PCs Pilfered, Paralyzing Populace

Heywood Yabuzof writes "According to this Wired story, thieves in Chile caused traffic to grind to a halt when they decided to steal the computers (15 PCs and 2 servers) that control the traffic lights in Santiago. Funny how everyone worries so much about preventing "evil hackers" from breaking in to systems remotely and causing chaos, and then some burglars just go ahead and steal the critical computers to produce the same (unintended?) results."

Comments

i hope for their sake

[ddent]

That they have backups of the data that was on those PCs... IIRC, Vancouver (Canada) spent 1 million to syncronize the timing of all the traffic lights...

Re:i hope for their sake

[Anonymous Coward]

I hope so too -- it would be dumb if they didn't. I find this hillarious:

But while stealing the goods, valued at US$90,000, they took their time. According to police reports, these peculiar robbers smoked some cigarettes, ate a snack, and drank a few cups of joe, taking it easy before leaving the scene of the crime.

If only criminals in America were as laid back. Heh.
_
WINDOWS USERS CLICK HERE!

Re:i hope for their sake

[beckett]

don't worry, i d/led the whole .gz file off of Direct Connect and burnt it on a CD. I'm sharing it right now!

Re:i hope for their sake

[Zarhan]

According to the article:

Patricio Tambolini, subsecretary of transportation, told the local media that drivers should not expect a normal green light until Monday, when things may be straightened out. About half of the 800 derelict traffic lights were operational by Thursday evening, thanks to a backup version of the software that controls the lights, but no word on when the job will be completed.

So yes, they do indeed have a backup, it just takes a while to get it up and running.

Re:i hope for their sake

[ddent]

True. It's not clear though if they have specific timing information, and for all the lights. There is a difference between automated semi-sensible syncronized lights, and the results of spending a million dollars figuring out the best way by hand.

Re:i hope for their sake

[catwh0re]

the purpose of stealing such equipment, none other than to run the largest lego city the world is yet to see. purrrrr

Re:i hope for their sake

[herko_cl]

Living in Santiago, I can testify they luckily did. Using a backup server, they were able to restore traffic to normal within 6 hours.
I'd like to clarify a few points, though. Our traffic lights are fully autonomous, but the stolen computers analyze traffic flow via cameras at critical junctions and synchronize the lights from one crossroads to the next.
This works so well that, even when traffic is extremely heavy, cars keep moving along. On most mornings and evenings, if you are going "with the flow" you can drive for miles without getting a red light.

On the subject of security: apart from stealing the alarm system (we thought that was funny, too), they removed heavy cast-iron bars from a window to enter this office. To do this, they had to break down part of the wall. This was obviously a well-planned, well executed heist.

Re:i hope for their sake

[1u3hr]

Is anyone reminded of The Italian Job, the novel an more famously movie that had a computer hacker (Benny Hill! as Professor Simon Peach) 0wn the Milan traffic computer, causing an immense gridlock, except for one path for the armoured car robbers to escape (the cops turned that off, so the crooks, led by Michael Caine) went on a merry chase in their Mini Coopers across rooftops and stairways to escape....

Re:i hope for their sake

[M-G]

Yes! That's exactly what came to mind when I read this. Of course, I just watched it a week ago, so it's pretty fresh in my mind.

As for the Mini Coopers, don't forget the sewers. Legend has it that during practice runs, one of the drivers managed to do a complete barrel roll, but they were never ever to do it with the cameras running.

Car people have to watch this movie, although the destruction of the Mini's, a couple of E-Types, and an Aston Martin are a bit painful to watch...

It's a good thing...

[Sivar]

It's a good thing they had the servers all in one place, else they may have inconvenience the thieves.

Re:It's a good thing...

[56ker]

Makes you wonder why they needed computers to control the traffic lights - surely that could be done with some 555 timers & other ICs instead of going to the expense of using PCs? It reminds me of my GCSE technology coursework - even though there was no need for it to be computer controlled (things like a burglar alarm etc) we had to make it computer controlled just for the extra marks!? Maybe this is the same mentality here - they've been taught they need to have everything computer controlled so they've done it that way!

Re:It's a good thing...

[BlueUnderwear]

Makes you wonder why they needed computers to control the traffic lights - surely that could be done with some 555 timers

Read the article. The traffic light were able to operate autonomously using builtin timers... What the computer did was ensure synchonization between one crossroads and the next. To make sure that when you get a green light, the lights are also green in the next few crossroads. Timers tend to drift, and hence an centralized system is necessary to keep things in sync.

And presumably the computer system also changes the timings to adapt to the differences in traffic patterns throughout the day (giving longer green periods to those directions where the most traffic is at that time). Nowadays, most city road networks operate very close to their capacity, and even little details such as the exact timing of traffic light are important to keep matters fluid.

Re:It's a good thing...

[NoMoreNicksLeft]

I find it hard to believe that most city streets operate at anything even approaching 100% capacity. It's probably more like 60-70%. Even dumb old me, could think of ways to further optimize it.

And it wouldn't even consist of locking the server room, and posting a rent-a-cop. LOL.

Re:It's a good thing...

[BlueUnderwear]

I find it hard to believe that most city streets operate at anything even approaching 100% capacity. It's probably more like 60-70%.

