Slashdot Mirror

← Back to Stories (view on slashdot.org)

It's Easy To Hack Traffic Lights

Posted by Soulskill on from the looking-forward-to-the-mobile-app dept.

An anonymous reader notes coverage of research from the University of Michigan into the ease with which attackers can hack traffic lights. From the article: As is typical in large urban areas, the traffic lights in the subject city are networked in a tree-type topology, allowing them to pass information to and receive instruction from a central management point. The network is IP-based, with all the nodes (intersections and management computers) on a single subnet. In order to save on installation costs and increase flexibility, the traffic light system uses wireless radios rather than dedicated physical networking links for its communication infrastructure—and that’s the hole the research team exploited. ... The 5.8GHz network has no password and uses no encryption; with a proper radio in hand, joining is trivial. ... The research team quickly discovered that the debug port was open on the live controllers and could directly "read and write arbitrary memory locations, kill tasks, and even reboot the device (PDF)." Debug access to the system also let the researchers look at how the controller communicates to its attached devices—the traffic lights and intersection cameras. They quickly discovered that the control system’s communication was totally non-obfuscated and easy to understand—and easy to subvert.

6 of 144 comments (clear)

  1. Old news by neglogic · · Score: 4, Informative

    This was central to the plot of the Italian Job. The real Napster took care of it.

  2. Welcome to the Information Age! by sinij · · Score: 5, Insightful

    It is scary how many industries (e.g. autos, "smart" electronics, control systems) are decades behind state of the art security. We will have a lot of growing pains to get out "only computer guys need to do this".

    1. Re:Welcome to the Information Age! by Mr+D+from+63 · · Score: 5, Informative
      From TFA,

      In fact, the most upsetting passage in the entire paper is the dismissive response issued by the traffic controller vendor when the research team presented its findings. According to the paper, the vendor responsible stated that it "has followed the accepted industry standard and it is that standard which does not include security."

      Don't blame the vendor, blame the standard. The vendor that includes security in his bid will have a higher price and lose to the vendor that doesn't.

    2. Re:Welcome to the Information Age! by sinij · · Score: 4, Insightful

      "Acceptable industry standard" is not a standard, it is status quo. You have to blame municipalities for complete lack of understanding of these security concerns.

      Next, script kiddies causing couple fender-benders and every municipality having to upgrade traffic light systems at a "I want it yesterday" premium. Then higher property taxes to pay for such monumental lack of planning and foresight.

    3. Re:Welcome to the Information Age! by Lumpy · · Score: 4, Insightful

      "we aren't willing to pay for security" It's worse than that. IT also stems from the fact that people in charge. The guys making big bucks making decisions are horribly undereducated.

      If you ask the guy that is in charge of the city's traffic lights to explain in detail how the system works he will NOT be able to tell you. We as a society do not put in leadership positions the best and brightest. WE instead promote those that can suck up the best and schmoose the best.

      And it's now biting us in the ass because the decision makers in general are dumb as a box of rocks. And when faced with a problem they simply say "I dont know" or try to scream how we need more laws instead of actually learning what the problem is and fixing it.

      --
      Do not look at laser with remaining good eye.
  3. A lot of easy things are illegal by TomGreenhaw · · Score: 5, Insightful

    Its easy to exceed the speed limit. Its easy to shop lift. Its easy to buy a gun and shoot somebody.

    Its probably easy to build a device that gives you green lights as though you were an emergency vehicle. This is definitely illegal.

    While I think its irresponsible to design computer systems without basic and reasonable security measures, technology is not the final answer to antisocial behavior. Hacking somebody else's systems is illegal and wrong. Finding (sometimes ) esoteric ways to do it and making it easy for bad guys is just plain foolish.

    My friend Neil and I have a law: You know you have enough security when you can't do your job anymore. Requiring the average stop light electrician to now be a computer networking security expert requiring tons of tech support would certainly drive up taxes.

    Antisocial behavior is why we have laws and there is a reason we should obey them.

    --
    Greed is the root of all evil.