17 ms·

Give Me the Green Light Part 1: Hacking Traffic Control Systems

186 points by danso 2y ago

teeray 2y ago
If we’re as serious about cybersecurity as all the noise that gets made about it indicates, we really need legal immunity for unsolicited responsible disclosure. You shouldn’t have any ability to beat someone with the CFAA who is trying to help you.
- jagged-chisel 2y ago
  Anyone has the “ability” and freedom to make threats under the CFAA. Because there are no consequences for doing so. This particular company wouldn’t get the feds to prosecute this case. Another annoying problem is that this company seems to think that their “policy” overrides first sale doctrine wrt their products: ‘we don’t know where or how you got that device, therefore CFAA violation threat.’
  - teeray 2y ago
    > Anyone has the “ability” and freedom to make threats under the CFAA. Certainly. What I’m saying is that it should be cheap or free to neutralize their threat. There should be a lawyer-free portal where you can upload their threat letter and your responsible disclosure letter, and get some kind of legal order blessing your work that you can throw back at them.
    - krger 2y ago
      >There should be a lawyer-free portal where you can upload their threat letter and your responsible disclosure letter, and get some kind of legal order blessing your work that you can throw back at them. Who's going to check it to make sure that "your responsible disclosure letter" actually is a responsible disclosure letter and not just nonsense?
      - jasonjayr 2y ago
        The firm funded by fines for making unfounded threats with scary lawyer letters.
  - pixl97 2y ago
    You may not get the feds to prosecute the case, but it's very possible for the feds to investigate you with varying levels of fervor. If you're a well lawyered security researcher this is probably fine. If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things.
    - EvanAnderson 2y ago
      > If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things. This is exactly what I tell my coworkers who are getting into security. Keep your mouth shut about anything you find unless you have a reporting channel that leads to a "well lawyered" security company. I've found vulnerabilities that I would have loved to disclose, but being a lowly IT generalist, I'm not going to stick my neck out. I can't imagine my employer would like the press. I use one-off email addresses at my personal domain and historically warned companies that I was seeing spam to one-off addresses as possible indications of a data breach. By and large I was ignored, but occasionally I received a word of thanks. Even more occasionally I received notes of thanks that, in fact, I had uncovered a data breach. Once, however, I received a nasty response insinuating that I'd breached their systems. The person I contacted didn't, apparently, understand what I was saying. They were confused that their company name was to the left of the "@" in my email address. That was enough for me. I decided I was done reporting those events. Too much risk.
      - slantedview 2y ago
        > I was seeing spam to one-off addresses as possible indications of a data breach For the uninformed, how does spam to an address on your domain indicate a breach of someone else's system?
        EvanAnderson 2y ago
        I sign-up for a service using "123abc-theirdomain.com@mydomain.com" as the email address. Messages to that address come to my "Inbox". I don't use the address for anything else. I never send a message with that address. Years pass. I start receiving email solicitations for erectile dysfunction remedies and, oddly, woodworking plans (what is it with the spam for shed plans?) to that address. Either my address was sold or a data breach occurred. (It could have been my own data breached, but it seems unlikely, if that did happen, that the result would be me receiving spam only to that one specific address.)
  - toss1 2y ago
    Yup. I submit that this sort of threat poisons the well and makes security worse for everyone, including those making the threat (but it's a bit of a commons problem because the worsening security is industry-wide, but for the threat-maker it seems to improve their situation). If I am a person interested in how these systems work, and maybe making some money off my work in the area, this sort of threat, both its severity (potentially years of costly litigation and or/jail) and how frequently it happens (seems we read of such incidents many times per year, which is only the tip of the iceberg) would make someone seriously question the straight white-hat path. Why not find the exploits and sell them on the dark web? One might even justify it with "they wouldn't listen anyway and it's their fault for releasing a system with such stupid vulns." and/or "they'll fix it only when they see real-world consequences and if they don't it doesn't matter". One's moral compass need not be very compromised to lean on such excuses. There REALLY needs to be a Safe Harbor law with basic requirements that the work is documented, first revealed to the company security dept (perhaps citing the Safe Harbor law?), no action taken by the researcher to allow it to be disclosed or released publicly for 90 days, and perhaps a few other reasonable safeguards. and how often it happens