Considering the average over the whole day, and over all roads and streets in the network, it's probably even much lower than that. What's relevant here is peak usage: how overloaded are the main arteries at rush hour?

Re:It's a good thing...

[56ker]

About the first one - where I live is at a major junction right next to a bunch of traffic lights. People expect long traffic jams and delays at rush hour - that's just normal. As to your second point if you watch the lights at night (I can see them from my bedroom window) they only change when a car comes along. With these two systems - central control is not needed. That's why I felt computers in all this were unecessary - because in the case I know about they are!

Re:It's a good thing...

[BlueUnderwear]

About the first one - where I live is at a major junction right next to a bunch of traffic lights. People expect long traffic jams and delays at rush hour - that's just normal.

Indeed. But there is a difference between long and very long...

As to your second point if you watch the lights at night (I can see them from my bedroom window) they only change when a car comes along.

That works ok only on crossroads where one direction has hardly ever a car. But as soon as higher level of traffic are to be dealt with, the system would also need to find out how many cars there are, and what the overall state of the system is. Computerized traffic control systems are pretty much common in many large cities nowadays, even though they are usually better secured than in this case.

Re:It's a good thing...

[NoMoreNicksLeft]

True. But how overloaded do they have to be? For instance, I know of one major street with 5 stoplights. You can't make it through all of them, and on some days, you'll see more than 2 redlights before you're through it. At rush hour, you'll see all 5. During rush hour, some of the cross-streets will have 1 or 2 cars waiting for their light, but it's just as likely there won't be. Do you ignore those one or two cars, and make them wait 20 minutes to cross? Do you hold up traffic every two minutes, even when those cars aren't there?

Is it just me, or is there something wrong with this? Hell, I'm sure they haven't stolen our traffic control computers... so what gives? Maybe they have, but there was a coverup? Heh. My solution would solve all this, and a few more problems... and not be some multimillion dollar smartroad project with a 20 year timetable and unbelievable cost overruns.

Which pretty much guarantees no one would ever want anything to do with it.

Re:It's a good thing...

[tjb]

If its just synchronising, why not just run a wire from light-to-light with a reference tone on it and have each timer phase-lock to that? That would eliminate any drift and probably be a heck of a lot cheaper.

If they were doing any sort of analysis, though, I could see why they'd need PC's.

Tim

Re:It's a good thing...

[BrokenHalo]

Here in Perth, Western Australia they do the opposite...

Under the aegis of "traffic calming", successive sets of traffic lights are programmed to turn red. This in a city the size of, say, (Greater) London, but with 5% of the population density.

Needless to say, it doesn't leave many of us very calm :-)

Re:It's a good thing...

[Harlow_B_Ashur]

Acutally traffic lights derive their time base from the power grid, which allows all traffic lights to know exactly what time it is, at least relative to one another.

I'm not aware of any centrally contolled type systems in the U.S. that would go haywire if central went down, typically they revert to a reasonable coordination scheme according to the time-of-day in the absence of central control.

As for a 555 timer being up to the task, hardly. Traffic lights have been a whole lot more sophisticated than that since at least the early 1930's.

Re:It's a good thing...

[uspsguy]

A couple of years ago, the hard drive in the city of Lakewood, CO's control computer bit the big one. Lights were still operational but rush hour was a disaster for about 2 weeks. The failed drive was an old, non-standard (8 inch platters, maybe?) one and there were no replacements readily available. The control computers adapt the system to various traffic flows. For example, morning and evening rush hours require different timing for best flow. BTW, Lakewood now has a redundant backup system. For some odd reason, there was suddenly some money available to fix the system more or less right.

You've gotta love...

[goneaway]

that they just hung out for a while and had some snacks. A LAN party before the heist perhaps?

Re:You've gotta love...

[swankypimp]

With all the coffee they drank, they were probably IT guys. I just knew that "Ned" character from the IBM commercials was up to no good.

Re:You've gotta love...

[gnovos]

"Ned, where did all the servers go!?!?"

"Don't worry, boss, they were all transfered over to the IBM e-server!"

"Oooooh, excellent! Ah, where exactly IS the e-server?"

"Oh, that got stolen."

Re:You've gotta love...

[dxkelly]

I thought the funniest part was that they stole the alarm system too. :-)

Evil hackers

[Anonymous Coward]

The term is now "cyber-terrorist."

Slow down!

[tanveer1979]

With the slow down hitting everything the thieves may have thought that the traffic should also face a slump, and moreover look at the bright side. You get a friday off :-) and have a wonderful excuse to give to your boss. i am wondering when will that happen here

Re:Slow down!

[pennsol]

This article should have been posted on a Monday so everyone getting to work could chime in with thier "just got outt of rush hour traffic" two cents... now that would have been funny?

Physical Security

[dirvish]

Physical security is just as important as network security. If the admin of these servers and computers had safegaurded their physical security there wouldn't have been a problem. Hackers are just one threat...vandals must also be considered. That is why physical security is one of the 10 sections covered in the CISSP certification exam (the premeire information security certification).

Re:Physical Security

[Anonymous Coward]

They deactivated the alarm system and security cameras, Generally ir is not the sysadmins job to do more than request extra security from whoever physical security is contracted out to.

Re:Physical Security

[Shiny Metal S.]

Other very common mistake is leaving a floppy drive set up as the first booting device, or not having password protected BIOS settings.

