Researcher: Hackers Can Jam Traffic By Manipulating Real-Time Traffic Data

An anonymous reader writes "Hackers can influence real-time traffic-flow-analysis systems to make people drive into traffic jams or to keep roads clear in areas where a lot of people use Google or Waze navigation systems, a German researcher demonstrated at BlackHat Europe. 'If, for example, an attacker drives a route and collects the data packets sent to Google, the hacker can replay them later with a modified cookie, platform key and time stamps, Jeske explained in his research paper (PDF). The attack can be intensified by sending several delayed transmissions with different cookies and platform keys, simulating multiple cars, Jeske added. An attacker does not have to drive a route to manipulate data, because Google also accepts data from phones without information from surrounding access points, thus enabling an attacker to influence traffic data worldwide, he added.' 'You don't need special equipment for this and you can manipulate traffic data worldwide,' Jeske said."

Comments

Nothing new

[xevioso]

There is nothing new about this. I once worked for a guy who bragged to me that as a kid in new Zealand, one of his first hacking exploits was to get into the Auckland traffic control systems and randomly change all the lights to red. He thought it was hilarious. He was an idiot.

Re:Nothing new

[pdabbadabba]

Better than changing them all to green, I suppose.

Re:Nothing new

[mlts]

AFAIK, lights have two sets of circuits in them to prevent a change to greens in more than one direction. If it does happen, the light switches to "oh crap" mode and starts flashing yellow or green.

Of course, I've seen a traffic signal flashing green before all ways, but that was only once.

Re:Nothing new

[mlts]

Correction: Not yellow/green for "oh crap", yellow or red. Of course, with how people drive, all greens would last about 2-3 seconds before the wreck that happens stops traffic completely for an indefinite time anyway.

Re:Nothing new

[PPH]

Of course he's an idiot. You need to change them green along your route.

Re:Nothing new

[MightyYar]

I'm always stunned by how many people cruise right through a disabled traffic light (that is, completely dark).

Re:Nothing new

[i kan reed]

Yep, any time I see a disabled light, I compulsively have to remind everyone I know that it means a all-way stop sign for the rest of the day. Kind of annoying of me, but I'd rather not see anyone dead(and I've seen some near misses when I was stopped at one before)

Re:Nothing new

[tlhIngan]

AFAIK, lights have two sets of circuits in them to prevent a change to greens in more than one direction. If it does happen, the light switches to "oh crap" mode and starts flashing yellow or green.

It's called a Conflict Monitor Unit and it's a required element for traffic lights per law. It basically does as you say - it looks at the outputs and if an invalid one crops up (two greens, say) then it immediately shuts down the traffic light and optionally returns a signal that could notify when this occurs.

They're a bit more complex than just detecting two greens - they can even monitor things like are the lights cycling properly (green-yellow-red), how long red/yellow/green lights have been on and if red wasn't actually on for some reason.

Re:Nothing new

[History's Coming To]

I've seen traffic lights in the UK fall back on flashing yellows - this was at around 2am in Edinburgh city centre, so traffic was moderate and it was mostly taxis (pubs and clubs kick out between midnight and 3am), it didn't seem to cause any problems at all. The driver commented that it actually seemed to be an improvement.

To cause a real gridlock doing this you have to assume everybody is using the same source of data, and only that one. Most traffic control systems also use mechanical detectors, car-spotting cameras and the like, you'd need to hack all of these systems to guarantee a gridlock.

Re:Nothing new

[Bengie]

A local light at our busiest intersection went green for all strait traffic. Once people realized what was going on, people naturally started to take turns, even letting the "turn" lanes take their turn even though they were stuck red. It was actually faster than the regular way of the lights working.

Re:Nothing new

[Cro Magnon]

The other day, there was a power outage that caused several traffic lights in my neighborhood to go dark while I was driving with my GF. I uttered a word and she said it was no big deal, just treat it as a 4-way stop, and I said "Yeah, but what about all the idiots who don't know that".

Re:Nothing new

[Bearhouse]

'Die Hard' reference, boys & girls...

Re:Nothing new

[Anonymous Coward]

duh, we have signs which indicates which of the roads has the right of way

Re:Nothing new

[i kan reed]

We being who? Not in my state/nation.

Re:Nothing new

[Anonymous Coward]

Die Hard? You mean Hackers, right? (Actually, I've never seen Die Hard; yeah, I know, I'm failing at pop culture right now.)