- upwardbound 2y ago
  We do have that now, as of 2022! The new Justice Department policy now instructs prosecutors not to prosecute security researchers who acted in good faith for the public benefit and who avoided any harm to individuals or the public. https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/opa/pr/department-justice-announces-...
  - qingcharles 2y ago
    That checks off federal cases, but there are still options for a corporation under what are normally much stricter state laws in the USA. For instance, in Illinois you can get up to 5 years in prison for violating the ToS of a web site.
    - TheCleric 2y ago
      As well I think that would still leave you exposed for a civil suit, which even if you win, can be financially devastating. What would be needed is an anti-SLAPP type legislation at the state and federal level to mitigate it.
  - bagels 2y ago
    Policy can change, retrospectively even
    - DJBunnies 2y ago
      Yeah it was a kaizen ticket the group filed after the last sprint.
bitwize 2y ago
Just what we need to tie up the cops so we can rollerblade into Grand Central Station and hack the Gibson to get the garbage file that will exonerate Joey! https://m.youtube.com/watch?v=yhVDhcuRY1I https://m.youtube.com/watch?v=yhVDhcuRY1I
- jfactorial 2y ago
  [flagged]
23july2024 2y ago
Part 2 article goes into a bit more of detail, but the funniest thing is that they requested access to the SNMP MIBs of the controller and never got them > I requested MIBs from Q-Free but didn’t receive any follow-up after the request and I never received access to the MIBS, so it was back to square one. Then you go look at https://www.freethemibs.org/advocates https://www.freethemibs.org/advocates and... there they are, "advocates" for free MIB access. What clowns.
- IshKebab 2y ago
  What are SNMP and MIBs?
  - codewench 2y ago
    SNMP stands for Simple Network Management Protocol, and is a way to directly address not just individual hardware elements, but to access specific functions or methods within that device via a "simple" addressing scheme. A MIB file describes the various endpoints available on a device, much like a wsdl file would describe a SOAP endpoint. So you might have an SNMP address like 2.1.4.3.0.1* which the MIB file would translate to "the current temp for CPU1"
  - mceachen 2y ago
    Simple Network Management Protocol. Management Information Base. https://en.m.wikipedia.org/wiki/Management_information_base https://en.m.wikipedia.org/wiki/Management_information_base
hjfjh 2y ago
[flagged]
_qua 2y ago
That's an embarassing letter from the company.
the_real_cher 2y ago
Why wouldn't defcon allow this to be presented?
- floatrock 2y ago
  > my CFP wasn’t accepted Don't know their specific process, but this sounds like "we got a bunch of submissions and yours didn't make the cut." Honestly, rather than this being a nefarious "too dangerous even for defcon" like your wording suggests, I think the author knows why it didn't make the cut and snarkily addressed it: > I’d love to write a long detailed blog about getting a root shell via UART or extracting the firmware via JTAG and then reversing it, but the honest truth is I found a vulnerability in the webapp in the first 15 minutes of having the unit online and it was the first thing I tried. So my guess is so basic it just wasn't interesting enough. /shrug
  - BonusPlay 2y ago
    Sounds like amazing material for a CCC talk.
moritonal 2y ago
Sounds like the company realised they can't solve the issue in 90 days. Betting a combination of infrastructure scale problems, terrible tech, no-longer-building old solutions, no maintenance fee's built in and contractors who hate them. So they pulled the only lever they had left, which was the lawyers. Same time, RedThreat's email was kinda (maybe rightly) hostile. Read from the other side it's basically "You have 90 days to work (/maybe pay) me before you start hearing your name on TickTok under the label 'wanna hack the city?'". "Work with your team" leaves a ton of negotiating opportunity for a company that obviously does this for a living and expects to make money somewhere.
- samtho 2y ago
  The 90 day window is an industry standard for zero-days, how the author worded it is neither here nor there. 90 days is ample time for even a half-functioning organization to address the issue in some way. I agree with Red Threat’s decision to not show their hand in the first email. The altruistic take on this is that they do not want the email to fall upon deaf ears (or even a bad actor within a company) and would prefer to have a channel of communication open with the security team before outlining the details. The biggest problem when faced with a zero-day is that it’s unknown who else knows about it. This helps the the company’s security team justify the work due to the fire lit under the company to take action - especially if their corporate structure does not allow for more “elective” fixes.
  - mike_hearn 2y ago