With e.g. Debian boot floppies or any other mini Linux and mini Unix distribution you can just insert a floppy, hit reset and wait a while until you got r00t and do whatever you want (like change the real root password in /etc/shadow on the main partition to whatever you want).

I'm talking about it, because it's much easier than trying to write a remote exploit, much easier than writing a local exploit and much easier than actually stealing the whole hardware. It's usually also much easier than social engineering.

It wouldn't be even hard to make a floppy which automatically do something to the system (like adding new users and adding them to every group, changing passwords, reading encrypted passwords for later cracking, leaving backdoors, etc.). When you have such a floppy, you only need few seconds to insert it, hit reset, come back after a minute when everything is done, take your floppy and hit reset again.

You can even prepare this floppy in a way, that when everything is done, your files from the floppy are deleted and "shutdown -r" is run. That way even when someone enters the room before you, he'll only find a normally working system with empty floppy in the drive. The chances are that no one will even go there to see what's wrong if the server was down for a minute and now it's OK, especially if it's a lunch brake or something.

Very dangerous and very easy if you can only go near a computer, and if it can boot the system from the floppy. And I've already seen servers without BIOS passwords and those set to boot in order of floppy,cd,hdd. It's very important and often forgotten issue, it's somewhere between physical and non-physical (logical?) security.

Re:Physical Security

[aoeuid]

Perhaps it was an inside job. The article says the theives were familiar with the building. Perhaps a disgrunted employee shed some light on the building security, hence the ease at which they were able to disable this alarm system that was indeed in place. Especially when you consider that they were confident enough to stick around for a while, it really makes you wonder whether they knew they weren't going to caught because someone else had set the whole thing up.

Re:Physical Security

[greenrd]

Yes, that's an interesting issue. However, even setting a BIOS password isn't foolproof, because a BIOS password can be bypassed if you have physical access to the machine for a sufficient amount of time (e.g. to take out the battery, take out the hard drive, etc.).

Re:Physical Security

[mark-t]

Physical security is just as important as network security.

Although the point you've made here is essentially correct, physical security is actually _more_ important than network security, as without it, any and all additional security features are rendered null and void. Period.

Re:Physical Security

[GeorgieBoy]

With e.g. Debian boot floppies [debian.org] or any other mini Linux [uga.edu] and mini Unix [cotse.com] distribution you can just insert a floppy, hit reset and wait a while until you got r00t and do whatever you want (like change the real root password in /etc/shadow on the main partition to whatever you want).

It's really even easier than that, in fact, without a floppy, you can just tell the bootloader (e.g. lilo) to boot with options like "linux init=/bin/sh" or something similar, and after the kernel loads you'll just get a shell.

Re:Physical Security

[Shiny Metal S.]

Yes, you're right. Sometimes you can even use a backdoor password. I remember that password AMI worked for every AmiBIOS some time ago (extremely stupid idea, once someone knows such a password, every system can be compromised). There's a lot of interesting articles on the Web about cracking BIOS passwords:

• HOW TO BYPASS BIOS PASSWORDS by Elf Qrin
• How to Bypass BIOS Passwords by LabMice.net
• BIOS Password Recovery by Password Crackers, Inc.

A Google search for BIOS Passwords gives quite a few hits. Putting your floppy into the drive is the fastest and easiest thing you can do if you have physical access, but it's not the only issue. No one should ever be allowed to be near the important servers, except people responsible for the security.

Somehow off-topic, but speaking about security, I have to recommend one of the best texts about security (mostly about secure programming) I've ever read: Secure Programming for Linux and Unix HOWTO by David A. Wheeler. Great read. And speaking about passwords, it's good to read great publications of Alec Muffett, the author of the famous crack(1) and CrackLib:

• Security FAQ
• Proper Care and Feeding of Firewalls
• WAN-Hacking with AutoHack (plus slides)
• How To Build Your Own Network Intrusion Kit (readme)
• Programming Holes that will hose your System Security
• Crack FAQ
• CrackLib README
• Crack Humour

It's maybe not very on-topic when speaking about physical security, but it's very important to understand the security as a whole.

Re:Physical Security

[Shiny Metal S.]

It's really even easier than that, in fact, without a floppy, you can just tell the bootloader (e.g. lilo) to boot with options like "linux init=/bin/sh" or something similar, and after the kernel loads you'll just get a shell.

I haven't thought about it. It's even better, because you can do it on a machine without floppy and CD drive, or without knowing/cracking BIOS password, however you have to do everything manually. But it's easy to e.g. copy /bin/sh to /bin/cracksh with suid root, or even make a simple remote backdoor. What's important is that people think they have hard to guess root password and a secure system, but with access to reset switch and keyboard anyone can be root after 10 seconds.

Re:Physical Security

[zCyl]

Heheh, some of the comments on here show that people have spent far too much time at a keyboard. For Joe Schmoe who is running a website on fish mating habbits, physical security is nothing, because the only attack will come from random network attacks. But for a serious computer system, physical security is perhaps MORE important than network security, because it's already known exactly how to get past physical safeguards if you can access a machine.

In summary, all the comments being mentioned like locking the bios, making sure it doesn't boot to floppy, etc, is "nice", but all it does is buy you a few extra minutes worth of physical security. And for a serious system, minutes are nothing. If you want physical security for a system, lock the thing in a vault and don't even let your janitors near it.

