Tapping Data From Radio-Controlled Bus Stop Displays

jones_supa writes "A couple of weeks ago hacker Oona Räisänen told about finding a 16 kbps data stream on FM broadcast frequencies, and her suspicion was that it's being used by the public transit display system in Helsinki, Finland. Now it's time to find out the truth. She had the opportunity to observe a display stuck in the middle of its bootup sequence, displaying a version string. This revealed that the system is called IBus and it's made by the Swedish company Axentia. Sure enough, their website talks about DARC and how it requires no return channel, making it possible to use battery-powered displays in remote areas. Other than that, there are no public specs for the proprietary protocol. So she implemented the five-layer DARC protocol stack in Perl and was left with a stream of fully error-corrected packets on top of Layer 5, separated into hundreds of subchannels. Some of these contained human-readable strings with names of terminal stations. They seemed like an easy starting point for reverse engineering..."

Comments

wow, thanks Timothy

[Anonymous Coward]

An interesting article on Slashdot... that's amazing... it's like ARM chips running windows... well, ok... we thought that was going to be amazing... :P

Re:wow, thanks Timothy

[Anonymous Coward]

hmm.. can the displays be set to display another text instead of the regular schedule?

like.. let's say a zombie invasion alert :p

Re:wow, thanks Timothy

[Anonymous Coward]

Is it you, Jen-Hsun Huang?

Re:wow, thanks Timothy

[davester666]

Well, she is about to be arrested for releasing technology that can help terrorists with an attack.

Re: wow, thanks Timothy

[BESTouff]

She's in Europe. Have no fear (for her).

Timmay!

[Anonymous Coward]

Timmay... And the Lords of the Underworld!

While reading ...

[Anonymous Coward]

did anyone else think of the hokey Hollywood hacker who gets on their MacBook and "hacks" the system to turn red light green, change bus schedules, etc ...

Now, Oona is cute, a hacker and is into Kung Fu.

Should she be a Bond villain or one of Bond's squeezes?

Re:While reading ...

[gl4ss]

Should she be a Bond villain or one of Bond's squeezes?

why not both? that maximizes the screen time(watch the movies and you'll agree).

Re:While reading ...

[PPH]

Now, Oona is cute, a hacker and is into Kung Fu.

[Sigh] And all US culture can produce is the Kardashians.

The roots of hacking

[Anonymous Coward]

This, my friends, is true hacking. While this sort of stuff has become less common over the years, it is people such as this that provide real value to the community in terms of improving security for the masses. I wish that I had more time (and equipment...and hand't forgotten so many of my skills) as there are a few projects like this that I'd like to dig into. For instance, I have a home security/automation system out at my farm. I am fully cognizant that the security provided by it is a joke, as any insider at the alarm company could turn off my alarm without my known, but that's beside the point. What I'm really interested in is the link between the alarm company and my system. I log into their super secure website (tongue in cheek here) and issue a command either from my computer or phone. The alarm company sends that command to my system via the local GSM network (2g or 3g). There's no documentation on this portion of the system. Is it secure? Encrypted? Could it be readily spoofed? Even if it is encrypted, is there sufficient proof of authority on the system issuing commands? Anyway, love this stuff!

Re:The roots of hacking

[AK Marc]

It's all security through obscurity. Everything is security through obscurity (for differing definitions of obscurity). The lock on my house works because nobody "knows" the key, other than me, and I don't even know it because it's a physical token I don't understand. But if someone took an impression of the key, they they could gain access because the obscurity was lifted. Encryption works because your keys are obscured/hidden. So yes, likely your security system is grossly insecure, but won't be hacked. Why not? Because if they defeated it 100%, they'd have access to your farm. *yawn*. Some cow tippers might pay $10 to disable it for some mischief, but without some real money behind it, nobody is going to target it.

As I have said many times; "Perfect security is impossible, you just need to be more secure than the next most attractive target." Corollaries include making yourself less of a target (or psychotically, make others bigger targets).

That's not to say tinkering isn't interesting, but don't confuse "encryption" or "difficulty" with "security".

