Slashdot Mirror
It's Easy To Hack Traffic Lights
An anonymous reader notes coverage of research from the University of Michigan into the ease with which attackers can hack traffic lights. From the article:
As is typical in large urban areas, the traffic lights in the subject city are networked in a tree-type topology, allowing them to pass information to and receive instruction from a central management point. The network is IP-based, with all the nodes (intersections and management computers) on a single subnet. In order to save on installation costs and increase flexibility, the traffic light system uses wireless radios rather than dedicated physical networking links for its communication infrastructure—and that’s the hole the research team exploited. ... The 5.8GHz network has no password and uses no encryption; with a proper radio in hand, joining is trivial. ... The research team quickly discovered that the debug port was open on the live controllers and could directly "read and write arbitrary memory locations, kill tasks, and even reboot the device (PDF)." Debug access to the system also let the researchers look at how the controller communicates to its attached devices—the traffic lights and intersection cameras. They quickly discovered that the control system’s communication was totally non-obfuscated and easy to understand—and easy to subvert.
This was central to the plot of the Italian Job. The real Napster took care of it.
It is scary how many industries (e.g. autos, "smart" electronics, control systems) are decades behind state of the art security. We will have a lot of growing pains to get out "only computer guys need to do this".
Deaths? multiple injured people? Why isn't that secured in the first place? With all the news about stuff getting *hacked*, why are they still doing this?
I've got better things to do tonight than die.
So can cyclists use this to proceed through an intersection with miscalibrated vehicle sensors without having to wait several minutes for a motor vehicle to pull up behind? I don't know about other countries, but not every US state has a dead red law allowing one to proceed with caution through a malfunctioning signal.
My home town only has one traffic light (and didn't get a left turn lane until after I moved away). I wonder what sort of damage hackers could do with that... Chaos where US 101 meets highway 34....
What is the point of this "research"? To prove that there are still many systems in our world that can be hacked easily? No shit.
The thing is that sometimes there is no incentive to hack things because it is a lot of work for very little gain, until some other asshat on the interwebs shows people how it can be done. Then the effort to hack it becomes less (as there is not a manual), and thus the freqnency of it occurring increases. I may exaggerate a little when call this a form of sponsored vandalism... but I am not sure what society will gain from this research.
The large majority of hacks are done by people trying to steal or just for entertainment. Terrorism is really not your #1 hacker. And anyway, I don't see Al Quaida making a statement by hacking the traffic lights on a particular crossing. Instead, what we get now is that all 18-year-olds who read ars technica will try this out.
Red means stop. Do not go. No, no, no. Green in all directions means go. Oh no, Oh no, Oh no.
No more reasons to be late at work.
Achille Talon
Hop!
... is a job best done by people who understand it. Yet the security czar of the US Government bragged in an interview that since he didn't know anything about security he was better able to deal with it.
people charge of traffic lights are engineers but not likely to be EE's or tech people. They may know some what about how they work but maybe not the deep tech parts. The engineers in charge are traffic / construction engineers.
Civil engineers that design traffic flow systems are looking at the problem from a macro-scale, and from a traffic-perspective, not from a security or physical device perspective.
It's the job of the designer/implementer to put the security into the system. In that sense the vendor and manufacturer should be held liable, not the customer.
Do not look into laser with remaining eye.
I can fix the the flashing reds that happen all. the. damn. time. In my hometown.
Its easy to exceed the speed limit. Its easy to shop lift. Its easy to buy a gun and shoot somebody.
Its probably easy to build a device that gives you green lights as though you were an emergency vehicle. This is definitely illegal.
While I think its irresponsible to design computer systems without basic and reasonable security measures, technology is not the final answer to antisocial behavior. Hacking somebody else's systems is illegal and wrong. Finding (sometimes ) esoteric ways to do it and making it easy for bad guys is just plain foolish.
My friend Neil and I have a law: You know you have enough security when you can't do your job anymore. Requiring the average stop light electrician to now be a computer networking security expert requiring tons of tech support would certainly drive up taxes.
Antisocial behavior is why we have laws and there is a reason we should obey them.
Greed is the root of all evil.
Wireless security doesn't mean much when people already have easy physical access to all of these traffic lights. It's not like they are guarded by more than a pad lock. I am guessing the greatest threat to traffic lights (in the eyes of the department of transportation) is still copper thieves.
Don't emergency vehicles sometimes use this to their advantage to turn an intersection into a 4-way red light so that they can get through? I know I've heard of ambulances and fire trucks having a button that makes all stop lights near them turn red, but I have never tried to verify the truth of the claim.
So when are we going to hear about sob storys from idiots who hack traffic lights and get more then 33 months in jail for it?