Re:Physical Security

[Anonymous Coward]

Again, the nine-bit security of UNIX falls down.

It's so archaic.

Re:Physical Security

[Shiny Metal S.]

AC: Again, the nine-bit security of UNIX falls down. It's so archaic.

M**20: It's the security of your office. Don't blame unix.

You're right. Of course the security of UNIX doesn't fall down because I can bypass it with direct access to the hardware. The AC said that the standard Unix file permission bits are archaic. They are in fact archaic in a sense of ancient and old-fashioned, but they are not archaic in a sense of no longer current or applicable. They are archaic like the Kant's categorical imperative is.

However there are actually not 9 but 12 bits (set-uid, set-gid and sticky bit, owner read, write and execute, group read, write and execute, and others read, write and execute). This system is very simple and extremely practical, but this is not the end of Unix security mechanisms. You can mount filesystems with different restrictions, you can use additional file attributes of your filesystem, there are POSIX capabilities, etc.

With ACs there's a problem, that you never know if the one who answers is the original AC, or a different one, but I'll ask anyway: What would you change with the Unix (POSIX) security system? I guess that you only said it to start a flame war, but just in case you had anything insightful in mind, I'd like you to say some more details about Unix/Linux security and other models which you prefer, or any suggestions about features you would change or add. It could be very interesting.

I think, however, that when you fully understand Unix, you will appreciate and enjoy this powerful and flexible security model. But, as Henry Spencer once said, "Those who do not understand Unix are condemned to reinvent it, poorly."

Can you imagine...

[Anonymous Coward]

a Beowulf cluster of traffic lights?

Re:Can you imagine...

[Anonymous Coward]

what is pinisu?

Re:Can you imagine...

[batemanm]

Isn't that normally called a city?

Nice job to help us waking up.

[software_non_olet]

Isn't it lovely, even thieves give back a lot.

This is a problem all over the world

[jedrek]

Sitting behind our screens, we sometimes forget that the entire network is actually a physical entity. We remind ourselves of it when a backhoe rips through our ISP's OC3, or when we're out of cable and can't connect our network card to our router or modem.

Well, at least I do.

Anyway, here in Poland there's a problem with people stealing cable. Not cable-tv, but telecommunication cables. Whole neighborhoods here in Warsaw have been cut off from telephony because of stolen inter-exchange cable. Railroad lights have been known to fail because of stolen equipment (this happens way too often). It's twice as bad in Russia, trust me.

Actually, at times, it seems like everything that isn't screwed or welded down in this country (this region) will get stolen. Ah... sucks pretty bad.

Re:This is a problem all over the world

[Aceticon]

I was aware of that sort of problem in Africa, but i hadn't the slightest idea it occured in Poland also - one learns new things everyday.

Against that sort of problems i sugest fibre-optics instead of copper cables. Being totally worthless for anything else is one of the great values of fibre over copper cables - a thief can sell the copper in the copper cables, but not the glass in fibre (glass is way too cheap to be worth the trouble).

Re:This is a problem all over the world

[jedrek]

Yeah, I've heard that before.

I know for a fact (it's happened a few times) that fibreoptic cable will get stolen because thieves don't know any better. There's not actually that much money in cables, so the guys stealing them aren't really sophisticated.

Re:This is a problem all over the world

[BrokenHalo]

I'm impressed.

I can understand the alacrity with which the salvage guys came around when the company I worked for back in the early eighties was decommissioning their Burroughs B3700. You could easily have filled a small truck with all the heavy-duty silver cable under the false floor.

I find it a bit hard to appreciate the attraction for glass cable, and I can only admire them if they can make it worthwhile...

Re:This is a problem all over the world

[Anonymous Coward]

But on the upside, using fiber optics is great
for lightning protection.

Re:This is a problem all over the world

[Anonymous Coward]

Why the delay with deployment of fiber-optic cables, then, if they're cheaper?

Esp. since copper infrastructure is being removed in Poland, sounds like a good time for fiber!!

Skill.

[Renraku]

It would have taken some real skill to steal all of that via the Internet.

Fault tolerance and worst case scenarios

[JohnBE]

I would have thought that the system would have been designed with the worst case scenario firmly in mind and had I not seen the article I would have thought it a hoax story. However I am ashamed to say that I have seen so many single points of failure while doing consulting work, that the whole article is another depressing reminder of the 'it won't happen to me syndrome'.

Should have critical path analysis and worse case scenarios inherent in the design of the system as a whole as opposed to individual object security. I.E. don't just spend time securing the machines electronically but also ask what happens if someone boots down the door and steals the machines or if someone leaves the server room door open with a brick (I have once seen this). A more holistic view perhaps.

Re:Fault tolerance and worst case scenarios

[BlueUnderwear]

or if someone leaves the server room door open with a brick

Worse: leave the door to the facility open with a brick (to let fresh air into the non-airconditioned building), and in the evening, conveniently leave the brick outside near the door for the next day.

Oh, btw did I mention that it was a glass door?

Re:Fault tolerance and worst case scenarios

[dillon_rinker]

Bricks are pretty common...as are steel bars, rocks, tire irons, etc...

I'll grant that this was an invitation to mischief makers.

