Slashdot Mirror
It's Easy To Hack Traffic Lights
An anonymous reader notes coverage of research from the University of Michigan into the ease with which attackers can hack traffic lights. From the article:
As is typical in large urban areas, the traffic lights in the subject city are networked in a tree-type topology, allowing them to pass information to and receive instruction from a central management point. The network is IP-based, with all the nodes (intersections and management computers) on a single subnet. In order to save on installation costs and increase flexibility, the traffic light system uses wireless radios rather than dedicated physical networking links for its communication infrastructure—and that’s the hole the research team exploited. ... The 5.8GHz network has no password and uses no encryption; with a proper radio in hand, joining is trivial. ... The research team quickly discovered that the debug port was open on the live controllers and could directly "read and write arbitrary memory locations, kill tasks, and even reboot the device (PDF)." Debug access to the system also let the researchers look at how the controller communicates to its attached devices—the traffic lights and intersection cameras. They quickly discovered that the control system’s communication was totally non-obfuscated and easy to understand—and easy to subvert.
This was central to the plot of the Italian Job. The real Napster took care of it.
n/t
It is scary how many industries (e.g. autos, "smart" electronics, control systems) are decades behind state of the art security. We will have a lot of growing pains to get out "only computer guys need to do this".
Deaths? multiple injured people? Why isn't that secured in the first place? With all the news about stuff getting *hacked*, why are they still doing this?
I've got better things to do tonight than die.
So can cyclists use this to proceed through an intersection with miscalibrated vehicle sensors without having to wait several minutes for a motor vehicle to pull up behind? I don't know about other countries, but not every US state has a dead red law allowing one to proceed with caution through a malfunctioning signal.
My home town only has one traffic light (and didn't get a left turn lane until after I moved away). I wonder what sort of damage hackers could do with that... Chaos where US 101 meets highway 34....
What is the point of this "research"? To prove that there are still many systems in our world that can be hacked easily? No shit.
The thing is that sometimes there is no incentive to hack things because it is a lot of work for very little gain, until some other asshat on the interwebs shows people how it can be done. Then the effort to hack it becomes less (as there is not a manual), and thus the freqnency of it occurring increases. I may exaggerate a little when call this a form of sponsored vandalism... but I am not sure what society will gain from this research.
The large majority of hacks are done by people trying to steal or just for entertainment. Terrorism is really not your #1 hacker. And anyway, I don't see Al Quaida making a statement by hacking the traffic lights on a particular crossing. Instead, what we get now is that all 18-year-olds who read ars technica will try this out.
Red means stop. Do not go. No, no, no. Green in all directions means go. Oh no, Oh no, Oh no.
No more reasons to be late at work.
Achille Talon
Hop!
You just open up the junction boxes at the intersection, cross some wires and all the lights become green. The Gremlins already knew how to do it. No hacking required.
"Watchdogs" fan boys might get a kick out of this one.
Now I'm really happy that my area still uses dial-up to communicate with the traffic lights - the lights call in to a central controller a handful of times a day. I'd always thought that they should upgrade, but now I'm not so sure.
... is a job best done by people who understand it. Yet the security czar of the US Government bragged in an interview that since he didn't know anything about security he was better able to deal with it.
people charge of traffic lights are engineers but not likely to be EE's or tech people. They may know some what about how they work but maybe not the deep tech parts. The engineers in charge are traffic / construction engineers.
Looks like the security is so laughable (basically no security) that Watch Dogs portrayed mucking with traffic lights surprisingly accurately :)
The people that will implement 'smart' cars, which use vehicle to vehicle communication, and communication with traffic lights will screw up, and be vulnerable to criminal hackers. The current dumb vehicle system works pretty well. Unless distractions, or ethanol is added to the biological computing unit.
Civil engineers that design traffic flow systems are looking at the problem from a macro-scale, and from a traffic-perspective, not from a security or physical device perspective.
It's the job of the designer/implementer to put the security into the system. In that sense the vendor and manufacturer should be held liable, not the customer.
