Incident: Traffic Lights Vulnerable to Hacking Due to Lack of Security

Published Date: 2014-08-21

Postmortem Analysis
Timeline 1. The software failure incident regarding the vulnerability of traffic lights systems happened in 2014. - Estimation based on Article 25988 published on 2014-04-30.
System 1. Sensys Networks VDS240 wireless vehicle detection systems [25988] 2. Econolite traffic lights and controllers [29203]
Responsible Organization 1. Hackers were responsible for causing the software failure incident reported in the articles [25988, 29203].
Impacted Organization 1. U.S. cities, including San Francisco, Los Angeles, New York City, Washington, DC, and 40 other cities [25988] 2. Traffic lights all across the United States [29203]
Software Causes 1. Lack of encryption and authentication in the Sensys Networks VDS240 wireless vehicle detection systems allowed for data manipulation and potential traffic control system manipulation [25988]. 2. Default and rarely changed usernames and passwords in traffic light controllers, such as those made by Econolite, made them susceptible to hacking [29203].
Non-software Causes 1. Lack of encryption and authentication in the traffic control systems' sensors and access points [25988]. 2. Default username and password being used in the controllers of traffic lights, making them vulnerable to hacking [29203].
Impacts 1. The software failure incident allowed hackers to potentially manipulate traffic flow, causing gridlock and redirecting cars in major U.S. cities and the nation's capital [25988]. 2. The vulnerability in the traffic control systems could lead to traffic jams, lights remaining red longer than necessary, and disruptions in emergency response management, potentially causing accidents, including deadly ones [25988]. 3. The lack of encryption and security mechanisms in the traffic control systems allowed for unauthorized access and manipulation of data, posing a significant risk to public safety [25988]. 4. The software failure incident highlighted the lack of security measures in place for traffic light controllers, making them susceptible to hacking and remote control, which could lead to widespread disruptions in traffic management [29203]. 5. The default settings and lack of encryption in traffic light controllers made them easy targets for hackers, raising concerns about the overall security of critical infrastructure systems [29203].
Preventions 1. Implementing data encryption and authentication mechanisms in the traffic control systems to secure the communication between sensors and access points could have prevented the software failure incident [25988]. 2. Enabling firmware updates to be encrypted with AES for all sensors, including older models, and ensuring that firmware updates are securely transmitted could have mitigated the vulnerability [25988]. 3. Updating the software standard used by traffic light manufacturers, such as Econolite, to limit who can send commands to traffic lights and require additional credentials for authorized devices could have enhanced security and prevented hacking incidents [29203].
Fixes 1. Encrypting the data in transit and preventing unauthorized users from altering the configuration or firmware of the traffic sensors [25988]. 2. Updating the software standard used by traffic light controllers to limit who can send commands and require additional credentials [29203]. 3. Guarding the network by enabling encryption and setting passwords for the traffic control systems [29203].
References 1. Cesar Cerrudo, an Argentinian security researcher with IoActive [25988] 2. Sensys Networks' vice president of engineering, Brian Fuller [25988] 3. Department of Homeland Security's ICS-CERT division [25988] 4. Branden Ghena, a computer science PhD student at the University of Michigan [29203] 5. Local transportation officials in Michigan [29203] 6. Econolite, a major maker of signals, cameras, and traffic management systems in North America [29203] 7. Adam Pridgen, a security consultant at Praetorian [29203] 8. Charles Tendell, founder of Azorian Cyber Security [29203]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to vulnerable traffic control systems has happened again at Sensys Networks. Cesar Cerrudo, a security researcher, discovered security vulnerabilities in Sensys Networks' wireless vehicle detection systems installed in major U.S. cities and other countries, allowing for potential manipulation of traffic data and causing gridlock [25988]. (b) The software failure incident related to vulnerable traffic control systems has also happened at Econolite, one of the largest makers of signals, cameras, and traffic management systems in North America. Researchers at the University of Michigan found that Econolite's traffic lights and controllers are susceptible to hacking due to lack of encryption and the use of default usernames and passwords [29203].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the vulnerability of the traffic control systems due to poor security measures during development. The article [25988] highlights how the Sensys Networks VDS240 wireless vehicle detection systems lack basic security protections such as data encryption and authentication, allowing for data manipulation and potential attacks on traffic flow systems. The lack of encryption and authentication in the system's design was intentional based on customer feedback, as mentioned in the article. This design flaw makes it possible for attackers to intercept data, send arbitrary commands, and manipulate the devices, ultimately leading to potential traffic disruptions and safety hazards. (b) The software failure incident related to the operation phase is demonstrated by the ease with which the traffic lights can be hacked and controlled remotely. The article [29203] discusses how traffic lights across the United States, including those made by Econolite, are susceptible to hacking due to unsecured controllers operating on default settings with published usernames and passwords. This operational vulnerability allows anyone with a radio hooked up to a laptop to remotely change lights or shut them down, highlighting the risks associated with the operation and maintenance of traffic control systems. The article emphasizes the importance of securing the network, enabling encryption, and setting passwords to prevent unauthorized access and potential disruptions caused by operational misuse.