Hahah

[autopr0n]

Not only did they steal the computers, they stole the alarm system that was supposed to protect them.

The worlds most sarcastic criminals, is what we've got here :P

Re:Hahah

[baba]

Reminds me of another story, about this guy that used to have his stereo system stolen from his car on a regular basis. He got tired of it, and had an alarm system installed. Shortly after that the latest stereo system and the alarm system were both stolen...

Re:Hahah

[frinkster]

So maybe they were trying to prove a point, like when I stole the Neighborhood Watch sign back in my high school days.

Re:Hahah

[Anonymous Coward]

Chile has some of the most ballsy thieves on the planet. When I was living in Santiago, I was sitting in my 2nd floor apartment with the lights on and 10 FEET AWAY some guy had scaled the building and lifted my bicycle over the balcony railing and then jumped down to the ground and rode away. I almost died laughing watching him try to pedal away on this cruddy bike that was't worth 2 pesos with two flat tires and a broken chain. I almost expected to find the bike returned with a nasty note. ("Chucha bici como las guevas!")

Re:Hahah

[evilviper]

LMAO. Didn't see that comming.

Stop

[Nastard]

Didn't anyone tell these guys to "STOP"?

ahahaha "stop"... like the light! AHAHAHAHA OH MY GOD I THINK I JUST WET MYSELF!

ahahahhahahaha

Oh. Fuck you, you humorless swine.

Re:Stop

[Anonymous Coward]

I thought it was funny.

NOT!

Re:Stop

[Tranvisor]

I got a chuckle :)

I hope they had a good backup strategy

[cygnusx]

The real test for the admins at the end of the day will be -- how fast can they bring the systems back online?

Honestly, how different is this (apart from being more spectacular) from a power spike frying your servers (maybe because of a UPS problem)?

Re:I hope they had a good backup strategy

[Anonymous Coward]

Well, according to the article, "About half of the 800 derelict traffic lights were operational by Thursday evening, thanks to a backup version of the software that controls the lights, but no word on when the job will be completed."

Amazing what one learns when one reads the article before posting standard slashdot accepted drivel for karma.

Lesson about crypto

[xxSOUL_EATERxx]

Wasn't this the sort of thing the internet was designed to avoid in the first place? Anyway, the whole thing just underscores the importance of high-bit crypto. The best firewall in the world win't help secure your data if somebody runs off with your computer. Something to keep in mind in this day and age of intrusive "patriotic" legislation.

rofl

[rtscts]

Summary: inside job.

It's funny shit though:

But while stealing the goods, valued at US$90,000, they took their time. According to police reports, these peculiar robbers smoked some cigarettes, ate a snack, and drank a few cups of joe, taking it easy before leaving the scene of the crime

And my favourite:

After they loaded the computers into a van, the alarm was also taken

ROFL. 10/10 for style. Someone buy these clowns a beer (before they earn themselves a darwin award).

Re:rofl

[Rhinobird]

9.7...9.6...9.9...and a 7 from the Russian judge...

The judges clearly giving style points for the taking of the alarm system, however there is that automatic 10th point deduction for not turning off the surveilence system.

Back to you Chuck...

Re:rofl

[Anonymous Coward]

if they would drop off all the shit that they stole from that transportation building, that would be cool. hehe.

Re:rofl

[mistered]

and a 7 from the Russian judge

Or it could be the French judge... :)

heard that

[Anonymous Coward]

...in another country, the speed cams posted at intersections were being stolen, so they had to install spy cams to monitor the speed cams....too funny.

Re:heard that

[uebernewby]

...in another country, the speed cams posted at intersections were being stolen, so they had to install spy cams to monitor the speed cams....too funny.

Yes, and that country would be the Netherlands. Only the speed cams weren't stolen, they were demolished.

backups backups

[doubtless]

Any admins know that backup is one of the top priorities, and we all know the importance of off-site backups.

In this case, they should have at least 2 different sites that runs the traffic light system. Much like hospitals having at least a backup power supply, critical services like this are never to be interrupted.

Imagine if this happens to the air traffic systems, then I'm sure it wouldn't even be funny.

Security through obscurity

[ndogg]

"We thought we had deployed all normal security measures," Tambolini said. "You never know if you've covered all security holes until this kind of thing happens." He also pleaded to the almost 1 million befuddled drivers for some patience and understanding.

This just shows the weakness of security through obscurity. Security ends up becoming reactive rather than proactive, so the purpose ends up defeating itself, since you cannot fix holes until something is stolen through the exploitation of those holes.

Re:Security through obscurity

[MyNameIsFred]

I think you're being a little hard on them. Nowhere does the article imply that they used security through obscurity. Any security system is only as good as the amount of money thrown at it. In this regard, it should be remembered that we're not talking about the world's richest country. I'm sure Chile has lots of money to throw at a traffic center that is nuclear-bomb proof, guarded by 3000 commandos, surrounded by motion and heat sensors, and triple-redundent communication links to the individual traffic lights.

Re:Security through obscurity

[Anonymous Coward]

The question is, that even under these circumnstances the system would be BAD DESIGNED.

No matter how many commandos or nuclear-bomb proof silos you're still deploying ONE site.

Two sites (at least) was mandatory there.

more reason

[Anonymous Coward]

to set a special minimum wage for techs and engineers.