Re:The roots of hacking

[diamondmagic]

You're blurring the definition of security and obscurity, which is already well defined. Obscurity refers to the logic of the system. Your system must be secure even if an attacker knows everything about how it works, because there is a separate part, the secret key, that is completely arbitrary and assumed to be kept secure. A key is only secret, arbitrary data; a cipher is only well-known logic; security though obscurity by definition means mixing your secret data with your public logic, a bad idea.

The biggest purpose of cryptography is to take big secrets (plaintext) and make them small secrets (private or secret keys). How it goes about doing that shouldn't be obscure.

A home invader shouldn't be able to break into my house even if they know everything about my lock and door, what matters is that they don't have the key (which has no mechanical components - it's not part of the system until I want to unlock the door).

Re:The roots of hacking

[AK Marc]

A home invader shouldn't be able to break into my house even if they know everything about my lock and door, what matters is that they don't have the key (which has no mechanical components - it's not part of the system until I want to unlock the door).

But your key is nothing but obscurity. I had a car. It was 30 years old (a classic). The keys I had for it were wearing out, and became more tempermental. So I looked for a way to get original keys cut. I called the dealer, and they said "no, can't be done" (yes, they knew I was a legitimate owner of the car). So I ended up emailing a picture of the key to an Australian company, who cut a key to the factory spec, not a duplicate of the ancient, worn keys. Worked much better. Soon after, my glove-box latch broke. I took the pieces to the dealer and asked for a replacement lock-ring (as it wasn't staying on, and there's a part to hold it together). They couldn't get the part of the part, but could order a whole new assembly. I ordered it. When it came in, it came with 4 keys to it. The dealer had sent in my VIN to the factory. The factory had records of my key-pattern, and keyed the lock to match my doors, and included extra keys.

So, someone wanting to break in could look at my VIN, order a replacement glove-box latch with that VIN, then pick up the part (and 4 keys to my car). That's security through obscurity because the knowledge of the key is the only thing keeping it safe. I could also call up the Australian place and read off a string of numbers 1-3-2-3-3-2-1 (or whatever they were) and they'd send me a working key. They have my key record on file there as well.

So what's the security of the key, if a picture of your key can get it duplicated, or using your VIN can as well? Is obscurity involved in that process? Manufacturers keep the key patterns of most cars these days.

Re:The roots of hacking

[Anonymous Coward]

I think you must be one of the most obtuse posters on Slashdot.

Over and over I see these arguments based purely over stupid definition games and the wilful misinterpretation of what other people say, and every time I see such an argument and I look up at the poster causing the problem, sure enough it's AK Marc. You've contributed nothing useful to any discussion that you've ever barged in on. You are merely an annoyance that other people need to learn, one by one, to stop responding to.

Re:The roots of hacking

[AK Marc]

So I'm always right, and always of a different opinion than you, so you find me annoying, but never can argue any specific points. Oh, and an A/C. Got it. Go ask momma to send more cheetos down, I think you are getting withdrawal again.

Re:The roots of hacking

[diamondmagic]

If someone is using your VIN to make keys after, then the key isn't an arbitrary secret.

If someone has a picture of your key, then they know your secret outright, even if it is arbitrary.

What you describe is no better than me copying your passwords off a Post-It note you left on your monitor.

A proper key is not "obscurity" -- it is secret! No, those are not the same things, a key has no logic to obscure. This discussion is no longer at the point were we can employ layman's definitions and continue to talk sense.

Re:The roots of hacking

[AK Marc]

The process of using a VIN to obtain your "Secret" is obscurity. Your secret isn't. It's stored openly at the manufacturer. It's available for $100 and a 1-week wait. How is that "secret"?

Obscurity: the state of being unknown, inconspicuous, or unimportant. Your "secret" is a "secret" because it's unknown, inconspicuous, or unimportant. What was the complaint again?

See, this is kinda what I meant

[50000BTU_barbecue]

when I said you don't need an oscilloscope anymore. Probably a SDR receiver that goes to a PC. What possible interest is there in looking at the raw RF at the antenna, which you won't see with an oscilloscope anyways (because I don't know any scopes with nV/cm settings yet), or the countless undocumented signals inside the receiver, which you won't access anyways because it's all on one chip?

