Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Give Me the Green Light Part 1: Hacking Traffic Control Systems

redthreatsec.com

Post reply on HN
Print view View original

31–40 of 94 posts

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#31

Post by [deleted] »

megous wrote: post #26
magmastonealex wrote: post #21

Earlier quoted context omitted.

Generally no, this is something from fiction. I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet. That device will catch so-called "conflicts" (two conflicting directions green at the same time) and put the intersection into a fail-safe state (u…

How about switching lights in quick succession, enough to cause real-world issue, but avoiding the direct conflict?

[deleted]

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#32

Post by floatrock »

the_real_cher wrote: post #15

Why wouldn't defcon allow this to be presented?

> my CFP wasn’t accepted

Don't know their specific process, but this sounds like "we got a bunch of submissions and yours didn't make the cut."

Honestly, rather than this being a nefarious "too dangerous even for defcon" like your wording suggests, I think the author knows why it didn't make the cut and snarkily addressed it:

> I’d love to write a long detailed blog about getting a root shell via UART or extracting the firmware via JTAG and then reversing it, but the honest truth is I found a vulnerability in the webapp in the first 15 minutes of having the unit online and it was the first thing I tried.

So my guess is so basic it just wasn't interesting enough. /shrug

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#33

Post by floatrock »

sdwr wrote: post #22

This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't harden themselves against all attack vectors, while they are responsible for a good part of the danger. Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). No…

> Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). Nobody would be happy about that, no matter what color hat I have on.

Yeah, but in youtube space, there are, eg, lawyers who are into lockpicking who post smug videos showing how vulnerable various manufacturers' locks really are to common lockpicking techniques. Apparently 4.5M subscribers are quite happy being informed what the state of lock security is out there.

https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#34

Post by rvnx »

yojo wrote: post #29
sdwr wrote: post #22

This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't harden themselves against all attack vectors, while they are responsible for a good part of the danger. Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). No…

I assume that any piece of technologically backed infrastructure is a potential target for state-level actors. If rando security researcher finds the vuln in 15 minutes, I guarantee China already has it. Anyone operating infrastructure hardware is negligent if they won't take basic measures to harden it against disclosed threats. I’m not worried about malfeasant citizens mucking with the traffic lights, there are sim…

When you work for a state-actor it's no different than anywhere else; you don't have exploits coming out of the sky.

You either research these vulnerabilities (and you have limited capacity and knowledge) or you purchase vulnerabilities from vendors, exchanges and "research companies".

In such case, it was an unnecessary free gift to an enemy state or a malicious actor.

The same with NSA, they do not know all the vulns of the universe (due to budget, resources, or simply focus).

You may actually have some vulns they are interested into but unless someone points these vulns to them, they will not get aware that they exists.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#35

Post by patrickmay »

sdwr wrote: post #27
megous wrote: post #25

Earlier quoted context omitted.

Company makes HW that can potentially harm people, if someone logs in to it remotely and turns all lights green at once. It's possible to find the vulnerability in 15 minutes of getting remote access to the device without any prior knowledge, that gives admin access to the HW. Company rejects the report based on flmisy reasons via a lawyer, threatening with a felony prosecution. But the person finding the vulnerabili…

There are electrical junction boxes all over my neighborhood, that direct power to the stoplights and residential buildings (?). They have a simple padlock, and could be opened in 30 seconds with a lockpick or bolt cutters. Nobody tries! Not even to test it out! The question isn't "How easy is it to break in?", but rather "Should I be tampering with this?"

Your analogy breaks down immediately because the Internet isn't your neighborhood, it's effectively everyone's neighborhood, including the state-level bad actors mentioned above.

If someone could access those electrical junction boxes from China or North Korea, I'd want the locals finding the vulnerabilities first.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#36

Post by hunter2_ »

magmastonealex wrote: post #24

This is a great introduction to the mess that is traffic signal controllers! The reality is perhaps even worse than the article suggests. The majority of signal controllers support the NTCIP "standard" MIBs in addition to the "proprietary" MIBs that are provided through FreeTheMIBs. These "standard" MIBs are defined in standards like NTCIP 1202[1], which are freely available online through the NTCIP group. These stan…

> for any traffic controller you happen to find on a network

But how would one get on such "a network" in the first place? I assume it would involve physically opening a (hopefully locked) cabinet in public near the road? So just a bit of cutting/picking reveals an ethernet port, you drop in a wireless bridge, close it back up, and then hack from a parked car?