Physical Security

[SgtChaireBourne]

The theft in Santiago makes a good point about physical security and single point of failure. I stayed at a national record keeping agency a few years ago which got hit by thieves a few weeks before I arrived. In the areas they hit, they got every last CPU and piece of RAM and were out again before the alarm was respondend to.

Unlike the one in Santiago, this organization was very lucky that none of the hard drives were damaged or taken so there was no loss of working data, only expense and disruption of work. However, the building was sufficiently compartmentalized that they could only clean out a few administrative departments. They were already the model of security and efficiency for their primary charges. None of that is easily threatened by outsiders. However, after that they got religion about backups for even working material.

Fires, roof leaks, or clumsy people near the servers could have a similiar effect.

Root

[Hyperfrog]

Perhaps the recent news stories on the location of the Internet Root #1 server wasn't such a good idea.

Imagine.....

[Anonymous Coward]

A beowulf cluster of those!

Bah!

[jvollmer]

Don't practice your alliteration on me!
None of yer Hindus haronizin' in the hallway,
or Shintos shatterin' sheetglass in the shithouse!

in related news...

[anti-drew]

April 4, 2002 LONDON (NewsWire) The perfect crime was committed last night, when thieves broke into Scotland Yard and stole all the toilets.

Police say they have absolutely nothing to go on.

3 AM is too late for alliteration

[Roosey]

Pernicious people plundered PCs providing parkway profluence producing paralyzing predicaments?

Preposterous! :]

Re:3 AM is too late for alliteration

[gnovos]

Assinine alliterationist are always awaiting an astounding ass-kicking.

The worst...

[Anonymous Coward]

I'm sure this caused some of the worst crashes in the history of computing

h4ck th3 pl4n37!!!

[IntelliTubbie]

Update: although the traffic jam caused a significant delay for police, the thieves were later arrested at Grand Central Station after hacking into a Gibson mainframe from a bank of public telephones. The perpetrators, identified as Angelina "Acid Burn" Jolie and Jonny Lee "Crash Override" Miller, were later released and have since gone on to make better movies. Sandra Bullock was unavailable for comment.

Cheers,
IT

Could have been worse

[upper]

The lights could have been reprogrammed so to show everybody green lights all the time. Or to act almost normally, but to occasionally turn more lights green than their should be.

Or maybe that wouldn't have been possible -- it's not clear from the article whether the computers controlled the signals in detail or just sent sync signals to otherwise autonomous lights.

Happens with phone copper too

[bobobobo]

Similarly, another problem in 3rd world countries that are trying to develop any kind of widespread phone infrastructure, is that the actual copper itself is pulled out of the ground and stolen! This is one of the reasons India for example, is moving forward with satellite technology instead, as this practice tends to be commonplace and fairly frustrating.

Re:Happens with phone copper too

[BlueUnderwear]

Happens also with wires for electricity. Fortunately, in that case, the problem is self correcting

Re:Happens with phone copper too

[bobobobo]

Don't forget about gas and oil pipelines. People tend to notice these more often though...

Re:Happens with phone copper too

[Rhinobird]

yeah, kinda hard to steal a sattellite. So..are the Indians big on that beamed space power stuff too? Kinda hard to steal eletrical cables if the power is zapping you out in the open...

It would have been funny if...

[l810c]

they were caught in the ensuing traffic jam.

Re:It would have been funny if...

[fymidos]

but that's propably what happened to the police, no?

Re:It would have been funny if...

[Anonymous Coward]

"If they planned this jam, they must have planned a way out of it."

(a quote from The Italian Job)

Politics: Meat-Power vs Silicon-Power

[Anonymous Coward]

The reason some parties are more anxious about hacking is that it shifts a bit of power to the side of network security experts (i.e. geeks, hackers, NSA), away from the side of physical security experts (i.e. gurads, police, military, mafia, juntas). People aligned with the old guard take up their cause.

They stole a beowulf cluster of those things!

[Anonymous Coward]

Imagine when they make a beowulf cluster out of them!

DoS?

[prakashj79]

Does this count as a DoS attack? Talk of insecure systems. Sheesh.

Keep an eye out...

[quintessent]

...for PCs on eBay that come pre-loaded with traffic controlling software.

Not thatfunny...

[Tranvisor]

Funny how everyone worries so much about preventing "evil hackers" from breaking in to systems remotely and causing chaos, and then some burglars just go ahead and steal the critical computers to produce the same (unintended?) results."

The reason why everybody fears the hack more then the physical intrusion is because while on risk is a known one(physical) the other is a mystery to the normal person. People fear the unknown more then anything, your normal person knows they could buy a gun get some friends and scout out a place for a few weeks till they rob it, they are taught this from movies ;). Small wonder when, in the movies any hacker can cause widespread destruction with the push of a button, people are for some reason more afraid of hackers ;)

Related Wired Links

[CySurflex]

Related Wired Links: Latin America: The Mobile World not so mobile anymore, huh?

Polski cables.

[Anonymous Coward]

What's better?

(a) stealing Polski cables

or

(b) sex with a klacz

?

Re:Lesson about crypto? you fuckin fool

[Anonymous Coward]

how many comments have i read that say some dumb shit about the internet. do you really think that these servers were on the internet. think about it you fool. besides being a fucking gigantic security hole, what purpose would it serve? let punks like you know what the current state of the light 53rd by 9th is?