Re:Nothing new

[SpaceMonkies]

Now that I think about it, in some places, creating a traffic jam is not that hard. Here in Boston, traffic jams happen whenever it snows, whenever it rains, when the sky is clear and the sun is low in the sky (the traffic report calls it "solar glare"), when there's an accident (even in the opposite direction on an interstate highway: "curiosity delays"), whenever there's a Red Sox game or other event at Fenway Park, and when there's road construction. So based on the frequency of traffic jams and the diversity of causes, it does not seem to take much to cause a traffic jam around here. Rural Nebraska might be another story. Now, to use faked traffic data to *prevent* a traffic jam, that would be a truly noteworthy hack!

Re:Nothing new

[Richard Steiner]

"Go" at a stop light or stop sign means "go with caution" anyway, so the behavior of others doesn't matter as long as you drive defensively.

Re:Nothing new

[colinrichardday]

What about the original The Italian Job?

http://www.imdb.com/title/tt0064505/?ref_=sr_2

Re:Nothing new

[Runaway1956]

This ^

I always look both ways, to make sure that some fool isn't coming at me 50 mph. I've seen it happen, and there are videos on Youtube. The most recent video I watched, was a guy on a motorcycle running a red light. He went over the car, did a flip, and landed on his feet, looked around for a couple seconds wondering what happened, then collapsed on his broken leg.

Had that motorcycle been a two ton truck instead, the driver who pulled into the intersection without looking would probably have died.

Re:Nothing new

[ToddDTaft]

Signs indicating which road has right-of-way are common in Finland and some of the nearby countries. While it's been a few years since I've driven there, the last time I was in Helsinki, many traffic signals were turned off (as in dark) late at night or on weekends. They also had a number of intersections where there was no Stop or Yield/Give Way signs in any direction. Drivers were expected to know the rules of the road and who had right-of-way.

Re:Nothing new

[Immerman]

Indeed, there's a growing body of evidence that traffic lights and signs both actually decrease throughput while increasing the number and severity of accidents compared to leaving busy intersections completely unguided and letting drivers sort things out for themselves. Funny that. Who would have thought intelligent beings paying attention to their environment could do a better job of real-time traffic optimization than a bunch of signs being blindly obeyed.

Re:Nothing new

[k6mfw]

What about the original The Italian Job?

http://www.imdb.com/title/tt0064505/?ref_=sr_2

That is what I was thinking with Benny Hill as the professor (techie who also is compusive p0rn addict) responsible for corrupting the traffic system. Lead job man played by Michael Caine recruits this guy by arranging couple "fun" girls for him.

Re:Nothing new

[Anonymous Coward]

Indeed, there's a growing body of evidence that traffic lights and signs both actually decrease throughput while increasing the number and severity of accidents compared to leaving busy intersections completely unguided and letting drivers sort things out for themselves. Funny that. Who would have thought intelligent beings paying attention to their environment could do a better job of real-time traffic optimization than a bunch of signs being blindly obeyed.

Um.... No. This is ridiculously easy to disprove. Like, every time I've seen a light that's out, the backup is quite annoyingly long.

It's fairly obvious intuitively, too. If cars go one at a time, you have one car in the intersection at a time. If cars follow, the total throughput is higher.

(Perhaps the less accidents claim is true, but only because you've reduced the transactions per second.)

Re:Nothing new

[rjr162]

Exactly. There was an offset 4 way intersection that had stop signs instead of lights. They replaced it with lights and traffic definitely flowed better with the stop signs

Re:Nothing new

[Anonymous Coward]

After hurricane Ike hit Houston, I had the misfortune of getting stuck at a light which was perfectly functional, except for the fact that it hadn't changed for at least an hour (how long I sat in line watching it, and the line had already formed by then). The light was green in a single direction and red in all other directions, making treating it like a four way stop a very dangerous proposition.

Re:Nothing new

[Synerg1y]

A broken leg is almost a best case scenario in that kind of wreck. Motorcycle vs. car, car wins.

Re:Nothing new

[Immerman]

Actually transactions per second increases as well - the trick of course is that there's an adjustment period. If you take a bunch of people accustomed to being told exactly what to do it may take weeks before they adjust to actually paying attention and figuring things out for themselves on an ongoing basis.

Who said anything about cars going one at a time? - without any traffic signs you can pack that intersection just as full of cars as will fit - if for example someone is taking a left turn (wide for you non USers) all four incoming paths can also be making right turns simultaneously. And there's no reason the lane he's merging into can't be flowing as well. Even cross-traffic can keep flowing if there are suitable gaps to permit it. Chaotic? Yes, but also efficient so long as everyone is paying attention.