You're better off just finding what's already done and buy it. I myself have looked at the FM band on my old analog spectrum analyzer to look for SCA signals. http://en.wikipedia.org/wiki/Subsidiary_Communications_Authority

It's all wonderful fun, but when you can do the same with a 15$ USB receiver and some software, it all starts to look rather silly, no?

Re:See, this is kinda what I meant

[Anonymous Coward]

Why would anyone have used an oscilliscope for this anyway? Non sequitur much?

Re:See, this is kinda what I meant

[Desler]

when I said you don't need an oscilloscope anymore. Probably a SDR receiver that goes to a PC.

At what stage in this project would an oscilloscope have been needed anyway? Yes, she used an SDR for scanning radio frequencies.

What possible interest is there in looking at the raw RF at the antenna, which you won't see with an oscilloscope anyways (because I don't know any scopes with nV/cm settings yet), or the countless undocumented signals inside the receiver, which you won't access anyways because it's all on one chip?

What is all on one chip? How is this rambling statement even applicable to this article?

It's all wonderful fun, but when you can do the same with a 15$ USB receiver and some software, it all starts to look rather silly, no?

You can decode these IBus messages with a $15 USB receiver? Link please?

Re:See, this is kinda what I meant

[Anonymous Coward]

This just in: project that would not need an oscilloscope does not need an oscilloscope! But that does not translate into the stupid logical leap you make that oscilloscopes are not needed anymore. Your logic today is still just as poor as when you created your stupid submission.

Re:See, this is kinda what I meant

[Anonymous Coward]

It's all wonderful fun, but when you can do the same with a 15$ USB receiver and some software, it all starts to look rather silly, no?

It only looks silly if you have no intellectual curiosity. How exactly is one supposed to gain knowledge if one never actually explores things?

Re:See, this is kinda what I meant

[fizzer06]

Yes, SCA. http://www.fcc.gov/encyclopedia/broadcast-radio-subcarriers-or-subsidiary-communications-authority-sca/

Re:See, this is kinda what I meant

[PPH]

How exactly is one supposed to gain knowledge if one never actually explores things?

Ask on Slashdot.

Re:See, this is kinda what I meant

[Anonymous Coward]

Anti-intellectualism is now considered "interesting" on Slashdot? Jesus fuck this site sucks these days.

Re:See, this is kinda what I meant

[Anonymous Coward]

when I said you don't need an oscilloscope anymore.

I didn't need a scope when developing a web server for a commercial embedded system, or when I learned Python for that matter. What relevance does any this have to needing a scope? Of course there are going to be hacking tasks that you don't need a scope or a bazillion other important tools for. But when I was debugging a power amplifier, or trying to reduce switching noise problems from a high power circuit, and in many other projects, an oscilloscope was absolutely critical.

You might as well complain that people don't need to buy saws for hacking projects any more... until you bump into someone who tried building their own case for something or otherwise doing some work with basic materials instead of buying Lego pieces or being a software hacker.

Re:See, this is kinda what I meant

[Anonymous Coward]

You can decode these IBus messages with a $15 USB receiver? Link please?

OsmoSDR

Re:See, this is kinda what I meant

[Anonymous Coward]

This might put you in the right direction:
Software defined radio with a TV tuner card.

That'll get you into seeing what signals are out there. It would take another layer or two of software to find out what's on those signals though. It should be easy enough to get a rough idea where to go in that regard by looking at the waveforms.

Re:See, this is kinda what I meant

[HarrySquatter]

On what planet does 180 Euro translate into 15 USD?

Re:See, this is kinda what I meant

[ArchieBunker]

Its the RTL-SDR project. A Linux developer discovered that a digital TV receiver chip made by Realtek (used in $15 dongles) had the ability to receive the raw sampled RF data. The bandwidth is nearly 3Mhz so that means you can view a HUGE chunk of the RF spectrum at once and decode the signals via software. AM/FM/USB/LSB you name it. Dongles based on the R820T tuner receiver from 22Mhz to 1600Mhz! Pipe the output into some digital speech decoder programs and you have a police scanner that would normal cost hundreds of dollars.

