Slashdot Mirror
One Single Malicious Vehicle Can Block 'Smart' Street Intersections In the US (bleepingcomputer.com)
An anonymous reader shares a BleepingComputer report: Academics from the University of Michigan have shown that one single malicious car could trick US-based smart traffic control systems into believing an intersection is full and force the traffic control algorithm to alter its normal behavior, and indirectly cause traffic slowdowns and even block street intersections. The team's research focused on Connected Vehicle (CV) technology, which is currently being included in all cars manufactured across the globe. More precisely, it targets V2I (vehicle-to-infrastructure) protocols, and more precisely the I-SIG system implemented in the US.
The Michigan research team says the I-SIG system in its current default configuration is vulnerable to basic data spoofing attacks. Researchers say this is "due to a vulnerability at the signal control algorithm level," which they call "the last vehicle advantage." This means that the latest arriving vehicle can determine the traffic system's algorithm output. The research team says I-SIG doesn't come with protection from spoofing attacks, allowing one vehicle to send repeated messages to a traffic intersection, posing as the latest vehicle that arrived at the intersection. According to simulated traffic models, the Michigan team says that around a fifth of all cars that entered a test intersection took seven minutes to traverse the traffic junction that would have normally taken only half a minute. Researchers don't believe this bug could be exploited for actual gains in the real world, but the bugs' existence shows the protocol is poorly coded, even four years after first being proved unsecured.
The Michigan research team says the I-SIG system in its current default configuration is vulnerable to basic data spoofing attacks. Researchers say this is "due to a vulnerability at the signal control algorithm level," which they call "the last vehicle advantage." This means that the latest arriving vehicle can determine the traffic system's algorithm output. The research team says I-SIG doesn't come with protection from spoofing attacks, allowing one vehicle to send repeated messages to a traffic intersection, posing as the latest vehicle that arrived at the intersection. According to simulated traffic models, the Michigan team says that around a fifth of all cars that entered a test intersection took seven minutes to traverse the traffic junction that would have normally taken only half a minute. Researchers don't believe this bug could be exploited for actual gains in the real world, but the bugs' existence shows the protocol is poorly coded, even four years after first being proved unsecured.
They prove that a hostile actor can cause overwhelming congestion at and near an intersection, but still comment:
It is unclear how a threat actor might use the vulnerabilities discovered by the Michigan research team, as it would take them thousands of malicious cars spread across a city for long periods of time to incur any real economical damages to the local business sector.
Now, let me think, what is an effective means of causing real damages when you have a lot of people in a small area? Oh, yes, agressive chemistry. Or if you want something a little slower, agressive biology.
This kind of thing is always a potential problem. If you allow uncontrolled inputs, you always need to check if somebody is acting maliciously. Technical improvements could obviously help, but it's at least as important to have legal mechanisms to back them up. Spoofing the system needs to be illegal with real penalties for violations and reasonable mechanisms for spotting the spoofers. This is the new equivalent of making it illegal to use emergency lights if you aren't an emergency vehicle.
There's no point in questioning authority if you aren't going to listen to the answers.
Never trust user input!
Eh, a single malicious vehicle can block "dumb" intersections too if it just stops right there in the middle!
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
Crashes do this all the time now. If there's a wreck on the freeway I use to get to work, it clogs the entire freeway so that traffic slows to a snail's pace. The alternative routes also fill up fast. Doesn't take rocket science; just old-fashioned stupidity and inattention.
It doesn't help that crash inspectors have to "do science" on the wreck to understand it better. Why waste tens of thousands of commuter hours to clear up the insurance of 2 people? Selfish allocation of resources. Take lots of pictures then push the wrecks off the road, and study the pictures back in the office.
Table-ized A.I.
Spoofing the system needs to be illegal
Modded up on Slashdot for declaring that security research should be outlawed. I wish this sort of thing surprised me.
A transponder hooked up to a Raspberry Pi and a battery could be made to have the same effect... fun times...
BTW - the Trump administration delayed the CV/V2V mandate in the US, and it's not mandated in the EU yet. One of the few Trump administration decisions that I wholeheartedly and completely support.
a cell jammier can do the same thing
And Beat The Shit Out of Said Car. We Are Arkansas. We ArNotKansas.
https://www.xkcd.com/1958/
Just slightly more complex, a malicious actor with a single vehicle can block a "dumb" intersection by driving doughnuts in the middle of the intersection.