    90 days isn't really an industry standard. It's what Google unilaterally decided upon when they chose to staff up Project Zero and reflects their assumptions being, as they are, a company that grew up on the web. One of those assumptions is that you have fully automated test processes and the ability to remotely update any/all installs of your software within a week or so, which in turn implies that users aren't involved in the decision about whether to upgrade or not. It also assumes you can do this as often as you want. This is a strong set of assumptions that happens to be true for Google but isn't true of SCADA shops. Even if they make a patched firmware, actually rolling it out would require a lot of work by their customers and of course maybe the same guy finds another security bug after 80 days and the whole thing starts again. Given the unclear threat model here (how does one get access to the networks that these are attached to? could you just hotwire the lights themselves and bypass the controller?) it's also not really obvious how you'd classify reports. If there's a bypassable HTTP login page that's clearly an exploit but customers may not care if they trust the underlying VPNs/firewalls/air gaps. If there's unauthenticated SNMP access by design then is it even intended to be secure against malicious network access at all? In many cases these devices will be reachable from the public internet, and in some of those cases it will be intentional. But is the security bug there on the controller or in the network setup that allows that access? It's probably easier to properly firewall off the controllers than continuously patch all the controller firmwares themselves, especially as the latter done wrong could easily enable hackers to perform a worse-than-Crowdstrike level takedown of all controllers simultaneously. It's really not clear that the model that works well for web browsers will ever work well for infrastructure. We just saw an awesome demo of what can go wrong when rapidly hot-patching security updates into critical infrastructure computers goes wrong.
jeffbee 2y ago
If you just want a green light an easier way to get one is to flash the infrared strobe pattern that gives fire trucks green lights. Seems simpler.
- rootusrootus 2y ago
  It has been years since I have seen a fire truck get a green light through preemption. It probably varies by jurisdiction, but around here the preemption just causes the entire intersection to go red. Then the emergency vehicle can navigate across carefully. In addition to being basically useless as a trick these days, it is also trivially easy to detect an IR strobe being used, and the penalty can be hefty. Fun fact: In some places, there are strobes on the signal that activate when it has been preempted, to let everyone know an emergency vehicle is coming through.
  - TheCleric 2y ago
    Yeah near me (mid-sized metro area) they just hit the intersection with lights and sirens and creep forward until they’re sure they won’t get t-boned. Light sequence never changes.
- popcalc 2y ago
  Using one of these will get you 6 months in federal prison btw.
  - jeffbee 2y ago
    Doing any of the things suggested by this headline will send you to jail.
- fortran77 2y ago
  I've never seen that in the real world. In my area, the lights go RED in all directions. Much safer option.
mcswell 2y ago
Can you turn all the lights at a given intersection green at the same time?
- magmastonealex 2y ago
  Generally no, this is something from fiction. I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet. That device will catch so-called "conflicts" (two conflicting directions green at the same time) and put the intersection into a fail-safe state (usually flashing red/yellow lights). There are of course some edge cases where this is technically possible (as long as the cabinet door is open in CalTrans TEES cabinets, you can actually remove the MMU entirely and do whatever you want), and I'm not familiar with safety mechanisms used in other localities. (Note: I work in the industry, not for any of the companies in this article, and my views are my own).
  - megous 2y ago
    How about switching lights in quick succession, enough to cause real-world issue, but avoiding the direct conflict?
    - magmastonealex 2y ago
      Now you start to get into the differences between the various standards :) In NEMA TS2 (and the more modern ITE ATC), the MMU does enforce a yellow clearance time - you need the light to turn yellow for a period of time before a conflicting phase goes green. Usually this is a few seconds. Changing phases rapidly would likely confuse drivers, but in _theory_ shouldn't cause a collision if people respect yellows. (believe it or not, in some localities a "red clearance" time - all red - is not required and lights will go from yellow in one direction to green in another.) In CalTrans TEES, I do not believe the standard calls for the MMU to enforce clearance times - the attack you describe would potentially be possible.
      - 2y ago
sdwr 2y ago
This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't harden themselves against all attack vectors, while they are responsible for a good part of the danger. Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). Nobody would be happy about that, no matter what color hat I have on. Security is a twin-engine racket, based on the pillars of - assumed intellectual superiority - the actual protection racket part
- megous 2y ago