Do not look into laser with remaining eye.
I can fix the the flashing reds that happen all. the. damn. time. In my hometown.
Its easy to exceed the speed limit. Its easy to shop lift. Its easy to buy a gun and shoot somebody.
Its probably easy to build a device that gives you green lights as though you were an emergency vehicle. This is definitely illegal.
While I think its irresponsible to design computer systems without basic and reasonable security measures, technology is not the final answer to antisocial behavior. Hacking somebody else's systems is illegal and wrong. Finding (sometimes ) esoteric ways to do it and making it easy for bad guys is just plain foolish.
My friend Neil and I have a law: You know you have enough security when you can't do your job anymore. Requiring the average stop light electrician to now be a computer networking security expert requiring tons of tech support would certainly drive up taxes.
Antisocial behavior is why we have laws and there is a reason we should obey them.
Greed is the root of all evil.
Wireless security doesn't mean much when people already have easy physical access to all of these traffic lights. It's not like they are guarded by more than a pad lock. I am guessing the greatest threat to traffic lights (in the eyes of the department of transportation) is still copper thieves.
When you buy a off the shelf part that does 99% the work for you and have all the accompanying documentation on how to use the part shipped to you along with it.
It explicitly states that the sensors uses proprietary protocol.
The researchers decided to bypass all of the time and effort of reverse engineering the protocol; that is everything from the physical, link layer, transport, all the way up to the application.
Their rational to this is that it's easy to "trick" public safety companies who have to follow ITAR and EAR regulations into selling a part to any random dude. Their citation is a link to an article about one guy, who had a contract for conducting this sort of research, "social engineering" his way to obtain a off the shelf part.
Sure they pointed out some valid security concerns such as no encryption at the application layer and debug access to VxWorks, but it is absolute FUD to call it easy.
Try hacking one of these if you 1) don't work for the companies that make these 2) don't actually have the access point and documentation handed to you.
how come I don't see the networks on Wigle and my Android phone? Umm.
2600 posted story about this back in the 90's. Things don't really change apparently.
Don't emergency vehicles sometimes use this to their advantage to turn an intersection into a 4-way red light so that they can get through? I know I've heard of ambulances and fire trucks having a button that makes all stop lights near them turn red, but I have never tried to verify the truth of the claim.
So when are we going to hear about sob storys from idiots who hack traffic lights and get more then 33 months in jail for it?
Jack of all trades,master of none
I once knew a traffic-light engineer who was an EE with a BS. I mentioned that I thought it was annoying not to have sensors on lights in rarely-used cross streets, since it wastes a lot of gas to have the main throughway traffic constantly stopping for no reason, not to mention wasting people's time. He said that if you put in a sensor, people will get used to the light always being green, and in the rare case it turns red they will tend not to stop and will cause more accidents. He was very strongly opposed to such sensors - arguing supposedly from experience as a professional and an expert - and our argument started to become, well, heated, so I just let it go. I really doubt what he said is supported by statistics, but his attitude was an example of the thinking of the people designing the lights.
(This was a couple of decades ago. Maybe the thinking has changed since I do see more sensors these days, but still not nearly enough. Often they seem poorly designed, such as unnecessarily waiting a full cycle before changing even if there is no cross traffic.)
Yes, but the customer should probably be specifying some level of security in their requirements.
From the standpoint of managing or architecting the product, if there isn't a specific requirement for such a feature, then you don't actually have any spec to design it to, and it's one more thing that you have to document and test before you can release your product.
The traffic lights in our metropolitan area are connected via the 900MHZ ISM Band. We were able to use the XBee Pros to connect to them and see the (unencrypted) data streaming across coordinating the lights (and also changing them in the case of emergency vehicles). I never had the guts to issue commands to them, but it was cool to see...