Re:Nothing new

[Synerg1y]

I can't help but think cause a big enough traffic jam... and one of those commuters may just show up on your doorstep one day, and being a hacker, he's probably going to be a lot bigger than you.

Re:Nothing new

[Anonymous Coward]

In Finland, if traffic lights are off or blinking yellow, they don't exist. You simply follow the road signs. If the speed limit is 50 km/h or over, you automatically have right-of-way; the intersecting roads are guaranteed to have signs that tell to keep out of the way. If the speed limit is less, you have to act like in normal intersections.

To handle the conflicts between the traffic lights and the road signs, there's a hierarchy. Police is at the top; they can override everything else. Traffic lights come next, then road signs and then road traffic law. So if traffic light tells you can go but a road sign tells to stop, the traffic light is correct and you don't have to stop. When the traffic light is off, you follow the road sign that tells you to stop.

Re:Nothing new

[Anonymous Coward]

That is what I was thinking with Benny Hill as the professor

But did they play yakkity sax while changing the lights?

Re:Nothing new

[Macman408]

I've still seen ones that are broken; for example a temporary stoplight strung up on wires while an intersection was under construction (and several lanes were closed, etc.). I forget exactly what the fault I witnessed was; it occurred to me that it was probably a wiring fault - like the workers hooked up the wires to the lights incorrectly, or there was a short between the wires, for example. It was something like the yellow and red were illuminated at the same time. The other lights on that signal were fine, it was just the one that was faulty.

I don't know if these units get separate sensor signals hooked up (eg you get one signal to provide power to the green light, and another signal back so that you can see if the green light is being powered), or if it's just checking that the output from the main controller box is producing good outputs. But there are very few ways of doing this (short of a video-based system) that would be completely foolproof. For example, if the workers hook the green output for one direction to the green light of a different direction, the sensor has no idea that the wrong light is lit. But hopefully they'd catch this pretty easily... ...On the other hand, given how often I see the sensor loops in the pavement hooked up wrong, I'm surprised I don't see this sort of thing more often. For example, a car will stop in the left turn lane in one direction, passing over about 4 sensor loops on the way. Then the left turn signal cycles for a different direction first, before the correct left turn signal goes green. It's obvious that at least one of the four loops is wired correctly, and at least one is wired wrong.

Re:Nothing new

[Will.Woodhull]

Good point.

This behavior suggests that there may be a problem with Google's driverless cars wrt safely handling intersections where the lights are out.

I believe Nevada is the only state where driverless cars are illegal. How are they handling it?

Re:Nothing new

[Will.Woodhull]

In a younger day, I used to drive taxi in Boston. Back then there was only one traffic jam per day, from 6:00 am until 3:am the following day. It rarely involved more than 70% of the city streets.

Now I live in Oregon where slow moving herds of elk sometimes cause traffic jams on the road to the beaches.

Re:Nothing new

[Immerman]

An interesting question. I would assume though that there are enough unmarked intersections in the country that the car knows how to handle them, and the improved situational awareness and reaction times would probably make it one of the safest "drivers" passing through, with one caveat: It provides no eye contact. When navigating disorganized traffic human drivers tend to fall back on non-verbal driver negotiations, a driverless car doesn't have that option.

Re:Nothing new

[russotto]

It's called a Conflict Monitor Unit and it's a required element for traffic lights per law. It basically does as you say - it looks at the outputs and if an invalid one crops up (two greens, say) then it immediately shuts down the traffic light and optionally returns a signal that could notify when this occurs.

Nevertheless, problems can creep up. I ran into one once where conflicting greens were given, but they were on different light heads. (this was the very complex intersection on Rt 202 in KIng of Prussia, PA). I've also seen them go directly from green to red with no yellow or a brief flash of yellow; I guess that's not really a "conflict" but it's disconcerting.

Re:Nothing new

[Will.Woodhull]

When I think about it, there is the more general category of courteous driving where I do not see how the driverless car could participate in the traffic flow in the same way that human drivers do. I have never thought about how often it happens, but probably more than once a day I am either giving someone the right of way because it is the courteous thing to do, such as letting them change lanes in front of me, or I am benefiting from their courtesy, such as maybe they are letting me take that prime parking space I have been waiting for, even though they legally have as much right to it, and are better in a better position to claim it.

I can see driverless cars negotiating with each other on this kind of thing, but I do not see how they can negotiate with human drivers, even if they could understand all the subtleties involved.

