PCs Pilfered, Paralyzing Populace

Heywood Yabuzof writes "According to this Wired story, thieves in Chile caused traffic to grind to a halt when they decided to steal the computers (15 PCs and 2 servers) that control the traffic lights in Santiago. Funny how everyone worries so much about preventing "evil hackers" from breaking in to systems remotely and causing chaos, and then some burglars just go ahead and steal the critical computers to produce the same (unintended?) results."

Comments

It's a good thing...

[Sivar]

It's a good thing they had the servers all in one place, else they may have inconvenience the thieves.

Re:It's a good thing...

[BlueUnderwear]

Makes you wonder why they needed computers to control the traffic lights - surely that could be done with some 555 timers

Read the article. The traffic light were able to operate autonomously using builtin timers... What the computer did was ensure synchonization between one crossroads and the next. To make sure that when you get a green light, the lights are also green in the next few crossroads. Timers tend to drift, and hence an centralized system is necessary to keep things in sync.

And presumably the computer system also changes the timings to adapt to the differences in traffic patterns throughout the day (giving longer green periods to those directions where the most traffic is at that time). Nowadays, most city road networks operate very close to their capacity, and even little details such as the exact timing of traffic light are important to keep matters fluid.

Re:It's a good thing...

[BlueUnderwear]

I find it hard to believe that most city streets operate at anything even approaching 100% capacity. It's probably more like 60-70%.

Considering the average over the whole day, and over all roads and streets in the network, it's probably even much lower than that. What's relevant here is peak usage: how overloaded are the main arteries at rush hour?

You've gotta love...

[goneaway]

that they just hung out for a while and had some snacks. A LAN party before the heist perhaps?

Re:You've gotta love...

[gnovos]

"Ned, where did all the servers go!?!?"

"Don't worry, boss, they were all transfered over to the IBM e-server!"

"Oooooh, excellent! Ah, where exactly IS the e-server?"

"Oh, that got stolen."

Physical Security

[dirvish]

Physical security is just as important as network security. If the admin of these servers and computers had safegaurded their physical security there wouldn't have been a problem. Hackers are just one threat...vandals must also be considered. That is why physical security is one of the 10 sections covered in the CISSP certification exam (the premeire information security certification).

Re:Physical Security

[Shiny Metal S.]

Other very common mistake is leaving a floppy drive set up as the first booting device, or not having password protected BIOS settings.

With e.g. Debian boot floppies or any other mini Linux and mini Unix distribution you can just insert a floppy, hit reset and wait a while until you got r00t and do whatever you want (like change the real root password in /etc/shadow on the main partition to whatever you want).

I'm talking about it, because it's much easier than trying to write a remote exploit, much easier than writing a local exploit and much easier than actually stealing the whole hardware. It's usually also much easier than social engineering.

It wouldn't be even hard to make a floppy which automatically do something to the system (like adding new users and adding them to every group, changing passwords, reading encrypted passwords for later cracking, leaving backdoors, etc.). When you have such a floppy, you only need few seconds to insert it, hit reset, come back after a minute when everything is done, take your floppy and hit reset again.

You can even prepare this floppy in a way, that when everything is done, your files from the floppy are deleted and "shutdown -r" is run. That way even when someone enters the room before you, he'll only find a normally working system with empty floppy in the drive. The chances are that no one will even go there to see what's wrong if the server was down for a minute and now it's OK, especially if it's a lunch brake or something.

Very dangerous and very easy if you can only go near a computer, and if it can boot the system from the floppy. And I've already seen servers without BIOS passwords and those set to boot in order of floppy,cd,hdd. It's very important and often forgotten issue, it's somewhere between physical and non-physical (logical?) security.

Re:Physical Security

[mark-t]

Physical security is just as important as network security.

Although the point you've made here is essentially correct, physical security is actually _more_ important than network security, as without it, any and all additional security features are rendered null and void. Period.

Re:Physical Security

[GeorgieBoy]

With e.g. Debian boot floppies [debian.org] or any other mini Linux [uga.edu] and mini Unix [cotse.com] distribution you can just insert a floppy, hit reset and wait a while until you got r00t and do whatever you want (like change the real root password in /etc/shadow on the main partition to whatever you want).

It's really even easier than that, in fact, without a floppy, you can just tell the bootloader (e.g. lilo) to boot with options like "linux init=/bin/sh" or something similar, and after the kernel loads you'll just get a shell.

This is a problem all over the world

[jedrek]

Sitting behind our screens, we sometimes forget that the entire network is actually a physical entity. We remind ourselves of it when a backhoe rips through our ISP's OC3, or when we're out of cable and can't connect our network card to our router or modem.

Well, at least I do.

