The hacker in The Italian Job did it spectacularly. So did the fire-sale team in Live Free or Die Hard. But can hackers really hijack traffic lights to cause gridlock and redirect cars?
According to one researcher, parts of the vehicle traffic control system installed at major arteries in U.S. cities and the nation’s capital are so poorly secured that they can be manipulated to snarl traffic or force cars onto different streets.
The hack doesn’t target the traffic lights directly but rather sensors embedded in streets that feed data to traffic control systems, said Cesar Cerrudo, an Argentinian security researcher with IOActive who examined the systems and plans to present his findings at the upcoming Infiltrate conference in Florida.
The vulnerable controllers — Sensys Networks VDS240 wireless vehicle detection systems — are installed in 40 U.S. cities, including San Francisco, Los Angeles, New York City, and Washington, D.C., as well as in nine other countries.
The system is comprised of magnetic sensors embedded in roadways that wirelessly feed data about traffic flow to nearby access points and repeaters, which in turn pass the information to traffic signal controllers.
The sensors use a proprietary protocol designed by the vendor — called the Sensys NanoPower protocol — that operates similar to Zigbee. But the systems lack basic security protections — such as data encryption and authentication — allowing the data to be monitored or, theoretically, replaced with false information.