Maybe driverless cars would only work in Nevada, where there is usually ample space between people. Maybe driverless cars will increase road rage incidents, with the added twist that the shooter would be able to concentrate more on his aim.

Re:Nothing new

[__aaltlg1547]

Actually transactions per second increases as well - the trick of course is that there's an adjustment period. If you take a bunch of people accustomed to being told exactly what to do it may take weeks before they adjust to actually paying attention and figuring things out for themselves on an ongoing basis.

Who said anything about cars going one at a time? - without any traffic signs you can pack that intersection just as full of cars as will fit - if for example someone is taking a left turn (wide for you non USers) all four incoming paths can also be making right turns simultaneously. And there's no reason the lane he's merging into can't be flowing as well. Even cross-traffic can keep flowing if there are suitable gaps to permit it. Chaotic? Yes, but also efficient so long as everyone is paying attention.

The problem with it, and the reason that we have traffic signals, is that the success of an unregulated intersection relies on nobody making any mistakes in a complex and confusing situation.

Re:Nothing new

[Immerman]

And yet it works. Safer and faster than when things are neatly organized. So long as everybody is expecting a confusing situation and reacts accordingly everything works out. By and large people aren't idiots, they just *act* like idiots when they're on autopilot. Add just a touch of confusion and fear and all of a sudden they start paying attention to what they're doing, and the occasional idiot can muddle through since the others are paying attention. When two idiots encounter each other... well they deserve what they get. Better than some idiot T-boning a driver who was obeying all the rules and not really paying close attention to what was happening around them.

Re:Nothing new

[Immerman]

Agreed. Perhaps the driverless cars could default to "courteous mode", but it seems like it's often kind of subtle as to what exactly that would entail.

As for road rage - I sort of doubt the person in the driverless car would become enraged, after all while their trip still take time it no longer takes attention so they probably won't even notice the asshole that just cut them off - how often do you get truly annoyed by another car when traveling as a passenger? On the other hand if your virtual chauffeur just cut someone off and they look over to see you eating lunch, or doing anything that doesn't make it obvious you're not actually driving... Or heck, for that matter if you're the asshole who set your chauffer to "aggressive mode" and then proceed to take a nap you could end up the target of a lot of well-deserved (IMO) rage.

Hmm, you know, I could actually see cars doing inter-driver negotiation if they also involved an animatronic "driver" - say one of those cute mogwai-looking things designed to display and evoke an emotional response. Might actually make the cars more appealing to own as well since it would give the passengers a "person" to trust with the driving. Could even potentially help diffuse road rage - hard to stay pissed at some cute fuzzy thing with eyes as big as your fists that gives you a mournful "I'm so sorry, I didn't notice you were there" look as it passes, even if you know damn well it's probably the most situationally-aware driver on the road.

Re:Nothing new

[davester666]

That's crazy talk. Expecting drivers to know the rules of the road.

Next you'll be telling us there is some kind of "driver's test" that you need to pass before you are allowed to drive.

Re:Nothing new

[Mycroft_VIII]

Hopefully, I've nearly been rear-ended for stopping at a stop sign! one guy even yelled "what the f** did you stop for, there was no one coming and no cops". And I've seen lots of people run a light that's off.
    Do not think I'm knocking driving defensively, it's hands down the best bet. Just know that it's no guarantee, just the best odds.

Mycroft

Re:Nothing new

[ArsenneLupin]

I've also seen them go directly from green to red with no yellow or a brief flash of yellow; I guess that's not really a "conflict" but it's disconcerting.

That's just to ensure more revenue for the camera...

Re:Nothing new

[Anonymous Coward]

There is nothing new about this. I once worked for a guy who bragged to me that as a kid in new Zealand, one of his first hacking exploits was to get into the Auckland traffic control systems and randomly change all the lights to red. He thought it was hilarious. He was an idiot.

Keen to teach me?

not too surprising

[Trepidity]

The integrity of the crowdsourced traffic data depends entirely on trusting the client, in this case the Google-controlled Android software that sends back the data. If you figure out how to replay that, then you can pollute the data.

Re:not too surprising

[courteaudotbiz]

Anyways, traffic data is so unreliable, it is a joke. Actual traffic is often the exact opposite as the traffic data I get in my car. I don't know for the US, but in Canada, it is completely useless.

Re:not too surprising

[fuzzyfuzzyfungus]

Depending on how swiftly and convincingly the malicious client(s) can fake new identities, a 'crowdsourced' mechanism may boil down to 'trusting most of the clients, most of the time'. rather than 'trusting the client, full stop'.

