5 ms·

That requires physical presence whereas these sorts of attacks can be undertaken remotely. And to actually use that as an attack, as the article points out, you

That requires physical presence whereas these sorts of attacks can be undertaken remotely. And to actually use that as an attack, as the article points out, you need to do it to a lot of intersections which is hard to scale when you need to actually be physically present. Plus, what happens if there are flaws in the control system that you can exploit via those kind of attack via a car. Like turning all the lights green at the same time.

jameshart 2y ago
This is just rampant speculation. The attack shown here requires a transmitting device to be physically present at the intersection, and the impact it was able to have on the system was “to increase the total delay by as high as 68.1%” This isn’t a vector for a mass hack of traffic lights with enormous safety consequences like in the Italian Job. It’s just a mechanism by which a malicious user can degrade public infrastructure. There are lots of ways in which malicious users can degrade public infrastructure. Usually though people don’t. When people do we have laws to prosecute them with.
- ElevenLathe 2y ago
  This is a little trickier because if you just park your car in the middle of an intersection, it's obvious who is the problem (it's you, or at least the car even if it can't be traced back to you). If the problem can be anybody with a few dollars' worth of electronics within 100ft of an intersection, then it isn't so obvious. Now we need FCC party vans, or at least the cops need another doohickey now.
  - jameshart 2y ago
    Right. And you think people will plant electronic doohickeys at junctions in order to make them 60% less efficient? The kind of ne’erdowells who get their kicks by getting away with recklessly causing mild inconveniences to other people? What else might they do if left unchecked? Hog all the WiFi bandwidth at the library? Put some plastic into the cardboard recycling bin?
    - ceejayoz 2y ago
      > Right. And you think people will plant electronic doohickeys at junctions in order to make them 60% less efficient? I think they'll compromise the gas station chain's IOT devices. Similar to when the POS devices for Target were attacked in 2013. They didn't have to have someone taking the in-person risk of going up to each device in person; they hacked a small HVAC company in PA that had "remote access to Target’s network for electronic billing, contract submission, and project management purposes". https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883 https://www.commerce.senate.gov/services/files/24d3c229-4f2f...
      - jameshart 2y ago
        Join the dots between that kind of acquisitive, financially motivated crime, and the posited threat model for smart traffic lights. I don’t understand how someone can make money by disrupting the light cycle to make it a bit less optimal.
        idontpost 2y ago
        [dead]
        genocidicbunny 2y ago
        It's not always about money. Sometimes there's a larger goal of just being disruptive. Imagine gridlock traffic on an election day. Imagine that traffic being mainly focused on voting districts that are likely to vote for a specific candidate.
- akira2501 2y ago
  > a transmitting device to be physically present at the intersection Drones exist. If I slap one of these on the side of an autonomous taxi cab.. how long until they notice? That's a huge fleet ripe for abuse in this way. > When people do we have laws to prosecute them with. This does not relieve the government from responsibly using our tax dollars when creating and delivering these implementations. Papering over real consequences with an after the fact jurisprudence is immensely irresponsible.
  - jameshart 2y ago
    Please explain the motivation and logistics behind your diabolical supervillain scheme that involves deploying a fleet of robotaxis to disrupt the traffic light cycles across the city and reduce the efficiency gain of a few junctions versus an optimized light cycle by a little over 60%, and then perhaps I will understand why you think the government should spend a single cent mitigating that threat.
    - deleted 2y ago
      [deleted]
    - genocidicbunny 2y ago
      Motivation: I want to hurt, annoy and disrupt the lives on Americans, even in seemingly insignificant ways. My purpose is to cause chaos. Logistics: I am financed by a nation/state unfriendly with the US. You could say that no nation state would shell out the money for something like this, but as long as it's relatively cheap (<$100k) and causes disruptive chaos, there will always be buyers for this kind of capability.
      - shrimp_emoji 2y ago
        I'd like to sponsor that just because I like pranks--I mean social experiments.
DougN7 2y ago
Having spoken to a friend who does traffic for a city, traffic light controllers are generally (always?) hard-wired to prevent an all green-type situation, but they have other weaknesses which I won’t go into.
- kjkjadksj 2y ago
  All the stuff is super physically unsecured too. You see people routinely popping the plate off telephone poles and illegally tapping into the powerlines. If someone knew what they were doing they could probably hook into the lines that control signal timing and do whatever. Throw on a high vis vest and people will think you are supposed to be doing whatever you are doing.
- capitainenemo 2y ago
  I did work on those for a while many years ago. I don't know if things have changed but many signal controllers had the ability to disable the conflict monitor without going into flash which could be helpful when working on them, but could certainly be abused. And yeah. cabinets are often left unlocked.
- anticensor 2y ago
  Let me guess: they are surprisingly easy to force them into all reds.
kjkjadksj 2y ago
You don't have to physically be there even today to shut down an intersection. Just drop the intersection you'd like to shut down into some form of social media followed by these car sideshow people, tell them everyone will be there, they show up and what do you know everyone you've told is there, besides you of course, tearing up their tires and creating congestion for probably dozens of blocks nearby this intersection where nothing is moving at all except these fast n furious wannabes. Not to mention the cost to the public of rousing cops and potentially helicopters to deal with this. Much more effective and costly to the public than this strategy that only results in a bit more traffic than usual, and can be done today. Maybe its already being done.
mcswell 2y ago
"Like turning all the lights green at the same time": This was the theme of a scifi short story (later expanded into a book) back in the 1960s.

jameshart 2y ago

This is just rampant speculation. The attack shown here requires a transmitting device to be physically present at the intersection, and the impact it was able to have on the system was “to increase the total delay by as high as 68.1%” This isn’t a vector for a mass hack of traffic lights with enormous safety consequences like in the Italian Job. It’s just a mechanism by which a malicious user can degrade public infrastructure. There are lots of ways in which malicious users can degrade public infrastructure. Usually though people don’t. When people do we have laws to prosecute them with.