Boundary (Internal/External) within_system, outside_system (a) The software failure incident reported in the articles is primarily within_system. The incidents involve vulnerabilities within the traffic control systems themselves that allow for potential manipulation and hacking. For example, in Article 25988, it is highlighted that the traffic control systems installed in major U.S. cities lack basic security protections such as data encryption and authentication, making them susceptible to manipulation by attackers [25988]. Similarly, in Article 29203, it is mentioned that traffic lights and controllers made by Econolite operate like unsecured routers with rarely encrypted communication and default usernames and passwords, making them vulnerable to hacking [29203]. (b) Additionally, the incidents also involve contributing factors that originate from outside the system. For instance, in Article 29203, it is noted that the U.S. traffic light communications standard, NTCIP 1202, is present in all modern signal systems, making them susceptible to hacking if default settings are not changed by cities [29203]. This external factor of a common standard across systems contributes to the vulnerability of the traffic control systems to potential hacking incidents.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The vulnerability in the traffic control systems was due to the lack of basic security protections such as data encryption and authentication, allowing the data to be monitored or replaced with false information [25988]. - The traffic lights and controllers operated by Econolite were found to be rarely encrypted and almost all of them used the same default username and password, making them susceptible to hacking [29203]. (b) The software failure incident occurring due to human actions: - The lack of encryption in the traffic control systems was intentional on the part of Sensys Networks based on customer feedback, as the municipal customers buying the systems didn't want it [25988]. - Local governments were hesitant to manually update every signal controller with encryption and password settings due to budget constraints, indicating a lack of action on the part of humans to enhance security measures [29203].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The vulnerability in the traffic control system was due to the lack of basic security protections in the controllers and sensors, such as data encryption and authentication, allowing for manipulation of data and potential attacks [25988]. - The traffic lights and controllers were found to operate like unsecured routers, with controllers rarely encrypted and most using the same default username and password, making them susceptible to hacking [29203]. (b) The software failure incident occurring due to software: - The vulnerability in the traffic control system was primarily due to the lack of encryption and authentication in the software protocol used by the sensors, allowing for unauthorized access and manipulation of data [25988]. - The software standard used by traffic light systems, including Econolite's, did not limit who could send commands to the lights, leaving them vulnerable to unauthorized access and control [29203].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. The incidents involve vulnerabilities in traffic control systems that can be exploited by hackers to manipulate traffic lights, cause gridlock, redirect cars, and potentially create dangerous situations on the roads. The vulnerabilities include lack of encryption, authentication, and security mechanisms in the systems, allowing attackers to intercept data, send arbitrary commands, manipulate devices, alter firmware, and disrupt traffic flow [25988]. Additionally, the articles mention how researchers were able to remotely change traffic lights using a laptop and radio signals, highlighting the ease with which these critical infrastructure systems can be hacked [29203]. These actions demonstrate a malicious intent to exploit weaknesses in the software for potentially harmful purposes.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident: - The software failure incident related to the vulnerability in traffic control systems was not due to accidental decisions but rather poor decisions made by the vendors and lack of security measures. The lack of encryption and authentication in the systems, intentional removal of encryption based on customer feedback, and unresponsiveness of the company to security issues despite being informed by researchers all point towards poor decisions contributing to the failure [25988]. - Similarly, in the case of the traffic lights being dangerously easy to hack, the issue was not accidental but stemmed from poor decisions in the design and implementation of the systems. The default settings, lack of encryption, and the use of the same default username and password in traffic light controllers were all poor decisions that led to the vulnerability [29203].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the articles. In Article 25988, it is highlighted that the traffic control systems installed in major U.S. cities and the nation's capital were poorly secured, allowing for potential manipulation by hackers. The vulnerable controllers, Sensys Networks VDS240 wireless vehicle detection systems, lacked basic security protections such as data encryption and authentication, making it possible for attackers to intercept data, send arbitrary commands, and manipulate the devices [25988]. Additionally, the company responsible for the systems, Sensys Networks, was unresponsive to the security issues reported by the researcher, Cesar Cerrudo, and did not take adequate measures to address the vulnerabilities in the system [25988]. (b) The software failure incident related to accidental factors is also evident in the articles. In Article 29203, it is mentioned that traffic lights across the United States were dangerously easy to hack due to vulnerabilities in the traffic control systems. The controllers inside the metal boxes at intersections operated like unsecured routers, with many of them using the same default username and password, which were publicly available in online manuals. This lack of proper security measures made the traffic lights susceptible to hacking, showcasing an accidental introduction of vulnerabilities that could be exploited by hackers [29203].