Re:See, this is kinda what I meant

[Anonymous Coward]

On what planet does 180 Euro translate into 15 USD?

I'm poster of that link OsmoSDR, not anyone you have been discussing above or ever earlier. I genuinely have no idea what you are smoking, and how did you ended up referring to that sysmocom.de site and $180, device.

The blog refers to RTL-SDR which probably cheapest SDR you can get, even though since it was discovered that some DVB-T USB sticks can be used as SDR's, compatible can be hard to find these days any more as models have changed and what's still left usually have been priced higher obviously because sellers now knows why it's been sought after. Anyway I bought mine (Hama Nano) just days after hearing that discovery and paid around $20, but some according to reddit got it around $15. And yes, of course you can pour more money to anything, but there is not saying you couldn't have gotten cheap SDR.

Re:See, this is kinda what I meant

[Anonymous Coward]

http://club.dx.com/reviews/text/172105

Re:See, this is kinda what I meant

[dlgeek]

www.amazon.com/gp/product/B00C37AZXK is $11 with free 2-day shipping for prime members (US). It's a cheap DV-B TV dongle using a chipset that has a "debug mode" where it spits out the raw RF data, and wide ranging tuning chip that makes it usable as a general purpose SDR reciever (known as an RTL-SDR). Windy's mentioned using one on her blog in many of her other posts.

I just got one this week, and it's been awesome to play with. Check out rtlsdr.org for more information about how to set it up, and rtl-sdr.com for a blog of cool projects you can do with it.

Re:See, this is kinda what I meant

[NoMaster]

[See, this is kinda what I meant] when I said you don't need an oscilloscope anymore.

And, if you only consider the tiny sub-set of 'electronics' that is 'dicking around writing software for pre-built toys', you were right.

Fortunately, real electronics engineers and technicians are designing and building those toys for you. And, even more fortunately, they know when oscilloscopes are still useful.

Re:See, this is kinda what I meant

[50000BTU_barbecue]

1) That's exactly my point. Who needs an oscilloscope for that?

2) Did you miss the part where I said " I myself have looked at the FM band on my old analog spectrum analyzer ". I bolded the important part for you.

Re:See, this is kinda what I meant

[50000BTU_barbecue]

Go to eBay and do some shopping. The point is you play with electronics these days by reverse-engineering existing products and using software to re-purpose things. Which is my point. You don't need an oscilloscope to be working in electronics on a hobby level anymore.

What is all on one chip? Um, the SDR receiver is certainly NOT a sprawling set of discrete LC filters and transistors, is it?

Just another example of why an oscilloscope is not the "must have" instrument it once was.

Is that rambling and incoherent? What do I need to clarify?

Re:See, this is kinda what I meant

[50000BTU_barbecue]

I don't think you understood what I was saying. I was saying that having a spectrum analyzer, which has always been an expensive and complex instrument, is silly when all you wanted to do can be done with a 15$ dongle.

I have to ask: am I that unclear? I have the feeling I am.

Re:See, this is kinda what I meant

[Anonymous Coward]

And you don't need to buy acrylic paint to be a painter, because you can choose to use water colors instead. For decades there have been electronics projects you could do without any need for a scope, whether it be things like logic gate based, or home automation, or various other categories. But there have been and still are plenty of projects and categories that a scope is a "must have" instrument. The categories shift around, but I'm seeing a lot of overlap between projects I help kids with these days and stuff I worked on as a teenager in the 80s that couldn't afford a scope. Although it is a lot easier now to get a used scope, so I've actually come across more people with access to one when they really need it instead of some attempts we made to half-ass things years ago.

Re:See, this is kinda what I meant

[Agripa]

Oscilloscopes make very handy back end modulation analyzers when combined with a demodulator and would also be used in designing the demodulator itself. The common RF applications I see them used for are broadband envelope measurement and broadband RMS measurement where they can often be used to calibrate other instruments.