That is a much messier case than actually being allowed to trust the client, but if you can constrain a malicious client's ability to spoof identities, you have a much better chance of being able to crowd out the bad data, especially with something like traffic(where, if the 15 users around you are moving at 55, your report of either 0 or 95 looks a little suspect, since vehicles are constrained by the behavior of nearby vehicles, unlike people answering a poll or something of that nature).

A telco operator, say, who gets the IMEI and SIM and possibly some RF triangulation, could probably nail down your ability to lie pretty hard, and severely limit the rate at which you could inject bad data. Google, if they have to trust an app(however invasive, the app still depends on the OS to tell it the truth so it can pass that on), has a more difficult problem.

Re:not too surprising

[Trepidity]

Yeah, if they could cross-reference the GPS-reported location with a rough bounding box from the ISP, that could greatly restrict the data spoofing. But I'm not sure how easy that is to do. Do ISPs even have a mechanism where they could report approximate locations of phones in real-time? Is it legal to do so? I know they can go through logs in response to law-enforcement requests, but not sure how real-time that ability is, or whether telecom laws restrict their ability to share the data.

Re:not too surprising

[SirGarlon]

A telco operator ... could probably nail down your ability to lie pretty hard .... Google, if they have to trust an app ... has a more difficult problem.

I agree completely. The *provenance* of data and the *procedures* used to collect, filter, and process it, critically affect its reliability. Yet even intelligent people seem not to get that. I say "how do you know the data is any good?" to friends and colleagues and they give me blank looks. But this is exactly what you need to know in order to decide whether you trust the conclusions based on that data.

My wife was working at a major university library when a Googler came by to dish about how awesome the future was going to be with Google aggregating and mashing up all kinds of information from all kinds of sources. When the librarians asked "how do you know which of those pieces of information are credible?", the Google executive had no answer and rushed out of the meeting on some hasty excuse.

I really think evaluating the trustworthiness of information needs a lot more attention both in the industry and the general public.

Re:not too surprising

[Anonymous Coward]

Ah, but in the DC area at least there are lots of Waze users so their data is actually pretty good. Oh course, that's a reflection of the abysmal traffic around here...

Re:not too surprising

[mlts]

What would be ideal is a combination of the above. The telco could provided a hashed/salted [1] value from existing ESN/IMEI numbers, then combined with a rough box handed from ISPs or the telco.

That way, one must have an IMEI in the area in order to affect data. Of course, someone can always have their device state that a jam is happening, but it can be "modded down" by other devices.

[1]: The salt changes every 5 minutes, so Google knows a number for just that long and no longer. Of course, things can be traced, but this would definitely lower any window of attac

Re:not too surprising

[locopuyo]

Google maps has been fairly accurate in Minneapolis the past few years.
It used to be terribly inaccurate and I would resort to using Yahoo maps for traffic.

Re:not too surprising

[Bearhouse]

Sorry for you. In Europe, it's pretty good...

Re:not too surprising

[Anonymous Coward]

Not necessarily. Croudsourced data has some metadata associated with it that can't be controlled by the attacker. For instance, in this case, the data should be coming from the cellular networks. The number of providers with cell towers nearby the road in question should be fairly small and you should be able to limit which source IPs are allowed to submit data. If you see that a source in China is submitting traffic data for a road in Maryland, chances are you shouldn't accept it.

Re:not too surprising

[nospam007]

"Anyways, traffic data is so unreliable, it is a joke. Actual traffic is often the exact opposite as the traffic data I get in my car. I don't know for the US, but in Canada, it is completely useless."

That must be because of people using this trick.

They simulate heavy traffic in their area so that people get routed around their home so that they can sleep without all that traffic noise.
It's the only use this has.

Re:not too surprising

[Anonymous Coward]

Do ISPs even have a mechanism where they could report approximate locations of phones in real-time?

If the ISP owns or has access to a cellular network you use, then yes, they can estimate your real-time location very accurately if you're in an area with good coverage, due to basic signals triangulation. In fact, location estimation is pretty much a prerequisite for the proper operation of the cellular network, otherwise they wouldn't know which tower(s) are the best to use when communicating with you.

Re:not too surprising

[Will.Woodhull]

Google has also been pretty good in Metro Portland area, Oregon. Same for my Garmin Nuvi.

I live near the I-5 bridge over the Columbia River, and when that drawbridge goes up, it sometimes affects roads miles north and south of the river, as drivers use city streets to get to the I-205 bridge.