Duration permanent (a) The software failure incident described in the articles is more likely to be considered permanent. The vulnerabilities in the traffic control systems, such as the lack of encryption, authentication, and security mechanisms, as well as the default settings with easily accessible usernames and passwords, indicate systemic issues that are not easily resolved and could persist unless significant changes are made to the systems [25988, 29203]. (b) However, it is important to note that while the vulnerabilities are inherent in the systems and not easily mitigated, there are potential solutions mentioned in the articles that could make the systems more secure, such as enabling encryption, setting passwords, and updating the software standard to limit authorized devices and require additional credentials. These solutions, if implemented, could potentially address the temporary aspect of the failure by mitigating the immediate risks of hacking and unauthorized access [25988, 29203].
Behaviour other (a) crash: The software failure incident described in the articles does not involve a crash where the system loses state and does not perform any of its intended functions. Instead, the incident involves a potential security vulnerability in traffic control systems that could be exploited by hackers to manipulate traffic flow and cause disruptions [25988, 29203]. (b) omission: The software failure incident does not involve the system omitting to perform its intended functions at an instance(s). The vulnerability in the traffic control systems is related to potential manipulation by hackers rather than the system failing to perform its functions [25988, 29203]. (c) timing: The software failure incident is not related to the system performing its intended functions too late or too early. The focus of the incident is on the security vulnerabilities in the traffic control systems that could be exploited by hackers to disrupt traffic flow [25988, 29203]. (d) value: The software failure incident does not involve the system performing its intended functions incorrectly. Instead, the incident highlights the lack of security measures in the traffic control systems that could allow unauthorized manipulation by hackers [25988, 29203]. (e) byzantine: The software failure incident does not exhibit the characteristics of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The vulnerability in the traffic control systems is more about potential external manipulation rather than internal inconsistencies [25988, 29203]. (f) other: The behavior of the software failure incident can be categorized as a security vulnerability that could potentially lead to unauthorized manipulation of traffic control systems by hackers. This unauthorized manipulation could result in disruptions to traffic flow and potentially create safety hazards on the roads [25988, 29203].

IoT System Layer

Layer Option Rationale
Perception sensor, network_communication, embedded_software (a) sensor: The software failure incident was related to the sensor layer of the cyber physical system. The vulnerability was due to contributing factors introduced by sensor error. The article mentions that the vulnerable controllers, Sensys Networks VDS240 wireless vehicle detection systems, are comprised of magnetic sensors embedded in roadways that wirelessly feed data about traffic flow to nearby access points and repeaters, which in turn pass the information to traffic signal controllers. These sensors lack basic security protections such as data encryption and authentication, allowing the data to be monitored or replaced with false information [25988]. (b) actuator: The failure was not directly related to the actuator layer of the cyber physical system. (c) processing_unit: The failure was not directly related to the processing unit layer of the cyber physical system. (d) network_communication: The software failure incident was related to the network communication layer of the cyber physical system. The vulnerability was due to contributing factors introduced by network communication error. The article mentions that the traffic lights and controllers communicate with each other using radio signals, similar to a Wi-Fi network. However, the controllers operate like unsecured routers, lacking encryption and often using default usernames and passwords, making them susceptible to hacking [29203]. (e) embedded_software: The failure was related to the embedded software layer of the cyber physical system. The article discusses how the firmware of the sensors was not digitally signed, access to them was not restricted to authorized parties, and the lack of encryption and authentication in the communication between sensors and access points allowed for potential manipulation by attackers. The article also highlights that firmware updates for the sensors were not encrypted for older models already in the field, requiring replacement with new sensors that support encrypted updates [25988].