  Company makes HW that can potentially harm people, if someone logs in to it remotely and turns all lights green at once. It's possible to find the vulnerability in 15 minutes of getting remote access to the device without any prior knowledge, that gives admin access to the HW. Company rejects the report based on flmisy reasons via a lawyer, threatening with a felony prosecution. But the person finding the vulnerability and notifying the company is the smug one. :)
  - sdwr 2y ago
    There are electrical junction boxes all over my neighborhood, that direct power to the stoplights and residential buildings (?). They have a simple padlock, and could be opened in 30 seconds with a lockpick or bolt cutters. Nobody tries! Not even to test it out! The question isn't "How easy is it to break in?", but rather "Should I be tampering with this?"
    - patrickmay 2y ago
      Your analogy breaks down immediately because the Internet isn't your neighborhood, it's effectively everyone's neighborhood, including the state-level bad actors mentioned above. If someone could access those electrical junction boxes from China or North Korea, I'd want the locals finding the vulnerabilities first.
      - 2y ago
magmastonealex 2y ago
This is a great introduction to the mess that is traffic signal controllers! The reality is perhaps even worse than the article suggests. The majority of signal controllers support the NTCIP "standard" MIBs in addition to the "proprietary" MIBs that are provided through FreeTheMIBs. These "standard" MIBs are defined in standards like NTCIP 1202[1], which are freely available online through the NTCIP group. These standard MIBs let you set/get all kinds of fun settings... put the lights into flash, change timing settings, set "preempts" to give yourself a green light, and more. The standard also strongly suggests that all vendors use a default SNMP community name of "public". That means, for any traffic controller you happen to find on a network, you can almost certainly change tons of scary settings without even needing to _exploit_ anything! I've been working in the industry for quite some time, and it's genuinely scary how poorly secured some of this infrastructure is and how slowly things move when issues are found. (Disclaimer: I work in the industry, not for any of the companies discussed in the article, and all these views are my own and not those of my employer) [1]: https://www.ntcip.org/file/2019/07/NTCIP-1202v0328A.pdf https://www.ntcip.org/file/2019/07/NTCIP-1202v0328A.pdf
- hunter2_ 2y ago
  > for any traffic controller you happen to find on a network But how would one get on such "a network" in the first place? I assume it would involve physically opening a (hopefully locked) cabinet in public near the road? So just a bit of cutting/picking reveals an ethernet port, you drop in a wireless bridge, close it back up, and then hack from a parked car?
  - EvanAnderson 2y ago
    I am aware of a municipality local to me that, as part of a franchise agreement for a new ISP entering the community, had the ISP run fiber to every traffic cabinet. They're connected back to the city network in a VLAN that's "behind the firewall". >sigh<
    - SoftTalker 2y ago
      Because of course a controller for a traffic light needs gigabit fiber internet connectivity....
johnohara 2y ago
This blog post is dated 5 days prior to The Intelligent Transportation Society of America's publishing of its Cybersecurity and Transportation Safety Issue Brief. The original author of the blog post was invited to speak at an ITSA.ORG conference, and present as through the eyes of an attacker. Thus, the perspective he posits. There is nothing untoward in his observations but I can see why DefCon might hold off on letting him present his findings. The ITSA is based in Washington D.C. and has a fairly large membership consisting of state's DOT's (primarily western U.S.), tech companies, car companies, engineering design companies, consulting firms, etc. Their vision is a better future transformed by transportation technology and innovation. Safer. Greener. Smarter. For all. A lot of automation is factored into that vision including the use of autonomous vehicles, high-speed inter-connected systems, their attendant technologies, and of course, cyber-security. Personally, I'm dismayed the U.S. in only now awarding grants for these studies. Maybe the whole thing got sidetracked when our focus shifted to COVID, I don't know. But it does seem as though we're behind the private and governmental initiatives going on in Asia. 1: https://itsa.org/ https://itsa.org/ 2: https://itsa.org/wp-content/uploads/2024/07/Cybersecurity-and-Transportation-Safety-Issue-Brief-Final-Version.pdf https://itsa.org/wp-content/uploads/2024/07/Cybersecurity-an... 3: https://itsa.org/wp-content/uploads/2023/01/2026-ITS-America-Strategic-Plan.pdf https://itsa.org/wp-content/uploads/2023/01/2026-ITS-America...
slantedview 2y ago
The legal threat letter from the vendor is among the most insane examples I've read. They only consider something a valid vulnerability if the reporter can demonstrate they obtained the equipment through a legitimate recorded sale? What on earth does that have to do with the existence of a vulnerability?
yijjb 2y ago
[flagged]

