Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Give Me the Green Light Part 1: Hacking Traffic Control Systems

redthreatsec.com

Post reply on HN
Print view View original

41–50 of 94 posts

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#41

Post by EvanAnderson »

hunter2_ wrote: post #36
magmastonealex wrote: post #24

This is a great introduction to the mess that is traffic signal controllers! The reality is perhaps even worse than the article suggests. The majority of signal controllers support the NTCIP "standard" MIBs in addition to the "proprietary" MIBs that are provided through FreeTheMIBs. These "standard" MIBs are defined in standards like NTCIP 1202[1], which are freely available online through the NTCIP group. These stan…

> for any traffic controller you happen to find on a network But how would one get on such "a network" in the first place? I assume it would involve physically opening a (hopefully locked) cabinet in public near the road? So just a bit of cutting/picking reveals an ethernet port, you drop in a wireless bridge, close it back up, and then hack from a parked car?

I am aware of a municipality local to me that, as part of a franchise agreement for a new ISP entering the community, had the ISP run fiber to every traffic cabinet. They're connected back to the city network in a VLAN that's "behind the firewall". >sigh<

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#42

Post by rootusrootus »

magmastonealex wrote: post #30
megous wrote: post #26

Earlier quoted context omitted.

How about switching lights in quick succession, enough to cause real-world issue, but avoiding the direct conflict?

Now you start to get into the differences between the various standards :) In NEMA TS2 (and the more modern ITE ATC), the MMU does enforce a yellow clearance time - you need the light to turn yellow for a period of time before a conflicting phase goes green. Usually this is a few seconds. Changing phases rapidly would likely confuse drivers, but in _theory_ shouldn't cause a collision if people respect yellows. (beli…

> (believe it or not, in some localities a "red clearance" time - all red - is not required and lights will go from yellow in one direction to green in another.)

This was definitely true in the past, I feel like the concept of a 'red clearance time' is something that only became common within the last 5-10 years. Do you think it has become (with rare exceptions) ubiquitous at this point?

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#43

Post by SoftTalker »

EvanAnderson wrote: post #41
hunter2_ wrote: post #36

Earlier quoted context omitted.

> for any traffic controller you happen to find on a network But how would one get on such "a network" in the first place? I assume it would involve physically opening a (hopefully locked) cabinet in public near the road? So just a bit of cutting/picking reveals an ethernet port, you drop in a wireless bridge, close it back up, and then hack from a parked car?

I am aware of a municipality local to me that, as part of a franchise agreement for a new ISP entering the community, had the ISP run fiber to every traffic cabinet. They're connected back to the city network in a VLAN that's "behind the firewall". >sigh<

Because of course a controller for a traffic light needs gigabit fiber internet connectivity....

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#44

Post by rootusrootus »

jeffbee wrote: post #19

If you just want a green light an easier way to get one is to flash the infrared strobe pattern that gives fire trucks green lights. Seems simpler.

It has been years since I have seen a fire truck get a green light through preemption. It probably varies by jurisdiction, but around here the preemption just causes the entire intersection to go red. Then the emergency vehicle can navigate across carefully.

In addition to being basically useless as a trick these days, it is also trivially easy to detect an IR strobe being used, and the penalty can be hefty.

Fun fact: In some places, there are strobes on the signal that activate when it has been preempted, to let everyone know an emergency vehicle is coming through.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#45

Post by EvanAnderson »

pixl97 wrote: post #10
jagged-chisel wrote: post #6

Earlier quoted context omitted.

Anyone has the “ability” and freedom to make threats under the CFAA. Because there are no consequences for doing so. This particular company wouldn’t get the feds to prosecute this case. Another annoying problem is that this company seems to think that their “policy” overrides first sale doctrine wrt their products: ‘we don’t know where or how you got that device, therefore CFAA violation threat.’

You may not get the feds to prosecute the case, but it's very possible for the feds to investigate you with varying levels of fervor. If you're a well lawyered security researcher this is probably fine. If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things.

> If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things.

This is exactly what I tell my coworkers who are getting into security. Keep your mouth shut about anything you find unless you have a reporting channel that leads to a "well lawyered" security company.

I've found vulnerabilities that I would have loved to disclose, but being a lowly IT generalist, I'm not going to stick my neck out. I can't imagine my employer would like the press.

I use one-off email addresses at my personal domain and historically warned companies that I was seeing spam to one-off addresses as possible indications of a data breach. By and large I was ignored, but occasionally I received a word of thanks. Even more occasionally I received notes of thanks that, in fact, I had uncovered a data breach.

Once, however, I received a nasty response insinuating that I'd breached their systems. The person I contacted didn't, apparently, understand what I was saying. They were confused that their company name was to the left of the "@" in my email address.

That was enough for me. I decided I was done reporting those events. Too much risk.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#46

Post by rootusrootus »

sdwr wrote: post #22

This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't harden themselves against all attack vectors, while they are responsible for a good part of the danger. Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). No…

> Out in meatspace, I don't wander around picking random people's locks

Sure, because the chances of getting punched out, shot, or reported to the cops is significantly higher. Given how trivial it is to quietly attack across the network, I think the analogy with meatspace makes little sense.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#47

Post by SoftTalker »

magmastonealex wrote: post #21
mcswell wrote: post #20

Can you turn all the lights at a given intersection green at the same time?

Generally no, this is something from fiction. I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet. That device will catch so-called "conflicts" (two conflicting directions green at the same time) and put the intersection into a fail-safe state (u…

In the old timer-and-cam based systems I also believe this was electrically impossible. IIRC the green light in one direction was grounded through the green light in the crossing direction. So it was impossible for both of them to be on at the same time.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#49

Post by ddulaney »

SoftTalker wrote: post #43
EvanAnderson wrote: post #41

Earlier quoted context omitted.

I am aware of a municipality local to me that, as part of a franchise agreement for a new ISP entering the community, had the ISP run fiber to every traffic cabinet. They're connected back to the city network in a VLAN that's "behind the firewall". >sigh<

Because of course a controller for a traffic light needs gigabit fiber internet connectivity....

That’s not the scary thing here. Better to future-proof it.

Running presumably unencrypted SNMP over shared lines is sketchy.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#50

Post by EvanAnderson »

magmastonealex wrote: post #21
mcswell wrote: post #20

Can you turn all the lights at a given intersection green at the same time?

Generally no, this is something from fiction. I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet. That device will catch so-called "conflicts" (two conflicting directions green at the same time) and put the intersection into a fail-safe state (u…

> I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet.

Presumably the logic for this MMU could be implemented in strictly electrical components (relays or such). That would give me the most comfort (since its functionality would be, literally hard-wired).

I worry that some enterprising manufacturer, out to save a few bucks, would implement this functionality in a microcontroller with firmware that could be updated remotely.

Does the standard specify the functionality of the MMU must be hard-wired, or at the very least not able to be changed without physical access?

Post reply on HN