If you are buying turnkey solutions, then obviously an oscilloscope is of less use since even if you used it to diagnose a problem, you will be reliant on the vendor to fix it. Not every solution is best solved buy outsourcing.

Encryption

[sunderland56]

Pity she couldn't break the text encryption - then she could have displayed the station names in English, instead of nonsense strings.

Re:Encryption

[Anonymous Coward]

It's probably a bunch of nonsense about nuggets and "equality".

Re:Encryption

[Anonymous Coward]

The station names are of course in Finnish - just look at a map of Helsinki. These displays have been around for years.

Re:Encryption

[Desler]

For anyone who is not an aspie they would have recognized that the GP's post is this new thing called a "joke". Maybe your side of the world hasn't yet been informed of their invention?

Re:Encryption

[rubycodez]

"Finnish"?? hah, what a silly name. is that what your imaginery fish friends spoke in your childhood?

Re:Encryption

[Anonymous Coward]

It's the last language anyone can learn: Finished

Re:Encryption

[PPH]

It takes a long time to learn as well. Which is why everyone is Russian.

Re:Encryption

[AK Marc]

Finnish? He never even starrted.

Re: Encryption

[Anonymous Coward]

finnish is self encrypting

Re:Encryption

[Anonymous Coward]

Finnish is self encrypting to most.

Re:Encryption

[MotorMachineMercenar]

As a Finn, I'm offended at your jingoism. How could anyone not understand this: http://www.youtube.com/watch?v=4om1rQKPijI

Re:Encryption

[rubycodez]

not everyone is Russian, some are real Slovene

That bus time system does not work.

[Anonymous Coward]

I use Helsinki buses and trams a lot. Those displays are all but useless.

When the buses are running on time they offer no information as the time table is on every bus stop and you know what the time is.

When there are delays the displays will happily count down according toward the arrival time as on the timetable, the bus does not come, and the display happily starts counting down the next 15, 20, whatever minutes to the arrival time of the next bus.

In general, when things are working they offer no useful information and when things are not working they offer incorrect information.

Helsinki transit companies should ask for their money back.

Re:That bus time system does not work.

[Deadstick]

Likewise the Denver light rail system...just a timetable expressed in a crude multiple-bulb display.

A live map also available

[jones_supa]

As a sidenote, HSL has also set up a live map of the Helsinki trams buzzing around.

Developer community and open data

[tuukkah]

Cool reverse engineering indeed! For those who want it easier, the Helsinki Region Transport Authority HSL offers the arrival time predictions through a service called "Omat lähdöt", which has an open API too. However, the textual messages are not available so that's new. As the post mentions, the predictions are based on the GPS locations sent by the busses, which are not available to third parties (unlike the locations of the metro, trams and trains). For more information about the HSL Developer Community and open data at HSL, see dev.hsl.fi.

Any existing apps that give the same info?

[grimJester]

I'd like an app that shows the arrival predictions for the stop(s) nearest my current location.

Re:Any existing apps that give the same info?

[Anonymous Coward]

TFL in London has this.

Re:Any existing apps that give the same info?

[Anonymous Coward]

Like this?

https://itunes.apple.com/app/reittigps-reittiopas-iphonelle/id290859824

It's been around couple of years already. Also available for Android.

Re:Any existing apps that give the same info?

[Anonymous Coward]

That does not give arrival predictions. Another app, called Stop Map, gives timetable stop times, but again, not predictions based on GPS data.

Recieve only, do not transmit.

[VortexCortex]

That which can be received unsecured, can be broadcast as such. Only a matter of time now before the displays feature zombie attack warnings.

Re:Recieve only, do not transmit.

[Anonymous Coward]

Not necessarily. Instead of script kiddie packages this requires actual electronics knowledge. No one apart Oona bothers these days.

Re:Recieve only, do not transmit.

[foobar bazbot]

Not necessarily. Instead of script kiddie packages this requires actual electronics knowledge. No one apart Oona bothers these days.

No, not necessarily, but given that it's in the FM broadcast band, it sounds quite likely that it can be spoofed with an unmodified FM transmitter and a script generating an appropriate audio signal.