186 points by danso 2y ago

If we’re as serious about cybersecurity as all the noise that gets made about it indicates, we really need legal immunity for unsolicited responsible disclosure. You shouldn’t have any ability to beat someone with the CFAA who is trying to help you.

jagged-chisel 2y ago
Anyone has the “ability” and freedom to make threats under the CFAA. Because there are no consequences for doing so. This particular company wouldn’t get the feds to prosecute this case. Another annoying problem is that this company seems to think that their “policy” overrides first sale doctrine wrt their products: ‘we don’t know where or how you got that device, therefore CFAA violation threat.’
- teeray 2y ago
  > Anyone has the “ability” and freedom to make threats under the CFAA. Certainly. What I’m saying is that it should be cheap or free to neutralize their threat. There should be a lawyer-free portal where you can upload their threat letter and your responsible disclosure letter, and get some kind of legal order blessing your work that you can throw back at them.
  - krger 2y ago
    >There should be a lawyer-free portal where you can upload their threat letter and your responsible disclosure letter, and get some kind of legal order blessing your work that you can throw back at them. Who's going to check it to make sure that "your responsible disclosure letter" actually is a responsible disclosure letter and not just nonsense?
    - jasonjayr 2y ago
      The firm funded by fines for making unfounded threats with scary lawyer letters.
- pixl97 2y ago
  You may not get the feds to prosecute the case, but it's very possible for the feds to investigate you with varying levels of fervor. If you're a well lawyered security researcher this is probably fine. If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things.
  - EvanAnderson 2y ago
    > If you're some IT related person that does something else as your primary job this may or may not be fine if the FBI shows up and starts asking lots of questions about all kinds of things. This is exactly what I tell my coworkers who are getting into security. Keep your mouth shut about anything you find unless you have a reporting channel that leads to a "well lawyered" security company. I've found vulnerabilities that I would have loved to disclose, but being a lowly IT generalist, I'm not going to stick my neck out. I can't imagine my employer would like the press. I use one-off email addresses at my personal domain and historically warned companies that I was seeing spam to one-off addresses as possible indications of a data breach. By and large I was ignored, but occasionally I received a word of thanks. Even more occasionally I received notes of thanks that, in fact, I had uncovered a data breach. Once, however, I received a nasty response insinuating that I'd breached their systems. The person I contacted didn't, apparently, understand what I was saying. They were confused that their company name was to the left of the "@" in my email address. That was enough for me. I decided I was done reporting those events. Too much risk.
    - slantedview 2y ago
      > I was seeing spam to one-off addresses as possible indications of a data breach For the uninformed, how does spam to an address on your domain indicate a breach of someone else's system?
      - EvanAnderson 2y ago
        I sign-up for a service using "123abc-theirdomain.com@mydomain.com" as the email address. Messages to that address come to my "Inbox". I don't use the address for anything else. I never send a message with that address. Years pass. I start receiving email solicitations for erectile dysfunction remedies and, oddly, woodworking plans (what is it with the spam for shed plans?) to that address. Either my address was sold or a data breach occurred. (It could have been my own data breached, but it seems unlikely, if that did happen, that the result would be me receiving spam only to that one specific address.)
- toss1 2y ago
  Yup. I submit that this sort of threat poisons the well and makes security worse for everyone, including those making the threat (but it's a bit of a commons problem because the worsening security is industry-wide, but for the threat-maker it seems to improve their situation). If I am a person interested in how these systems work, and maybe making some money off my work in the area, this sort of threat, both its severity (potentially years of costly litigation and or/jail) and how frequently it happens (seems we read of such incidents many times per year, which is only the tip of the iceberg) would make someone seriously question the straight white-hat path. Why not find the exploits and sell them on the dark web? One might even justify it with "they wouldn't listen anyway and it's their fault for releasing a system with such stupid vulns." and/or "they'll fix it only when they see real-world consequences and if they don't it doesn't matter". One's moral compass need not be very compromised to lean on such excuses. There REALLY needs to be a Safe Harbor law with basic requirements that the work is documented, first revealed to the company security dept (perhaps citing the Safe Harbor law?), no action taken by the researcher to allow it to be disclosed or released publicly for 90 days, and perhaps a few other reasonable safeguards. and how often it happens
upwardbound 2y ago
We do have that now, as of 2022! The new Justice Department policy now instructs prosecutors not to prosecute security researchers who acted in good faith for the public benefit and who avoided any harm to individuals or the public. https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/opa/pr/department-justice-announces-...
- qingcharles 2y ago
  That checks off federal cases, but there are still options for a corporation under what are normally much stricter state laws in the USA. For instance, in Illinois you can get up to 5 years in prison for violating the ToS of a web site.
  - TheCleric 2y ago
    As well I think that would still leave you exposed for a civil suit, which even if you win, can be financially devastating. What would be needed is an anti-SLAPP type legislation at the state and federal level to mitigate it.
- bagels 2y ago
  Policy can change, retrospectively even
  - DJBunnies 2y ago
    Yeah it was a kaizen ticket the group filed after the last sprint.