You would be surprised how conditioned you can become to traffic patterns always being a certain way. I nearly caused an accident last week when I turned left in front of a car that was going straight. I am a good driver... why did I do that? The intersection was where two small neighborhood roads intersect the main road. After I screwed up, I realized that In the last 25 years, I had _never_ seen a car go straight through that particular intersection. I unconsciously assumed that he was waiting for the light so that he could turn left, like cars always do.
Traffic engineering is not about saving gas. It is mostly about preventing accidents. That is one of the reasons you see so few Yield signs these days.
The intersection on our street has two lanes on the cross street - one dedicated right-turn lane, and a combined left-turn/straight-through lane.
We usually go straight through, but it's some where we never go through without being cautious because a straight-through/left-turn lane is a rarity. It's usually more common as a left-turn, and a right-turn/straight lane. People just don't seem to understand that after the car turns left, the car behind might want to go straight.
We've nearly had accidents where people would assume we'd be turning left.
Had a right-turn from the main road assume the same thing - the light was red, we headed straight, and the guy never looked to his left and continued making the right turn. He never figured out that people might not be turning and didn't look.
These days more traffic goes through there so people are more used to not assuming that most people turn. But geez.
It's apparently common enough that it's why they have "Traffic Pattern Changed" signs to warn drivers that they've mucked with the lights, lanes, etc.
http://phrack.org/issues/60/14.html
Your city's stoplights are balanced for a different speed.
Or they are balanced for the same speed in a different direction. On a two-way street whose signals are timed for 30 mph eastbound at a particular part of the day, westbound traffic is going to have a problem.
Or perhaps they are balanced for a different speed, the speed of the type of vehicle driven by the majority. Most signals are timed for people who drive cars, which means cyclists tend to hit more reds.
Reminds me of the time when that list of crosswalk-button hacks was published - it created quite a stir.
my, your, his/her/its, our, your, their
I'm, you're, he's/she's/it's, we're, you're, they're
Unfortunately, those sensors sometimes fail. With no "call," then one direction may never get a green light. (Of course, if this happens, then the tech will call an engineer to get a timing plan, then go out and reprogram the faulty controller, if it's not networked.) Freezing conditions, et c. can ruin in-ground loop sensors, and optical sensors can become befuddled by fog, snow and sun. Radar-based sensors are becoming more common, and because they're mounted on an arm or on a pole, they can be replaced more easily than the inductive loops.
I was stuck at a faulty red light with a sensor once. I waited for almost 5 minutes, wanting to call the police out to get me out of the stop light. Yes, I'm pedantic enough to annoy my wife like that. I knew that backing up and pulling forward would work, but it shouldn't have been necessarily.
As always, when something gets hacked, we find out it was for the stupidest reasons. You can just log into a Wi-Fi network and dump the entire memory of the traffic light through a debug port that was left open? I mean sure, everything can be hacked, but this is just handing the entire system to the hackers. Just like nearly every other "hack" that goes on in the real world.
This is just like when a web forum gets "hacked" because somebody with an axe to grind guessed the admin's password was actually "PaSsWoRd".
I sometimes ask revealing, often ignorant-seeming questions. Maybe they're harder to answer than you think.
Well our local municipal engineering department obviously has not read that memo.
We have various lights that are always green and switch on demand when a car approaches on the side street.
I'll note that the counter argument is that people using those roads get used to them always being green, but also get used to them switching quickly to red when a car approaches from the side street.
The issue with any traffic engineer, is that there's actually no science supporting traffic engineering. It's voodoo. And if you say that to anyone who deals with traffic, they act like you dessicated their shrine. Sure, some individual parts have science (traffic flow). But when proven false (California flows better than stated, other places worse) they will persist on using the proven wrong models, rather than trying to solve for reality.
A human factors study into lights, and having the colors/flashing change to help improve flow/compliance isn't what they do. "Fuck you, red lights are read and solid" is the closest to a discussion they will have with you.
Learn to love Alaska
They were both in that Die Hard movie that demonstrated the consequences of bad people gaining control of traffic lights -- among other things.
There's no time like the present. Well, the past used to be.