This Space Intentionally Left Blank
"Researchers don't believe this bug could be exploited for actual gains in the real world,"
In a real city, when this happens, we just ignore the all way stop signal and just walk or bike through the intersection, or use our skateboards.
Only old people and suburbanites use cars. They deserve to stew.
-- Tigger warning: This post may contain tiggers! --
They already did that with airbags. Technically you are legally required to have your airbags in working order during the transfer of title of a car. Practically speaking nobody does. But if there was an accident and the airbags didn't deploy, in theory the new owner of the vehicle could come back and sue you, and the government could come after you on criminal charges (I don't have the specific vehicle code entry for you. This was secondhand information from a professor who also worked for a local vehicle bureau branch.)
Additionally similiar laws are on the books for seatbelts as well as dozens under the vehicle emission code laws that don't necessarily affect emissions.
Get one of the programmers on here who brag how much they're being paid to produce code which is flawless and fully documented to rewrite the protocol.
Once you get one of those experts involved, anything is possible.
Next they'll say a stupid truck-driver with slick wheels can jackknife a whole highway shut for almost a day in winter.
So if I park a car in the middle of an intersection, it blocks traffic? Wow, another failing of so-called "smart-tech", which should be able to identify assholes blocking traffic and honk the horn, yell profanities, and flick them off just like a human driver can.
I don't want to cause damage. I just want to hack the system to get all the green lights.
Have gnu, will travel.
With a government system that tracks vehicle location and behavior? It will get perverted. Maybe Google or Facebook will buy or sell the information so they can target russian fake news at you while you're moving. George Orwell is probably spinning like high speed roller in his grave.
Ivan, Ivan, Ivan - you live in *Moscow* and you're sexually frustrated? You really need to get out more.
Just quit with all the automated light crap already. The best traffic flow I've ever seen is in parts of Chicago. Where they still have electromechanical timers* and just sync them for a given speed between lights. Yeah, this won't keep some Aspie from freaking out at 1:00AM if he pulls up to a red light and still has to wait for an empty intersection. But who cares?
*The only benefit I can see for networked signals is the ability to reset them quickly following a power outage.
Have gnu, will travel.
REMEMBER THE MURDER OF IAN MURDOCH, creator of Debian Linux and leading member of the Free Software community, killed Christmas 2015 by the notoriously corrupt San Francisco police department.
One idiot can rubberneck, drive slow or attempt to drive whilst playong with their phone and it will bring traffic to a crawl for miles.
God forbid any flashing lights are visible because everyone and their brother has to stop and gawk at them.
Malicious can be both intentional or otherwise. The results are the same for 'smart' or standard traffic.
can already block an intersection. This is nothing new.
- Set up spoofers on the streets behind and paralleling your bank heist escape route to maximum police response time.
- Install a spoofer in your competitor's taxi/uber/delivery van.
- Install spoofers on the route from the pizza place to your house. 30 minutes or it's free?
Support Right To Repair Legislation.
A single benign police officer, placed in a Boston intersection, can mess up traffic in the entire city.
get rich quick: rob a security van, block the streets with a malicious smart car, escape through the sewer system.
Nullius in verba
"More precisely, it targets V2I (vehicle-to-infrastructure) protocols, and more precisely the I-SIG system implemented in the US."
Sideshow Bob: Your children are no more than a pair of ill-bred troublemakers.
Homer: Lisa too?
SSB: Especially Lisa... But ESPECIALLY Bart.
Go ahead. I know you're thinking it already.
Bicycle.
How can they fix that? The thing require authenticating vehicles, which probably means loading a digital certificate in it. But soon or later, keys will leak.
Perhaps the whole thing was a bad idea, after all.
So the system works as intended? When a vehicle stops and blocks traffic (whether intentional or due to a crash or breaking down), traffic is routed away from it. What's the problem here?
How's life in the hypocrite lane?
And no one was surprised. Or, at least, they shouldn't have been.
Did someone say doughnuts in the intersection?
This happened where I live not long ago.
http://www.cbc.ca/news/canada/newfoundland-labrador/corvette-does-doughnuts-on-kenmount-road-scares-drivers-upsets-car-group-1.3085979