bitwize 2y ago

Just what we need to tie up the cops so we can rollerblade into Grand Central Station and hack the Gibson to get the garbage file that will exonerate Joey! https://m.youtube.com/watch?v=yhVDhcuRY1I https://m.youtube.com/watch?v=yhVDhcuRY1I

jfactorial 2y ago
[flagged]

23july2024 2y ago

Part 2 article goes into a bit more of detail, but the funniest thing is that they requested access to the SNMP MIBs of the controller and never got them > I requested MIBs from Q-Free but didn’t receive any follow-up after the request and I never received access to the MIBS, so it was back to square one. Then you go look at https://www.freethemibs.org/advocates https://www.freethemibs.org/advocates and... there they are, "advocates" for free MIB access. What clowns.

IshKebab 2y ago
What are SNMP and MIBs?
- codewench 2y ago
  SNMP stands for Simple Network Management Protocol, and is a way to directly address not just individual hardware elements, but to access specific functions or methods within that device via a "simple" addressing scheme. A MIB file describes the various endpoints available on a device, much like a wsdl file would describe a SOAP endpoint. So you might have an SNMP address like 2.1.4.3.0.1* which the MIB file would translate to "the current temp for CPU1"
- mceachen 2y ago
  Simple Network Management Protocol. Management Information Base. https://en.m.wikipedia.org/wiki/Management_information_base https://en.m.wikipedia.org/wiki/Management_information_base

hjfjh 2y ago

[flagged]

_qua 2y ago

That's an embarassing letter from the company.

the_real_cher 2y ago

Why wouldn't defcon allow this to be presented?

floatrock 2y ago
> my CFP wasn’t accepted Don't know their specific process, but this sounds like "we got a bunch of submissions and yours didn't make the cut." Honestly, rather than this being a nefarious "too dangerous even for defcon" like your wording suggests, I think the author knows why it didn't make the cut and snarkily addressed it: > I’d love to write a long detailed blog about getting a root shell via UART or extracting the firmware via JTAG and then reversing it, but the honest truth is I found a vulnerability in the webapp in the first 15 minutes of having the unit online and it was the first thing I tried. So my guess is so basic it just wasn't interesting enough. /shrug
- BonusPlay 2y ago
  Sounds like amazing material for a CCC talk.

moritonal 2y ago

Sounds like the company realised they can't solve the issue in 90 days. Betting a combination of infrastructure scale problems, terrible tech, no-longer-building old solutions, no maintenance fee's built in and contractors who hate them. So they pulled the only lever they had left, which was the lawyers. Same time, RedThreat's email was kinda (maybe rightly) hostile. Read from the other side it's basically "You have 90 days to work (/maybe pay) me before you start hearing your name on TickTok under the label 'wanna hack the city?'". "Work with your team" leaves a ton of negotiating opportunity for a company that obviously does this for a living and expects to make money somewhere.