Re:not too surprising

[jrumney]

It would eliminate people sitting in their bedrooms messing with traffic data in random places just for kicks. But if anyone was doing this for a reason (improve traffic flow on their own route, route traffic away from their house), they would be doing it locally, so you'd have to do a bit more than correlate cell towers with reported position.

So how would you tell the difference?

[Anonymous Coward]

The traffic is always jammed anyway.

You can jam traffic by DRIVING YOUR CAR.

Not a problem. . .

[smooth wombat]

if you don't bother to use these systems.

Considering the amount of time people spend checking to see which route is preferable, unless that route is at least 10 minutes shorter, there is no significant reason to alter your route.

The obvious exception being total gridlock, highway construction and the like.

It's like people who drive around looking for the cheapest gas not understanding they're burning fuel to save that 2 cents per gallon which negates their cost savings.

Re:Not a problem. . .

[Anonymous Coward]

It's like people who drive around looking for the cheapest gas not understanding they're burning fuel to save that 2 cents per gallon which negates their cost savings.

I use Gas Buddy to find the cheapest gas along my route. Oh wait, that's crowd source data and someone could be lying! Big deal. Seriously, this article is silly.

Re:Not a problem. . .

[MightyYar]

Considering the amount of time people spend checking to see which route is preferable, unless that route is at least 10 minutes shorter, there is no significant reason to alter your route.

Hmmm, I don't think that's right. As I walk to my car, I pull out my phone and see that the Waze widget (or Google Now if you prefer) says 19 minutes to home. Done. How did I waste time? Worst case, it has a longer-than-usual time and I turn on the navigation. What does that take, an extra 30 seconds at the outside?

Re:Not a problem. . .

[Anonymous Coward]

So you blindly follow navigation on a device partially engineered by an ad company. What are the odds that they are now or will eventually intentionally take you off the optimal route to view paid for advertising? A for profit corporation would be foolish not to sell such a service.

Re:Not a problem. . .

[MightyYar]

What are the odds that they are now or will eventually intentionally take you off the optimal route to view paid for advertising?

Pretty low, or I'd stop using the app!

I'm not sure I'd describe my use of the GPS as "blindly", either. The other day it tried to get me to make an illegal turn. Damned if I didn't survive it by, you know, ignoring the bad directions.

Re:Not a problem. . .

[Anonymous Coward]

if you don't bother to use these systems.

Considering the amount of time people spend checking to see which route is preferable, unless that route is at least 10 minutes shorter, there is no significant reason to alter your route.

The obvious exception being total gridlock, highway construction and the like.

It's like people who drive around looking for the cheapest gas not understanding they're burning fuel to save that 2 cents per gallon which negates their cost savings.

The attack can create traffic jams, which means they can affect you whether you use the system or not.

Re:Not a problem. . .

[IndustrialComplex]

I check the routes to see if traffic conditions are changing. For most of my commute, the condition options are this:

1. No delay
2. 2-5 minute delay
3. 40 minute delay.

You may wonder, 'so what? Don't reroute on the 2-5 minute delays, like I said'. However the problem isn't that it is a 2-5 minute delay which persists for 30 minutes, it's a 2-5 minute delay which persists for 5 minutes before turning into the 40 minute delay.

On my route, if there is any sort of traffic condition, it quickly escalates into a major traffic condition (for my particular stretch). So I behave proactively, and if I'm not literally in the 2-5 minute delay at that exact moment, I have to re-route or else I'll catch the 40 minute delay that is just about to form.

Re:Not a problem. . .

[Anonymous Coward]

Agreed. I'm a dedicated Waze user and while I have watched it explode over the past year it is not a utility and is not depended upon for the vast majority of people.

Go ahead and fudge the data sent. The one in 500 people (optimistic estimate) that are using google maps or Waze will think "oh shit, reroute" or the program will do it for them. The vast majority of people will keep driving until their eyes see a traffic jam. Then they say "oh shit, reroute".

This is tabloidish and silly. It's an interesting idea deserving of a thesis paper or a talk at a conference, and a security hole to be sure...but it is not a real world threat.

At least not until we have vehicles that drive themselves, or everyone on the planet has a smartphone and is relying on it to that extent.

Re:Not a problem. . .

[Anonymous Coward]

I find your lack of faith disturbing...

Re:Not a problem. . .