Tangential Tidbit

[LionKimbro]

I have heard that the US phone companies store the telephone switching computers in carefully unmarked basements of various public buildings in the areas where they are performing switching.

I have also heard that these are typically UNIX systems, and- get this- your phone number represents a series of cd ("cd", as in "change directory") operations into a file tree.

So for example, if your phone number is 547-9510, then information about connecting to you is stored in directory ..../5/4/7/9/5/1/0/

I don't know if any of this is true, but I have heard it from a person who has business knowing such things, and it sounds plausible to me. =^_^=

Reply if you know better. Just a tangential tidbit.

Re:Tangential Tidbit

[Fulcrum of Evil]

I have heard that the US phone companies store the telephone switching computers in carefully unmarked basements of various public buildings in the areas where they are performing switching.

This is someimes true; at&t leases space from buildings that doesn't show up on the directory and puts switching equipment there. Outside of the cities, they usually have there own buildings, called COs. Around here, they're typically 2 story brick buildings with no windows, but i have heard of them converting a townhouse.

I have also heard that these are typically UNIX systems, and- get this- your phone number represents a series of cd ("cd", as in "change directory") operations into a file tree.

Nope. It's a custom system written in a C variant.

Re:Tangential Tidbit

[Anonymous Coward]

no, they're mostly Plan 9 systems.

Re:Tangential Tidbit

[fliplap]

A common location for Qwest (formerly USWest here) is in highschools, not even the basements, but free standing structures. I didn't find out until long after i graduated that the thing everyone figured was an athletic equipment storage room was really full of switching equipment.

Re:Tangential Tidbit

[Bobb Sledd]

Oh, fuck you; it was funny and you know it!

Off topic indeed.

Re:Tangential Tidbit

[Kanasta]

Hrm. Unless the US phone companies work very differently from the rest of the world, I'd say no, that's absolute crap.

But then again...

A slashdot pundit reacts:

[Anonymous Coward]

"They should have used Linux !!!!1!"

yep

[nomadic]

Funny how everyone worries so much about preventing "evil hackers" from breaking in to systems remotely and causing chaos, and then some burglars just go ahead and steal the critical computers to produce the same (unintended?) results.

Right, they really need to leave those dashing young hackers alone, and instead pass laws outlawing theft. OH WAIT, THEY ALREADY HAVE.

Just so you all know, this story isn't as ironic as you think it is.

Their backup system should've been what got stolen

[Anonymous Coward]

Next time they install computers in a high crime area, they plan on installing a bunch of crusty 386's in expensive-looking rackmounts and they keep their real expensive equipment bolted to their office's ceiling disguised with cobwebs, snot rockets, spit wads. Only a redneck would steal the shit on the ceiling and the l33t thieves would think they just struck gold on some expensive Alpha rackmounts. :)

Wait a second...

[Anonymous Coward]

If you're stupid enough not to install a good alarm system...this has 3rd world written all over it.

Maybe the government workers simply walked into an empty office, you know, across the hall from where their office realy is.

The self-preservation society

[grahamlee]

They didn't then make off with $4M in gold bullion in "three fast cars, three Mini Coopers" did they?

<wander target=offtopic>
Reminds me of the story about a woman who was busy giving head to Jim Morrison. After finishing with him, she started to fellate Ray Manzarek. She was about to pleasure Mick Jagger when a Mini screamed through the wall in a shower of bricks and Michael Caine stepped out. He levelled his finger---and his gaze---at her coolly, then said:

"OI! You're only supposed to blow the bloody Doors off!"

Ahem.

Re:The self-preservation society

[ricklow]

Am I the only one who "gets" this?

What a day. I saw my first BMW Mini Cooper on the road today, then this. I'm going to have to pull out the old video and see if the bus is still hanging over the cliff.

Re:The self-preservation society

[grahamlee]

Certainly looks like you're the only person to have seen the film. Welcome to the s00p3r k-rad el337 world of being English. :-)

Another /. POS Story?

[stretch_jc]

Does this mean we're going to have a /. article on how someone hacked linux onto a traffic control system? :)

Re:Another /. POS Story?

[Ziviyr]

Only if they can manage a city-wide game of pong. :-)

No one Uses Traffic Lights in Chile or South A

[puto]

I do not see what the big deal is.

I am part Colombian and the rest from New Orleans(go figure). And although I live and grew up in the states I have lived three of my 32 years in South America. AND DRIVEN THROUGH EVERY COUNTRY!

No one uses stoplights. They are a like pretty christmas decorations. If it is read you do

1.the "rolling Stop",
2.haul ass and hope you don't die
3.slow down but go through(most popular)

However, the funniest thing with all the hurrah is. All latin American countries have huge police forces. Chile is no exception. But it makes you wonder if the theives can rob a government building, what about the quality of protection for the regular guy?

Re:No one Uses Traffic Lights in Chile or South A

[The Purple Wizard]

But it makes you wonder if the theives can rob a government building, what about the quality of protection for the regular guy?

Particularly when traffic is usually controlled by the police themselves. Or is this normal-police vs. traffic police politics?

Re:No one Uses Traffic Lights in Chile or South A

[Anonymous Coward]

You lie. I lived in Chile for years and they do use traffic lights. Most of the central american countries don't respect them though.