samtho 2y ago
The 90 day window is an industry standard for zero-days, how the author worded it is neither here nor there. 90 days is ample time for even a half-functioning organization to address the issue in some way. I agree with Red Threat’s decision to not show their hand in the first email. The altruistic take on this is that they do not want the email to fall upon deaf ears (or even a bad actor within a company) and would prefer to have a channel of communication open with the security team before outlining the details. The biggest problem when faced with a zero-day is that it’s unknown who else knows about it. This helps the the company’s security team justify the work due to the fire lit under the company to take action - especially if their corporate structure does not allow for more “elective” fixes.
- mike_hearn 2y ago
  90 days isn't really an industry standard. It's what Google unilaterally decided upon when they chose to staff up Project Zero and reflects their assumptions being, as they are, a company that grew up on the web. One of those assumptions is that you have fully automated test processes and the ability to remotely update any/all installs of your software within a week or so, which in turn implies that users aren't involved in the decision about whether to upgrade or not. It also assumes you can do this as often as you want. This is a strong set of assumptions that happens to be true for Google but isn't true of SCADA shops. Even if they make a patched firmware, actually rolling it out would require a lot of work by their customers and of course maybe the same guy finds another security bug after 80 days and the whole thing starts again. Given the unclear threat model here (how does one get access to the networks that these are attached to? could you just hotwire the lights themselves and bypass the controller?) it's also not really obvious how you'd classify reports. If there's a bypassable HTTP login page that's clearly an exploit but customers may not care if they trust the underlying VPNs/firewalls/air gaps. If there's unauthenticated SNMP access by design then is it even intended to be secure against malicious network access at all? In many cases these devices will be reachable from the public internet, and in some of those cases it will be intentional. But is the security bug there on the controller or in the network setup that allows that access? It's probably easier to properly firewall off the controllers than continuously patch all the controller firmwares themselves, especially as the latter done wrong could easily enable hackers to perform a worse-than-Crowdstrike level takedown of all controllers simultaneously. It's really not clear that the model that works well for web browsers will ever work well for infrastructure. We just saw an awesome demo of what can go wrong when rapidly hot-patching security updates into critical infrastructure computers goes wrong.

jeffbee 2y ago

If you just want a green light an easier way to get one is to flash the infrared strobe pattern that gives fire trucks green lights. Seems simpler.

rootusrootus 2y ago
It has been years since I have seen a fire truck get a green light through preemption. It probably varies by jurisdiction, but around here the preemption just causes the entire intersection to go red. Then the emergency vehicle can navigate across carefully. In addition to being basically useless as a trick these days, it is also trivially easy to detect an IR strobe being used, and the penalty can be hefty. Fun fact: In some places, there are strobes on the signal that activate when it has been preempted, to let everyone know an emergency vehicle is coming through.
- TheCleric 2y ago
  Yeah near me (mid-sized metro area) they just hit the intersection with lights and sirens and creep forward until they’re sure they won’t get t-boned. Light sequence never changes.
popcalc 2y ago
Using one of these will get you 6 months in federal prison btw.
- jeffbee 2y ago
  Doing any of the things suggested by this headline will send you to jail.
fortran77 2y ago
I've never seen that in the real world. In my area, the lights go RED in all directions. Much safer option.

mcswell 2y ago

Can you turn all the lights at a given intersection green at the same time?

magmastonealex 2y ago
Generally no, this is something from fiction. I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet. That device will catch so-called "conflicts" (two conflicting directions green at the same time) and put the intersection into a fail-safe state (usually flashing red/yellow lights). There are of course some edge cases where this is technically possible (as long as the cabinet door is open in CalTrans TEES cabinets, you can actually remove the MMU entirely and do whatever you want), and I'm not familiar with safety mechanisms used in other localities. (Note: I work in the industry, not for any of the companies in this article, and my views are my own).
- megous 2y ago
  How about switching lights in quick succession, enough to cause real-world issue, but avoiding the direct conflict?
  - magmastonealex 2y ago
    Now you start to get into the differences between the various standards :) In NEMA TS2 (and the more modern ITE ATC), the MMU does enforce a yellow clearance time - you need the light to turn yellow for a period of time before a conflicting phase goes green. Usually this is a few seconds. Changing phases rapidly would likely confuse drivers, but in _theory_ shouldn't cause a collision if people respect yellows. (believe it or not, in some localities a "red clearance" time - all red - is not required and lights will go from yellow in one direction to green in another.) In CalTrans TEES, I do not believe the standard calls for the MMU to enforce clearance times - the attack you describe would potentially be possible.
    - 2y ago

sdwr 2y ago

This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't harden themselves against all attack vectors, while they are responsible for a good part of the danger. Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). Nobody would be happy about that, no matter what color hat I have on. Security is a twin-engine racket, based on the pillars of - assumed intellectual superiority - the actual protection racket part