[Anonymous Coward]

I actually have encountered people lying on gasbuddy. I drove 3 miles out of the way to find an 18 cent increase. If you were the Manager of a gas station and wanted to bring in more customers to sell overpriced pop and junk food to, why not tell a little white lie?

Traffic Jams?

[ArcadeMan]

Barf: The minute we move in they're gonna spot us on their radar.
Lone Starr: Nuh-uh.
Barf: Uh-huh.
Lone Starr: Nuh-uh.
Barf: Uh-uh.
Lone Starr: Nuh-uh. Not if we jam it.
Barf: Aha! You're right.
Lone Starr: Down scope.
Barf: Down scope.
[puts down a periscope and targets the Spaceball 1's radar dish]
Barf: Radar about to be "jammed."
[then, a huge jar of "jam" smashes into the dish]

Re:Traffic Jams?

[fl!ptop]

[then, a huge jar of "jam" smashes into the dish]

Somehow, it's not as funny if you have to explain it.

Re:Traffic Jams?

[Anonymous Coward]

Have you never seen the movie or are you just being dense?

Great for creating jams

[Anonymous Coward]

Not so useful for creating unjammed areas. If you mark route A as jammed in order to get people to take route B, and route B can't handle that, it's going to get just as jammed as route A, leading people to take route A again.

Apple Data

[fermion]

As Apple says it collects data from iPhone, I wonder how easy it would be to simulate a lot of iphones in a particular area. As it is I find the Apple traffic to be a bit more reliable than Google. I remember two years ago being stuck in traffic jam that Google had told me was perfectly fine, even when I was stuck. Neither service is as reliable as my local traffic monitoring service that has supplements all data with cameras in addition to test cars listing drive times between points of travel.

Re:Apple Data

[kannibal_klown]

Anything is better than Sirius. That traffic system is horrible. It will often show me "Green" for a highway even though it's bumper-to-bumper for miles.

In all of those situations, Google had already refreshed as the red/black criss-cross "DO NOT GO HERE" line

Most traffic is not guided by Google or Waze

[erice]

So the impact on traffic conditions is likely to be negligible. The best you can do is annoy those who do you Google Maps or Waze by guiding them into the traffic jams they are trying to avoid. But considering the unreliability and time variability of traffic reporting the victims probably won't even notice that they've been fooled.

Perhaps in a future of self-driving cars that always follow Internet sourced navigation this will be more important. I think there is for navigation vendors to tighten their security before much of anyone cares.

Manipulate Traffic, You Say?

[Anonymous Coward]

What is this, The Italian Job?

Nice things

[jklovanc]

This is another example why we can't have nice things. Some malicious person will find a way to screw it up for no better reason than fun.

It worked!

[AndyKron]

I want to make a traffic jam in India. Look! It worked!!!

Won't make a difference.

[MaWeiTao]

I can't imagine this would affect many people. Most people stuck in traffic don't have a choice, they're there because it's a part of their daily commute. I check traffic maps on a daily basis, but it's most just to confirm that, yes, it's as bad as it is every other day. I then proceed to go local.

So the rarer instances where it's handy is if conditions are particularly severe or if there's a jam somewhere you normally wouldn't encounter one. However, even then, there aren't always viable alternatives. Take the New York City area. Unless you can circumvent the region altogether there's no viable alternative, it's all varying degrees of bad.

Not that urban planners and traffic engineers need the help. Some of the decisions they make leave me wondering if they're mentally disabled or trolling the driving public. A couple of the major avenues across my city have light cycles that pretty much guarantee you're going to be stuck at every red if you're driving at or close to the speed limit. Secondary side streets are given far too much priority. Hackers could only improve things.

Re:Won't make a difference.

[Anonymous Coward]

I can't imagine this would affect many people. Most people stuck in traffic don't have a choice, they're there because it's a part of their daily commute. I check traffic maps on a daily basis, but it's most just to confirm that, yes, it's as bad as it is every other day. I then proceed to go local.

I've always tried to have more than one route for my commute. Currently I have several, some overlapping, so if there's traffic in X I can take first leg of X then switch off to Y or completely skip it by going Z. While I believe there are areas where you have only one choice, most people do have options on where they're stuck in traffic even if they have no options on when.

Re:Won't make a difference.

[Anonymous Coward]

They assume you're going to speed... you didn't figure that out by now?

and...

[cstream_chris]

this is why we can't have nice things...

Yo Dawg

[Anonymous Coward]

Can you hook me up with a script or Android app to make this easy.

Traffic has me on the edge of taking a hostage.

