Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Give Me the Green Light Part 1: Hacking Traffic Control Systems

redthreatsec.com

Post reply on HN
Print view View original

71–80 of 94 posts

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#71

Post by slantedview »

EvanAnderson wrote: post #45
pixl97 wrote: post #10

Earlier quoted context omitted.

You may not get the feds to prosecute the case, but it's very possible for the feds to investigate you with varying levels of fervor. If you're a well lawyered security researcher this is probably fine. If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things.

> If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things. This is exactly what I tell my coworkers who are getting into security. Keep your mouth shut about anything you find unless you have a reporting channel that leads to a "well lawyered" security company. I've found vulnerabilities…

> I was seeing spam to one-off addresses as possible indications of a data breach

For the uninformed, how does spam to an address on your domain indicate a breach of someone else's system?

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#72

Post by mmsc »

sdwr wrote: post #22

This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't harden themselves against all attack vectors, while they are responsible for a good part of the danger. Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). No…

I think a better analogy is wandering around noting what locks random peoples' houses use, buying your own, breaking your own, informing the manufacturer of the flaw, and then informing the owners of the random peoples' houses.

AKA what criminals already do, except the criminals actually break into the random peoples' homes and steal their stuff.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#73

Post by EvanAnderson »

slantedview wrote: post #71
EvanAnderson wrote: post #45

Earlier quoted context omitted.

> If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things. This is exactly what I tell my coworkers who are getting into security. Keep your mouth shut about anything you find unless you have a reporting channel that leads to a "well lawyered" security company. I've found vulnerabilities…

> I was seeing spam to one-off addresses as possible indications of a data breach For the uninformed, how does spam to an address on your domain indicate a breach of someone else's system?

I sign-up for a service using "123abc-theirdomain.com@mydomain.com" as the email address. Messages to that address come to my "Inbox". I don't use the address for anything else. I never send a message with that address.

Years pass.

I start receiving email solicitations for erectile dysfunction remedies and, oddly, woodworking plans (what is it with the spam for shed plans?) to that address.

Either my address was sold or a data breach occurred.

(It could have been my own data breached, but it seems unlikely, if that did happen, that the result would be me receiving spam only to that one specific address.)

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#74

Post by winsome »

magmastonealex wrote: post #65
debatem1 wrote: post #58

Earlier quoted context omitted.

I'd be pretty interested in working on this kind of critical infrastructure. Any tips or pointers for an experienced SE/SWE on getting into your world?

I sort of accidentally stumbled into it when I joined an (at the time) startup as they were just getting into the market. So I don't know that I have anything specific to offer :) I don't want to name names for companies in the industry, but you can find them in industry publications like Traffic Technology Today, or often as contributors to the standards documents like NTCIP 1202, ITE ATC 5301, etc. I will say that…

You sound like me. Stumbled into the industry at a startup (different than the one you're at -- you could probably guess which one) and have been around a while now. The condition of our traffic infrastructure is terrifying, frankly.

I was shocked when I learned that NTCIP was built on top of SNMPv1. To make matters worse, there are actually people in the industry against the adoption SNMPv3. That would at least adds a modicum of security via authentication and encryption. I'd prefer we build around another protocol entirely.

Imagine if folks at IBM knew we still used SDLC as the backbone of our communication in the cabinets...

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#75

Post by IshKebab »

23july2024 wrote: post #5

Part 2 article goes into a bit more of detail, but the funniest thing is that they requested access to the SNMP MIBs of the controller and never got them > I requested MIBs from Q-Free but didn’t receive any follow-up after the request and I never received access to the MIBS, so it was back to square one. Then you go look at https://www.freethemibs.org/advocates and... there they are, "advocates" for free MIB access.…

What are SNMP and MIBs?

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#76

Post by TheCleric »

qingcharles wrote: post #23
upwardbound wrote: post #14

Earlier quoted context omitted.

We do have that now, as of 2022! The new Justice Department policy now instructs prosecutors not to prosecute security researchers who acted in good faith for the public benefit and who avoided any harm to individuals or the public. https://www.justice.gov/opa/pr/department-justice-announces-...

That checks off federal cases, but there are still options for a corporation under what are normally much stricter state laws in the USA. For instance, in Illinois you can get up to 5 years in prison for violating the ToS of a web site.

As well I think that would still leave you exposed for a civil suit, which even if you win, can be financially devastating. What would be needed is an anti-SLAPP type legislation at the state and federal level to mitigate it.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#77

Post by TheCleric »

rootusrootus wrote: post #44
jeffbee wrote: post #19

If you just want a green light an easier way to get one is to flash the infrared strobe pattern that gives fire trucks green lights. Seems simpler.

It has been years since I have seen a fire truck get a green light through preemption. It probably varies by jurisdiction, but around here the preemption just causes the entire intersection to go red. Then the emergency vehicle can navigate across carefully. In addition to being basically useless as a trick these days, it is also trivially easy to detect an IR strobe being used, and the penalty can be hefty. Fun fact…

Yeah near me (mid-sized metro area) they just hit the intersection with lights and sirens and creep forward until they’re sure they won’t get t-boned. Light sequence never changes.

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#78

Post by bagels »

upwardbound wrote: post #14
teeray wrote: post #3

If we’re as serious about cybersecurity as all the noise that gets made about it indicates, we really need legal immunity for unsolicited responsible disclosure. You shouldn’t have any ability to beat someone with the CFAA who is trying to help you.

We do have that now, as of 2022! The new Justice Department policy now instructs prosecutors not to prosecute security researchers who acted in good faith for the public benefit and who avoided any harm to individuals or the public. https://www.justice.gov/opa/pr/department-justice-announces-...

Policy can change, retrospectively even

Re: Give Me the Green Light Part 1: Hacking Traffic Control Systems

#79

Post by codewench »

IshKebab wrote: post #75
23july2024 wrote: post #5

Part 2 article goes into a bit more of detail, but the funniest thing is that they requested access to the SNMP MIBs of the controller and never got them > I requested MIBs from Q-Free but didn’t receive any follow-up after the request and I never received access to the MIBS, so it was back to square one. Then you go look at https://www.freethemibs.org/advocates and... there they are, "advocates" for free MIB access.…

What are SNMP and MIBs?

SNMP stands for Simple Network Management Protocol, and is a way to directly address not just individual hardware elements, but to access specific functions or methods within that device via a "simple" addressing scheme. A MIB file describes the various endpoints available on a device, much like a wsdl file would describe a SOAP endpoint.

So you might have an SNMP address like 2.1.4.3.0.1* which the MIB file would translate to "the current temp for CPU1"

Post reply on HN