Researchers Prove That Wirelessly Hacking Traffic Lights Is A Frighteningly Real Threat
Word to the wise -- be careful crossing through intersections, even when you have a green light. We don't want to overstate the threat, but apparently you really can hack into a traffic signal and change the light, just as you've seen in countless Hollywood films featuring the token computer hacker. This was proven by a team of researchers at the University of Michigan.
The small team of five consisting of students from the school's electrical engineering and computer science departments published a paper title "Green Lights Forever (PDF)," and in it, they outlined the discovery of a "number of security flaws that exist due to systemic failures by the designers." Moreover, they explained in the paper that a would-be attacker doesn't need physical access to any part of the traffic infrastructure.
"Many of the problems we discovered during our investigation were problems with the wireless network configuration," the researchers wrote. "The 5.8GHz radios used in the deployment are more vulnerable to attack than the 900MHz radios. SSID broadcasting should be disabled on this network. While this does little to deter a determined adversary, it prevents casual observers and curious teenagers from noticing that the networks exist. The 5.8GHz radios support WPA2 encryption and it should be enabled in the field."
Once a traffic signal is hacked into, the attacker has an assortment of options at his or her disposal. These range from denial of service attacks to deliberately causing traffic congestion and/or unsafe driving conditions by messing with the timings of lights. An attacker can even control the lights for personal gain. For example, lights could be changed to green along the route the attacker is driving, and automatically reset to normal once the hacker passes through an intersection.
Traffic signals don't usually come to mind when thinking about security threats, but given the lack of attention being paid to them, hackers and criminals could do some real damage by mucking with lights. It's not far fetched to envision someone planning a bank robbery or some other crime around a hacker's ability to create a massive traffic jam on streets where police and other emergency vehicles would need to travel.
"The real problem, however, is not any individual vulnerability, but a lack of security consciousness in the field," the researchers concluded. "A clear example can be seen in the response of the traffic controller vendor to our vulnerability disclosure. It stated that the company, 'has followed the accepted industry standard and it is that standard which does not include security.'"
The small team of five consisting of students from the school's electrical engineering and computer science departments published a paper title "Green Lights Forever (PDF)," and in it, they outlined the discovery of a "number of security flaws that exist due to systemic failures by the designers." Moreover, they explained in the paper that a would-be attacker doesn't need physical access to any part of the traffic infrastructure.
"Many of the problems we discovered during our investigation were problems with the wireless network configuration," the researchers wrote. "The 5.8GHz radios used in the deployment are more vulnerable to attack than the 900MHz radios. SSID broadcasting should be disabled on this network. While this does little to deter a determined adversary, it prevents casual observers and curious teenagers from noticing that the networks exist. The 5.8GHz radios support WPA2 encryption and it should be enabled in the field."
Once a traffic signal is hacked into, the attacker has an assortment of options at his or her disposal. These range from denial of service attacks to deliberately causing traffic congestion and/or unsafe driving conditions by messing with the timings of lights. An attacker can even control the lights for personal gain. For example, lights could be changed to green along the route the attacker is driving, and automatically reset to normal once the hacker passes through an intersection.
Traffic signals don't usually come to mind when thinking about security threats, but given the lack of attention being paid to them, hackers and criminals could do some real damage by mucking with lights. It's not far fetched to envision someone planning a bank robbery or some other crime around a hacker's ability to create a massive traffic jam on streets where police and other emergency vehicles would need to travel.
"The real problem, however, is not any individual vulnerability, but a lack of security consciousness in the field," the researchers concluded. "A clear example can be seen in the response of the traffic controller vendor to our vulnerability disclosure. It stated that the company, 'has followed the accepted industry standard and it is that standard which does not include security.'"