Re:Yo Dawg

[Black Parrot]

Can you hook me up with a script or Android app to make this easy.

Most people here prefer to get hooked up with a person. Scriptsex is next door.

Re:Yo Dawg

[Kaenneth]

"Traffic has me on the edge of taking a hostage."

That way you can use the Carpool lanes.

The paper has a solution

[Anonymous Coward]

He derives a zero-knowledge proof algorithm that solves the problem. Move along, nothing to see here.

Self Driving Cars.

[Anonymous Coward]

Imagine how much fun a hacker could have with self driving cars and unfinished bridges...
This is why the relevant law of Muphy's Law of Computing exists:
"To screw up is human, to screw up royally requires a computer"

Technically interesting, practically useless

[dfm3]

While I found the actual paper to be interesting (the researchers basically describe how they used a packet sniffer to capture data being sent to Google, then examined and reverse engineered the data to figure out exactly what was in the packets and what they could do with it), the idea of actually influencing real world trafic conditions using this method is a bit silly. First, only a very small percentage of drivers actually use live traffic data to make navigation decisions on the fly. Of those, some percentage either won't have an alternate route to choose from, or will simply stick to their route and tough it out. At best, you'd only trick a small percentage of drivers into avoiding a stretch of highway. As for "creating traffic jams", you'd have much better luck if you simply dropped a couple panes of glass off of the back of a truck or did something equally nefarious to cause an accident.

Re:Technically interesting, practically useless

[Anonymous Coward]

The point is that it is automated. At some point, someone is going to take it upon themselves to discover as many vulnerabilities of this kind as they can find and then unleash them all in one day and grind everything in the civilized world to a halt on that day. Even this seemingly benign exploit might actually kill someone if you consider the impact on ambulances carrying patients who need to get to the hospital right away.

In other news...

[Black Parrot]

assholes can use computers to aid and abet their assholery.

Re:In other news...

[Anonymous Coward]

Dark Helmet: I knew it, I'm surrounded by assholes.
Dark Helmet: KEEP FIRING, ASSHOLES!

Live free or break hard

[Anonymous Coward]

I seem to remember a lame movie made on this subject a few years back.

We sell traffic data...

[Anonymous Coward]

One of the things my employer does is embed GPS units into *fleets* of trucks that are connected to the trucks speedometers and other systems. This is in partnership with the truck manufacturers and clients (think of multiple fleets of 500 to 10,000 trucks and vans constantly tracked by corporate overlords for multiple business reasons). As a result, we have actual speed and positions from multiple clients at any given location in the markets we service aggregated/anonymized/compressed. We sell access to our traffic data to other companies as well as buy more aggregated data. Google, Apple, and others also buy our data from the aggregators, and we're not alone in this market with data to sell or buy. You'd need to pollute our proprietary data collection streams as well as the other streams which estimate based solely on GPS (much less reliable than measuring speeds from actual speedometers).

Depends on where you live

[SirGarlon]

Now that I think about it, in some places, creating a traffic jam is not that hard. Here in Boston, traffic jams happen whenever it snows, whenever it rains, when the sky is clear and the sun is low in the sky (the traffic report calls it "solar glare"), when there's an accident (even in the opposite direction on an interstate highway: "curiosity delays"), whenever there's a Red Sox game or other event at Fenway Park, and when there's road construction. So based on the frequency of traffic jams and the diversity of causes, it does not seem to take much to cause a traffic jam around here. Rural Nebraska might be another story.

Now, to use faked traffic data to *prevent* a traffic jam, that would be a truly noteworthy hack!

Who needs hackers?

[Anonymous Coward]

All you need is a cop in a crossroad and you got one hell of a traffic jam.

They can also take control of your actual cars

[WillAffleckUW]

Self-directed cars are nature's way of saying "Let the hacker crash me for fun".

Oh, but we're not supposed to talk about that fact.

Colorblind Fairness Act of 1976

[Anonymous Coward]

It's about time your city start following federal law and install talking robotic heads at all intersections.

What dicks

[nhat11]

That's all I want to say, lol

easy to defend against it

[Anonymous Coward]

All google software needs to do is perform some statistics, and bad data can be weeded out. Probably not worth the effort, but should hacking become a problem they totally can... Or check sender device against their database, after all, google is like God, they know everything

Re:way to go mods! +1 on an AC!

[Anonymous Coward]

I didn't care about one single thing you typed. I know you think you contribute but you don't. At least the other guy was trying to make a joke, whereas you're just trying to be The Most Interesting Man WIth Asperger's.