Re:No one Uses Traffic Lights in Chile or South A

[Anonymous Coward]

I am part Colombian and the rest from New Orleans(go figure). And although I live and grew up in the states I have lived three of my 32 years in South America. AND DRIVEN THROUGH EVERY COUNTRY!

Well, I'am Chilean and have lived here 23 of my 25 years, I think I'm at least as well informed as you are...

No one uses stoplights. They are a like pretty christmas decorations. If it is read you do 1.the "rolling Stop", 2.haul ass and hope you don't die 3.slow down but go through(most popular)

I just want to notice how courious it seems that if no one ever uses stoplights we would have chaos on one particular day, just because the controlling system was out. If no one uses stoplights then the controlling system is useless. Of course I know there is no contradiction, because I know you lie.

But it makes you wonder if the theives can rob a government building, what about the quality of protection for the regular guy?

Sorry to disapoint you, but It wasn't a government building. It was just a common house in a mixed residential/commercial neighborhood. It's very common here to turn former residences (big houses with lots of space) into offices for small/medium sized companies. The problem with this is that security is much more expensive than being in an office building, which probably explains why they made the mistake of saving money in security, by not spending in it.

Excuse my english, I hope it's compensated by my not being an ignorant in the matter I speak of.

GROAN

[Rhinobird]

GROAN...

Oh?

[dsb3]

... thieves in Chile caused traffic to grind to a halt when they decided to steal the computers ... Actually, I think they only caused traffic patterns to change when they actually stole the computers, not when they decided to as the original article would seem to indicate.

Nightmare!

[Anonymous Coward]

I recall when the traffic light grid in Vancouver went out completely, due to a lightning strike. My 13km commute that normally took 25 minutes turned into 3+ hours. It was insane.

A layer 1 problem

[buss_error]

I've been somewhat ignored when I keep bringing up physical security. I keep pointing out the problems and weak areas of our plant, and nothing is done. I point out the insecurity of our security, but proceedures don't change. I keep pointing out that if you can put your hands on the server, all the fancy firewalls and IDS systems in the world won't keep people out of the server, or keep the server up.

Despite this, all the cool technocrap that comes along gets sent to me and other for review, but the simple things like removing windows, chaning some alarm proceedures, and making entry into the server farm a two token process never get addressed. Instead, they keep pushing the flash stuff, and never do anything about the simple things.

I'll print out the story, and maybe, just possibilly, someone will see that physical security is slightly more important than we've been treating it to date.

Re:sophisticated?

[jedrek]

A klacz? A female horse?

I don't get it.

Bet you can't post that 5 times fast.

[Self-Important]

You heard me, Michael. I'm throwing down the alliteration gauntlet! :)

Habitat for Humanity

[BlueboyX]

I see the same thing in Habitat for Humanity in the US. People steal everything that isn't nailed down, no matter how ugly or worthless it might be. They love to take scafolding. Old, messed up sawhoarses? Gone by the next morning. It's crazy.

Re:Habitat for Humanity

[alcmena]

I'm sorry but if I was building houses for the poor, and someone stole the scafolding or my old sawhorse, I'd go home, tell them to build their own damn house, and never look back. Talk about pissing on the hand that feeds you.

Re:Habitat for Humanity

[armb]

The people stealing the stuff aren't necessarily the same people the homes are being built for, or at least not _all_ for the people the homes are being built for.
I'd be pissed off too, but it sucks even worse for the people who need the homes and aren't stealing stuff.

Clarifications...

[Leus]

I am chilean, and I'm kind of pissed by the comments of some guy who says he had drive in every country of Latinoamerica. In Chile, we respect every traffic light and traffic sign. The only signal that aren't very respected are the "no parking" signs, but nobody is perfect.

We have only two police forces: Carabineros de Chile, in charge of crime control, traffic, and order in general, and Investigaciones de Chile, our detectives. Carabineros are very competent in their jobs. A useful tip: if you come to Chile, NEVER try to bribe a police, except if you want to know some third world jail. Investigaciones is another story.

Oh, I was stucked in the traffic that day. Omigod.

In other news:

[Anonymous Coward]

# 2002-04-26 18:32:50 Vivendi Shareholder meeting hacked (articles,news) (rejected)

Apararently, news for nerds, stuff that matters includes stuff like some computering being stolen, but when Vivendi's proxy meeting online voting was hacked into, resulting a a do-over of votes which rejected management compensation increases, that's not news for nerds.

Re:Lesson about crypto? you fuckin fool

[Rakarra]

Ease up, he was just karma whoring.

Genius Idea

[Anonymous Coward]

...Head...

why i browse at -1

[vonsneerderhooten]

gimme the raw shit!!

-D

Guess it's obvious

[sharkey]

The traffic control PCs in Chile do not run Windows. If they did, the theft would have IMPROVED traffic flow. The question is, did they run Linux, BSD or *NIX?

Army of the Twelve Monkeys

[Leus]

The day before, a Puma (chilean lion) from the Zoo wandered in a neighbourhood. And the next day, the traffic goes nuts.

It was the Army of the Twelve Monkeys. Beware.

Re:You were only supposed to blow bloody doors off

[Anonymous Coward]

Whoever modded this as Offtopic is a fscking moron.....