Jack of all trades,master of none
I once knew a traffic-light engineer who was an EE with a BS. I mentioned that I thought it was annoying not to have sensors on lights in rarely-used cross streets, since it wastes a lot of gas to have the main throughway traffic constantly stopping for no reason, not to mention wasting people's time. He said that if you put in a sensor, people will get used to the light always being green, and in the rare case it turns red they will tend not to stop and will cause more accidents. He was very strongly opposed to such sensors - arguing supposedly from experience as a professional and an expert - and our argument started to become, well, heated, so I just let it go. I really doubt what he said is supported by statistics, but his attitude was an example of the thinking of the people designing the lights.
(This was a couple of decades ago. Maybe the thinking has changed since I do see more sensors these days, but still not nearly enough. Often they seem poorly designed, such as unnecessarily waiting a full cycle before changing even if there is no cross traffic.)
You would be surprised how conditioned you can become to traffic patterns always being a certain way. I nearly caused an accident last week when I turned left in front of a car that was going straight. I am a good driver... why did I do that? The intersection was where two small neighborhood roads intersect the main road. After I screwed up, I realized that In the last 25 years, I had _never_ seen a car go straight through that particular intersection. I unconsciously assumed that he was waiting for the light so that he could turn left, like cars always do.
Traffic engineering is not about saving gas. It is mostly about preventing accidents. That is one of the reasons you see so few Yield signs these days.
The intersection on our street has two lanes on the cross street - one dedicated right-turn lane, and a combined left-turn/straight-through lane.
We usually go straight through, but it's some where we never go through without being cautious because a straight-through/left-turn lane is a rarity. It's usually more common as a left-turn, and a right-turn/straight lane. People just don't seem to understand that after the car turns left, the car behind might want to go straight.
We've nearly had accidents where people would assume we'd be turning left.
Had a right-turn from the main road assume the same thing - the light was red, we headed straight, and the guy never looked to his left and continued making the right turn. He never figured out that people might not be turning and didn't look.
These days more traffic goes through there so people are more used to not assuming that most people turn. But geez.
It's apparently common enough that it's why they have "Traffic Pattern Changed" signs to warn drivers that they've mucked with the lights, lanes, etc.
Your city's stoplights are balanced for a different speed.
Or they are balanced for the same speed in a different direction. On a two-way street whose signals are timed for 30 mph eastbound at a particular part of the day, westbound traffic is going to have a problem.
Or perhaps they are balanced for a different speed, the speed of the type of vehicle driven by the majority. Most signals are timed for people who drive cars, which means cyclists tend to hit more reds.
Reminds me of the time when that list of crosswalk-button hacks was published - it created quite a stir.
my, your, his/her/its, our, your, their
I'm, you're, he's/she's/it's, we're, you're, they're
Unfortunately, those sensors sometimes fail. With no "call," then one direction may never get a green light. (Of course, if this happens, then the tech will call an engineer to get a timing plan, then go out and reprogram the faulty controller, if it's not networked.) Freezing conditions, et c. can ruin in-ground loop sensors, and optical sensors can become befuddled by fog, snow and sun. Radar-based sensors are becoming more common, and because they're mounted on an arm or on a pole, they can be replaced more easily than the inductive loops.
I was stuck at a faulty red light with a sensor once. I waited for almost 5 minutes, wanting to call the police out to get me out of the stop light. Yes, I'm pedantic enough to annoy my wife like that. I knew that backing up and pulling forward would work, but it shouldn't have been necessarily.
As always, when something gets hacked, we find out it was for the stupidest reasons. You can just log into a Wi-Fi network and dump the entire memory of the traffic light through a debug port that was left open? I mean sure, everything can be hacked, but this is just handing the entire system to the hackers. Just like nearly every other "hack" that goes on in the real world.
This is just like when a web forum gets "hacked" because somebody with an axe to grind guessed the admin's password was actually "PaSsWoRd".
I sometimes ask revealing, often ignorant-seeming questions. Maybe they're harder to answer than you think.
Well our local municipal engineering department obviously has not read that memo.
We have various lights that are always green and switch on demand when a car approaches on the side street.
I'll note that the counter argument is that people using those roads get used to them always being green, but also get used to them switching quickly to red when a car approaches from the side street.
The issue with any traffic engineer, is that there's actually no science supporting traffic engineering. It's voodoo. And if you say that to anyone who deals with traffic, they act like you dessicated their shrine. Sure, some individual parts have science (traffic flow). But when proven false (California flows better than stated, other places worse) they will persist on using the proven wrong models, rather than trying to solve for reality.
A human factors study into lights, and having the colors/flashing change to help improve flow/compliance isn't what they do. "Fuck you, red lights are read and solid" is the closest to a discussion they will have with you.
Learn to love Alaska
They were both in that Die Hard movie that demonstrated the consequences of bad people gaining control of traffic lights -- among other things.
There's no time like the present. Well, the past used to be.