megous 2y ago
Company makes HW that can potentially harm people, if someone logs in to it remotely and turns all lights green at once. It's possible to find the vulnerability in 15 minutes of getting remote access to the device without any prior knowledge, that gives admin access to the HW. Company rejects the report based on flmisy reasons via a lawyer, threatening with a felony prosecution. But the person finding the vulnerability and notifying the company is the smug one. :)
- sdwr 2y ago
  There are electrical junction boxes all over my neighborhood, that direct power to the stoplights and residential buildings (?). They have a simple padlock, and could be opened in 30 seconds with a lockpick or bolt cutters. Nobody tries! Not even to test it out! The question isn't "How easy is it to break in?", but rather "Should I be tampering with this?"
  - patrickmay 2y ago
    Your analogy breaks down immediately because the Internet isn't your neighborhood, it's effectively everyone's neighborhood, including the state-level bad actors mentioned above. If someone could access those electrical junction boxes from China or North Korea, I'd want the locals finding the vulnerabilities first.
    - 2y ago

magmastonealex 2y ago

This is a great introduction to the mess that is traffic signal controllers! The reality is perhaps even worse than the article suggests. The majority of signal controllers support the NTCIP "standard" MIBs in addition to the "proprietary" MIBs that are provided through FreeTheMIBs. These "standard" MIBs are defined in standards like NTCIP 1202[1], which are freely available online through the NTCIP group. These standard MIBs let you set/get all kinds of fun settings... put the lights into flash, change timing settings, set "preempts" to give yourself a green light, and more. The standard also strongly suggests that all vendors use a default SNMP community name of "public". That means, for any traffic controller you happen to find on a network, you can almost certainly change tons of scary settings without even needing to _exploit_ anything! I've been working in the industry for quite some time, and it's genuinely scary how poorly secured some of this infrastructure is and how slowly things move when issues are found. (Disclaimer: I work in the industry, not for any of the companies discussed in the article, and all these views are my own and not those of my employer) [1]: https://www.ntcip.org/file/2019/07/NTCIP-1202v0328A.pdf https://www.ntcip.org/file/2019/07/NTCIP-1202v0328A.pdf

hunter2_ 2y ago
> for any traffic controller you happen to find on a network But how would one get on such "a network" in the first place? I assume it would involve physically opening a (hopefully locked) cabinet in public near the road? So just a bit of cutting/picking reveals an ethernet port, you drop in a wireless bridge, close it back up, and then hack from a parked car?
- EvanAnderson 2y ago
  I am aware of a municipality local to me that, as part of a franchise agreement for a new ISP entering the community, had the ISP run fiber to every traffic cabinet. They're connected back to the city network in a VLAN that's "behind the firewall". >sigh<
  - SoftTalker 2y ago
    Because of course a controller for a traffic light needs gigabit fiber internet connectivity....

johnohara 2y ago

This blog post is dated 5 days prior to The Intelligent Transportation Society of America's publishing of its Cybersecurity and Transportation Safety Issue Brief. The original author of the blog post was invited to speak at an ITSA.ORG conference, and present as through the eyes of an attacker. Thus, the perspective he posits. There is nothing untoward in his observations but I can see why DefCon might hold off on letting him present his findings. The ITSA is based in Washington D.C. and has a fairly large membership consisting of state's DOT's (primarily western U.S.), tech companies, car companies, engineering design companies, consulting firms, etc. Their vision is a better future transformed by transportation technology and innovation. Safer. Greener. Smarter. For all. A lot of automation is factored into that vision including the use of autonomous vehicles, high-speed inter-connected systems, their attendant technologies, and of course, cyber-security. Personally, I'm dismayed the U.S. in only now awarding grants for these studies. Maybe the whole thing got sidetracked when our focus shifted to COVID, I don't know. But it does seem as though we're behind the private and governmental initiatives going on in Asia. 1: https://itsa.org/ https://itsa.org/ 2: https://itsa.org/wp-content/uploads/2024/07/Cybersecurity-and-Transportation-Safety-Issue-Brief-Final-Version.pdf https://itsa.org/wp-content/uploads/2024/07/Cybersecurity-an... 3: https://itsa.org/wp-content/uploads/2023/01/2026-ITS-America-Strategic-Plan.pdf https://itsa.org/wp-content/uploads/2023/01/2026-ITS-America...

slantedview 2y ago

The legal threat letter from the vendor is among the most insane examples I've read. They only consider something a valid vulnerability if the reporter can demonstrate they obtained the equipment through a legitimate recorded sale? What on earth does that have to do with the existence of a vulnerability?

yijjb 2y ago

[flagged]