ElevenLathe 2y ago
This is a little trickier because if you just park your car in the middle of an intersection, it's obvious who is the problem (it's you, or at least the car even if it can't be traced back to you). If the problem can be anybody with a few dollars' worth of electronics within 100ft of an intersection, then it isn't so obvious. Now we need FCC party vans, or at least the cops need another doohickey now.
- jameshart 2y ago
  Right. And you think people will plant electronic doohickeys at junctions in order to make them 60% less efficient? The kind of ne’erdowells who get their kicks by getting away with recklessly causing mild inconveniences to other people? What else might they do if left unchecked? Hog all the WiFi bandwidth at the library? Put some plastic into the cardboard recycling bin?
  - ceejayoz 2y ago
    > Right. And you think people will plant electronic doohickeys at junctions in order to make them 60% less efficient? I think they'll compromise the gas station chain's IOT devices. Similar to when the POS devices for Target were attacked in 2013. They didn't have to have someone taking the in-person risk of going up to each device in person; they hacked a small HVAC company in PA that had "remote access to Target’s network for electronic billing, contract submission, and project management purposes". https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883 https://www.commerce.senate.gov/services/files/24d3c229-4f2f...
    - jameshart 2y ago
      Join the dots between that kind of acquisitive, financially motivated crime, and the posited threat model for smart traffic lights. I don’t understand how someone can make money by disrupting the light cycle to make it a bit less optimal.
      - idontpost 2y ago
        [dead]
      - genocidicbunny 2y ago
        It's not always about money. Sometimes there's a larger goal of just being disruptive. Imagine gridlock traffic on an election day. Imagine that traffic being mainly focused on voting districts that are likely to vote for a specific candidate.
akira2501 2y ago
> a transmitting device to be physically present at the intersection Drones exist. If I slap one of these on the side of an autonomous taxi cab.. how long until they notice? That's a huge fleet ripe for abuse in this way. > When people do we have laws to prosecute them with. This does not relieve the government from responsibly using our tax dollars when creating and delivering these implementations. Papering over real consequences with an after the fact jurisprudence is immensely irresponsible.
- jameshart 2y ago
  Please explain the motivation and logistics behind your diabolical supervillain scheme that involves deploying a fleet of robotaxis to disrupt the traffic light cycles across the city and reduce the efficiency gain of a few junctions versus an optimized light cycle by a little over 60%, and then perhaps I will understand why you think the government should spend a single cent mitigating that threat.
  - deleted 2y ago
    [deleted]
  - genocidicbunny 2y ago
    Motivation: I want to hurt, annoy and disrupt the lives on Americans, even in seemingly insignificant ways. My purpose is to cause chaos. Logistics: I am financed by a nation/state unfriendly with the US. You could say that no nation state would shell out the money for something like this, but as long as it's relatively cheap (<$100k) and causes disruptive chaos, there will always be buyers for this kind of capability.
    - shrimp_emoji 2y ago
      I'd like to sponsor that just because I like pranks--I mean social experiments.

DougN7 2y ago

Having spoken to a friend who does traffic for a city, traffic light controllers are generally (always?) hard-wired to prevent an all green-type situation, but they have other weaknesses which I won’t go into.

kjkjadksj 2y ago
All the stuff is super physically unsecured too. You see people routinely popping the plate off telephone poles and illegally tapping into the powerlines. If someone knew what they were doing they could probably hook into the lines that control signal timing and do whatever. Throw on a high vis vest and people will think you are supposed to be doing whatever you are doing.
capitainenemo 2y ago
I did work on those for a while many years ago. I don't know if things have changed but many signal controllers had the ability to disable the conflict monitor without going into flash which could be helpful when working on them, but could certainly be abused. And yeah. cabinets are often left unlocked.
anticensor 2y ago
Let me guess: they are surprisingly easy to force them into all reds.

kjkjadksj 2y ago

You don't have to physically be there even today to shut down an intersection. Just drop the intersection you'd like to shut down into some form of social media followed by these car sideshow people, tell them everyone will be there, they show up and what do you know everyone you've told is there, besides you of course, tearing up their tires and creating congestion for probably dozens of blocks nearby this intersection where nothing is moving at all except these fast n furious wannabes. Not to mention the cost to the public of rousing cops and potentially helicopters to deal with this. Much more effective and costly to the public than this strategy that only results in a bit more traffic than usual, and can be done today. Maybe its already being done.

mcswell 2y ago

"Like turning all the lights green at the same time": This was the theme of a scifi short story (later expanded into a book) back in the 1960s.