like they are guarded by more than a pad lock. I am guessing the greatest threat to traffic lights (in the eyes of the department of transportation) is still copper thieves.
    • by pruss (246395)

      It's a lot easier to get caught when breaking into the padlock than when driving by with an RF device.

  • Don't emergency vehicles sometimes use this to their advantage to turn an intersection into a 4-way red light so that they can get through? I know I've heard of ambulances and fire trucks having a button that makes all stop lights near them turn red, but I have never tried to verify the truth of the claim.
    • by k6mfw (1182893)
      I was thinking what do they use now. Years ago I remember fire engines and trucks had strobe light on top of cab that flashes sequences which causes traffic light to turn red on opposing traffic. In late 70s or early 80s I saw a Dodge van that was parked in Quement Electronics on Bascom Ave in San Jose (you old guys remember that store, favorite among geeks back in the days when Fry's was a grocery store). I guess this person got ahold of one of these and voila, never gets a red light. Question I always won
      • It's called signal preemption. Opticom [gtt.com] is IR-based, and in fairly common use. There are several other systems available for signal preemption, including:

        • --GPS-equipped vehicles communicate with a control center, which does the preemption,
        • --audio-based, which react (hopefully) to a siren,
        • --rf-based.

        There may be others, but these are the ones I'm familiar with.

  • So when are we going to hear about sob storys from idiots who hack traffic lights and get more then 33 months in jail for it?
    • by sl149q (1537343)

      This is really not much different from simply (for example) removing traffic signs.

      I recall that some kids removed a stop sign as a prank, (Florida, mid 90's?) There was a bad accident and the result was a man slaughter charges and something like 20 year sentences.

  • by almitydave (2452422) on Friday August 22, 2014 @01:28PM (#47731025)

    Reminds me of the time when that list of crosswalk-button hacks was published - it created quite a stir [bbspot.com].

  • As always, when something gets hacked, we find out it was for the stupidest reasons. You can just log into a Wi-Fi network and dump the entire memory of the traffic light through a debug port that was left open? I mean sure, everything can be hacked, but this is just handing the entire system to the hackers. Just like nearly every other "hack" that goes on in the real world.

    This is just like when a web forum gets "hacked" because somebody with an axe to grind guessed the admin's password was actually "PaSsW

"I have just one word for you, my boy...plastics." - from "The Graduate"

Working...