Anyway, here in Poland there's a problem with people stealing cable. Not cable-tv, but telecommunication cables. Whole neighborhoods here in Warsaw have been cut off from telephony because of stolen inter-exchange cable. Railroad lights have been known to fail because of stolen equipment (this happens way too often). It's twice as bad in Russia, trust me.

Actually, at times, it seems like everything that isn't screwed or welded down in this country (this region) will get stolen. Ah... sucks pretty bad.

Hahah

[autopr0n]

Not only did they steal the computers, they stole the alarm system that was supposed to protect them.

The worlds most sarcastic criminals, is what we've got here :P

I hope they had a good backup strategy

[cygnusx]

The real test for the admins at the end of the day will be -- how fast can they bring the systems back online?

Honestly, how different is this (apart from being more spectacular) from a power spike frying your servers (maybe because of a UPS problem)?

rofl

[rtscts]

Summary: inside job.

It's funny shit though:

But while stealing the goods, valued at US$90,000, they took their time. According to police reports, these peculiar robbers smoked some cigarettes, ate a snack, and drank a few cups of joe, taking it easy before leaving the scene of the crime

And my favourite:

After they loaded the computers into a van, the alarm was also taken

ROFL. 10/10 for style. Someone buy these clowns a beer (before they earn themselves a darwin award).

3 AM is too late for alliteration

[Roosey]

Pernicious people plundered PCs providing parkway profluence producing paralyzing predicaments?

Preposterous! :]

The worst...

[Anonymous Coward]

I'm sure this caused some of the worst crashes in the history of computing

h4ck th3 pl4n37!!!

[IntelliTubbie]

Update: although the traffic jam caused a significant delay for police, the thieves were later arrested at Grand Central Station after hacking into a Gibson mainframe from a bank of public telephones. The perpetrators, identified as Angelina "Acid Burn" Jolie and Jonny Lee "Crash Override" Miller, were later released and have since gone on to make better movies. Sandra Bullock was unavailable for comment.

Cheers,
IT

Happens with phone copper too

[bobobobo]

Similarly, another problem in 3rd world countries that are trying to develop any kind of widespread phone infrastructure, is that the actual copper itself is pulled out of the ground and stolen! This is one of the reasons India for example, is moving forward with satellite technology instead, as this practice tends to be commonplace and fairly frustrating.

It would have been funny if...

[l810c]

they were caught in the ensuing traffic jam.

Keep an eye out...

[quintessent]

...for PCs on eBay that come pre-loaded with traffic controlling software.

Tangential Tidbit

[LionKimbro]

I have heard that the US phone companies store the telephone switching computers in carefully unmarked basements of various public buildings in the areas where they are performing switching.

I have also heard that these are typically UNIX systems, and- get this- your phone number represents a series of cd ("cd", as in "change directory") operations into a file tree.

So for example, if your phone number is 547-9510, then information about connecting to you is stored in directory ..../5/4/7/9/5/1/0/

I don't know if any of this is true, but I have heard it from a person who has business knowing such things, and it sounds plausible to me. =^_^=

Reply if you know better. Just a tangential tidbit.

Re:i hope for their sake

[herko_cl]

Living in Santiago, I can testify they luckily did. Using a backup server, they were able to restore traffic to normal within 6 hours.
I'd like to clarify a few points, though. Our traffic lights are fully autonomous, but the stolen computers analyze traffic flow via cameras at critical junctions and synchronize the lights from one crossroads to the next.
This works so well that, even when traffic is extremely heavy, cars keep moving along. On most mornings and evenings, if you are going "with the flow" you can drive for miles without getting a red light.

On the subject of security: apart from stealing the alarm system (we thought that was funny, too), they removed heavy cast-iron bars from a window to enter this office. To do this, they had to break down part of the wall. This was obviously a well-planned, well executed heist.

No one Uses Traffic Lights in Chile or South A

[puto]

I do not see what the big deal is.

I am part Colombian and the rest from New Orleans(go figure). And although I live and grew up in the states I have lived three of my 32 years in South America. AND DRIVEN THROUGH EVERY COUNTRY!

No one uses stoplights. They are a like pretty christmas decorations. If it is read you do

1.the "rolling Stop",
2.haul ass and hope you don't die
3.slow down but go through(most popular)

However, the funniest thing with all the hurrah is. All latin American countries have huge police forces. Chile is no exception. But it makes you wonder if the theives can rob a government building, what about the quality of protection for the regular guy?

Habitat for Humanity

[BlueboyX]

I see the same thing in Habitat for Humanity in the US. People steal everything that isn't nailed down, no matter how ugly or worthless it might be. They love to take scafolding. Old, messed up sawhoarses? Gone by the next morning. It's crazy.