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#37

Post by rvnx »

patrickmay wrote: post #35
sdwr wrote: post #27

Earlier quoted context omitted.

There are electrical junction boxes all over my neighborhood, that direct power to the stoplights and residential buildings (?). They have a simple padlock, and could be opened in 30 seconds with a lockpick or bolt cutters. Nobody tries! Not even to test it out! The question isn't "How easy is it to break in?", but rather "Should I be tampering with this?"

Your analogy breaks down immediately because the Internet isn't your neighborhood, it's effectively everyone's neighborhood, including the state-level bad actors mentioned above. If someone could access those electrical junction boxes from China or North Korea, I'd want the locals finding the vulnerabilities first.

Hypothetic answer from state-actor:

"We will push an update to Flipper Zero for this, the right moment.

Thanks to the Flipper Zero, we have millions of devices in the wild that we can remotely control and send signals from. Just wait."

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#38

Post by rvnx »

qual wrote: post #28
sdwr wrote: post #22

This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't harden themselves against all attack vectors, while they are responsible for a good part of the danger. Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). No…

Could you help me understand what you are suggesting is done instead? To me, it seems like you're suggesting that vulnerabilities are just left in play until someone malicious comes along and decides to do some real damage. But that seems so silly that I must be missing some alternative that you're thinking about.

You've noticed an issue.

You let the manufacturer know, and you let them decide for the next steps.

No ultimatum to threaten to disclose to the public or to ruin their reputation, it's not your business.

In the meantime, you keep it for yourself.

You helped: no lawyers, no problems.

If really there is a safety issue, after a reasonable period of time you can inform the regulators, as it is their job to assess safety.

This is responsible disclosure, not TMZ-style public-shaming.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#39

Post by hunter2_ »

qual wrote: post #28
sdwr wrote: post #22

This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't harden themselves against all attack vectors, while they are responsible for a good part of the danger. Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). No…

Could you help me understand what you are suggesting is done instead? To me, it seems like you're suggesting that vulnerabilities are just left in play until someone malicious comes along and decides to do some real damage. But that seems so silly that I must be missing some alternative that you're thinking about.

> vulnerabilities are just left in play until someone malicious comes along and decides to do some real damage. But that seems so silly

Well, that's exactly how it tends to work for housing, so I think GP's point is that if it works there it should work here. However, I disagree because the stakes are so different (harming a single family who are free to harden however they like, versus harming the general public who are at the mercy of whatever hardening is done for them).

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#40

Post by qual »

rvnx wrote: post #38
qual wrote: post #28

Earlier quoted context omitted.

Could you help me understand what you are suggesting is done instead? To me, it seems like you're suggesting that vulnerabilities are just left in play until someone malicious comes along and decides to do some real damage. But that seems so silly that I must be missing some alternative that you're thinking about.

You've noticed an issue. You let the manufacturer know, and you let them decide for the next steps. No ultimatum to threaten to disclose to the public or to ruin their reputation, it's not your business. In the meantime, you keep it for yourself. You helped: no lawyers, no problems. If really there is a safety issue, after a reasonable period of time you can inform the regulators, as it is their job to assess safety.…

You're presenting this as if its a new idea, but the security industry tried the above (for the majority of the time that "computer security" has been a thing) and... it didn't work! That's the whole reason public disclosure came about in the first place -- there's quite a rich history there if you're interested.

Some other thoughts:

>You let the manufacturer know, and you let them decide for the next steps.

Which, as history has proven, the "next steps" is generally to sweep it under the rug and to be forgotten about until it's exploited by a bad actor.

>it's not your business

But, what about when it is? On-topic: I drive a car, so I care about vulnerabilities in traffic lights and they may directly affect me. It's also my business if my personal data is stolen, or my identity, or corporate data, etc.

>You helped: no lawyers, no problems.

No problems... Until the vulnerability is exploited and it causes me a problem.

Post reply on HN