Researcher: Hackers Can Jam Traffic By Manipulating Real-Time Traffic Data

An anonymous reader writes "Hackers can influence real-time traffic-flow-analysis systems to make people drive into traffic jams or to keep roads clear in areas where a lot of people use Google or Waze navigation systems, a German researcher demonstrated at BlackHat Europe. 'If, for example, an attacker drives a route and collects the data packets sent to Google, the hacker can replay them later with a modified cookie, platform key and time stamps, Jeske explained in his research paper (PDF). The attack can be intensified by sending several delayed transmissions with different cookies and platform keys, simulating multiple cars, Jeske added. An attacker does not have to drive a route to manipulate data, because Google also accepts data from phones without information from surrounding access points, thus enabling an attacker to influence traffic data worldwide, he added.' 'You don't need special equipment for this and you can manipulate traffic data worldwide,' Jeske said."

Comments

Nothing new

[xevioso]

There is nothing new about this. I once worked for a guy who bragged to me that as a kid in new Zealand, one of his first hacking exploits was to get into the Auckland traffic control systems and randomly change all the lights to red. He thought it was hilarious. He was an idiot.

Re:Nothing new

[pdabbadabba]

Better than changing them all to green, I suppose.

Re:Nothing new

[mlts]

AFAIK, lights have two sets of circuits in them to prevent a change to greens in more than one direction. If it does happen, the light switches to "oh crap" mode and starts flashing yellow or green.

Of course, I've seen a traffic signal flashing green before all ways, but that was only once.

Re:Nothing new

[tlhIngan]

AFAIK, lights have two sets of circuits in them to prevent a change to greens in more than one direction. If it does happen, the light switches to "oh crap" mode and starts flashing yellow or green.

It's called a Conflict Monitor Unit and it's a required element for traffic lights per law. It basically does as you say - it looks at the outputs and if an invalid one crops up (two greens, say) then it immediately shuts down the traffic light and optionally returns a signal that could notify when this occurs.

They're a bit more complex than just detecting two greens - they can even monitor things like are the lights cycling properly (green-yellow-red), how long red/yellow/green lights have been on and if red wasn't actually on for some reason.

not too surprising

[Trepidity]

The integrity of the crowdsourced traffic data depends entirely on trusting the client, in this case the Google-controlled Android software that sends back the data. If you figure out how to replay that, then you can pollute the data.

Not a problem. . .

[smooth wombat]

if you don't bother to use these systems.

Considering the amount of time people spend checking to see which route is preferable, unless that route is at least 10 minutes shorter, there is no significant reason to alter your route.

The obvious exception being total gridlock, highway construction and the like.

It's like people who drive around looking for the cheapest gas not understanding they're burning fuel to save that 2 cents per gallon which negates their cost savings.

Nice things

[jklovanc]

This is another example why we can't have nice things. Some malicious person will find a way to screw it up for no better reason than fun.

It worked!

[AndyKron]

I want to make a traffic jam in India. Look! It worked!!!

Technically interesting, practically useless

[dfm3]

While I found the actual paper to be interesting (the researchers basically describe how they used a packet sniffer to capture data being sent to Google, then examined and reverse engineered the data to figure out exactly what was in the packets and what they could do with it), the idea of actually influencing real world trafic conditions using this method is a bit silly. First, only a very small percentage of drivers actually use live traffic data to make navigation decisions on the fly. Of those, some percentage either won't have an alternate route to choose from, or will simply stick to their route and tough it out. At best, you'd only trick a small percentage of drivers into avoiding a stretch of highway. As for "creating traffic jams", you'd have much better luck if you simply dropped a couple panes of glass off of the back of a truck or did something equally nefarious to cause an accident.

In other news...

[Black Parrot]

assholes can use computers to aid and abet their assholery.