Of course in the grand /. tradition, I haven't RTFA yet, and they could be using a modulation scheme that can't be emulated with FM (IMO unlikely, as it's probably some flavor of FSK or PSK), or too wide a modulation range, and even if it's all doable off-the-shelf, range will be quite limited without at least a little hardware competence to boost the transmit power.

Re:Recieve only, do not transmit.

[foobar bazbot]

Ignore above, I just RTFAed.

Turns out it's not a separate FM signal as I assumed, but an extra subcarrier (beyond the stereo and RDS signals) in an existing FM signal. This does indeed require electronics skills to generate, though it wouldn't be very hard to add in to a kit transmitter like the mpx-96 we built in my advanced electronics lab.

What is this magick you speak of?

[Applehu Akbar]

This couldn't happen in America because we don't have your fancy-dancy electronic bus annunciators. We believe that standing on a street corner in the rain builds character. Apparently, it also opens up new venues for hacking.

Re:What is this magick you speak of?

[Anonymous Coward]

This couldn't happen in America because we don't have your fancy-dancy electronic bus annunciators. We believe that standing on a street corner in the rain builds character. Apparently, it also opens up new venues for hacking.

Coincidentally standing on the street corner also opens an avenue to get up your mom's hooker dress. Funny how that works.

FYI $10,- RTL-SDR available, link below

[Anonymous Coward]

Right, this RTL-SDR is sold at $10.

http://www.hamradioscience.com/10-ads-b-receiver-rtl2832u-r820t/

ps. I'm the guy who linked that OsmoSDR.

TfL

[Anonymous Coward]

London's bus transport runs explicitly on a system called 'iBus,' and I'd bet my £5 it's the exact same system discovered here. Considering it seems to function in the exact same way (remote, battery/solar powered stops showing a countdown), I imagine there's also an FM frequency being used here to update the various bus stations.

Now just to learn how to hack it . . .

An article about the subject

[Cee]

There's an excellent article about how the signs work in Stockholm with some technical details.

Now if only it could TRANSMIT. B-)

[Ungrounded Lightning]

Its the RTL-SDR project. A Linux developer discovered that a digital TV receiver chip made by Realtek (used in $15 dongles) had the ability to receive the raw sampled RF data. The bandwidth is nearly 3Mhz so that means you can view a HUGE chunk of the RF spectrum at once and decode the signals via software.

Now if only it could transmit.

Or if it could also convert digital signals into I/Q and we could feed that into the Rx mixer of the block downconverter, run backward. Then two $11 - $15 dongles, one of them hacked slightly and with a small power amplifier added, would be a two-way software defined radio for very cheap.

(Supposedly) Broken for only some buses

[Ungrounded Lightning]

One of the cited article talks about the system having two cases:
  - The buses with the tracking hardware are displayed based on the tracking.
  - the buses without the tracking hardware are displayed based on the schedule.

Now maybe the line you're on has buses without tracking. (Or maybe the tracking system doesn't work and it's all a crock.) But the anecdote that your particular line is just showing an automated schedule doesn't show that all others are doing the same.

Re:Now if only it could TRANSMIT. B-)

[Muad'Dave]

The dongle receivers are typically I/Q receivers.

Re:Now if only it could TRANSMIT. B-)

[Ungrounded Lightning]

The dongle receivers are typically I/Q receivers.

Yes, I understand that. I guess I phrased it ambiguously.

What I meant is "convert data from the USB to I/Q OUTPUT, i.e. do the TRANSMIT side of a transceiver, too, not convert the receive side to I/Q from something else.

Then we need a local oscillator and mixer to boost it back UP to the desired frequency band (which might be done with the companion block downconverter chip if the appropriate signals are accessible or if it is actually also a transciever chip). Add a "power" amplifier (for suitably small values of "power"), a diplexer (if you really need to use a single antenna for both directions) and you're done.

Re:Now if only it could TRANSMIT. B-)

[Muad'Dave]

Gotcha. Regulatory issues aside, there are chips that do I/Q upconverting. I've always wanted to get one and play with it. They're actually becoming commodity hardware, potentially illegal as they may be.