Communication link_level, connectivity_level The software failure incidents reported in the provided articles are related to the communication layer of the cyber-physical system that failed at both the link level and connectivity level. 1. **Link Level (Wired or Wireless Physical Layer):** - Article 25988 discusses a vulnerability in the Sensys Networks VDS240 wireless vehicle detection systems used in traffic control systems in various U.S. cities. The wireless sensors embedded in roadways communicate data wirelessly to access points and repeaters, which then pass the information to traffic signal controllers. The lack of basic security protections such as data encryption and authentication in these sensors allows for the manipulation of data, potentially causing traffic disruptions and gridlock [Article 25988]. 2. **Connectivity Level (Network or Transport Layer):** - Article 29203 highlights the vulnerability of traffic lights across the United States, particularly those using Econolite's traffic lights and controllers. These systems operate on a computer network and communicate with each other using radio signals. The controllers inside metal boxes at intersections are rarely encrypted and often use default usernames and passwords, making them susceptible to hacking. The article emphasizes the need for cities to guard the network by enabling encryption and setting passwords to prevent unauthorized access and manipulation of traffic lights [Article 29203].
Application TRUE The software failure incident related to the application layer of the cyber physical system that failed is described in the articles. The failure was related to the application layer due to contributing factors introduced by bugs, operating system errors, unhandled exceptions, and incorrect usage. In Article 25988, it is mentioned that the vulnerable controllers of the traffic control system lacked basic security protections such as data encryption and authentication, allowing data to be monitored or replaced with false information. This vulnerability could be exploited by attackers to manipulate the traffic data and potentially cause traffic jams or other issues [25988]. In Article 29203, it is highlighted that the traffic lights and controllers, which are part of the traffic management system, operate like an unsecured router with rarely encrypted communication and the use of default usernames and passwords. This lack of security measures makes the system susceptible to hacking, indicating a failure at the application layer due to inadequate security practices [29203].

Other Details

Category Option Rationale
Consequence non-human, theoretical_consequence (a) death: People lost their lives due to the software failure - There is no mention of people losing their lives due to the software failure incident in the articles [25988, 29203]. (b) harm: People were physically harmed due to the software failure - There is no mention of people being physically harmed due to the software failure incident in the articles [25988, 29203]. (c) basic: People's access to food or shelter was impacted because of the software failure - There is no mention of people's access to food or shelter being impacted due to the software failure incident in the articles [25988, 29203]. (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incidents described in the articles could potentially impact property in the form of traffic accidents or delays, but there is no direct mention of people's material goods, money, or data being impacted [25988, 29203]. (e) delay: People had to postpone an activity due to the software failure - The software failure incidents described in the articles could lead to delays in traffic flow and potentially impact people's schedules, but there is no specific mention of people having to postpone activities directly due to the software failure [25988, 29203]. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incidents described in the articles primarily focus on the potential manipulation of traffic lights and traffic flow, which could impact non-human entities such as vehicles and traffic systems [25988, 29203]. (g) no_consequence: There were no real observed consequences of the software failure - The articles clearly describe potential consequences of the software failure incidents, such as the ability to manipulate traffic lights and traffic flow, which could have significant real-world impacts [25988, 29203]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The articles discuss potential consequences of the software failure incidents, such as causing traffic jams, accidents, or disrupting emergency response management, which could be considered theoretical consequences that have not been observed to occur [25988, 29203]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - There are no other consequences of the software failure incidents mentioned in the articles beyond those covered in the options (a) to (h) [25988, 29203].
Domain transportation, government (a) The failed system was related to the transportation industry, specifically the traffic control systems installed at major arteries in U.S. cities and the nation's capital [25988]. (b) The software failure incident was directly impacting the transportation industry, as it involved the manipulation of traffic lights and sensors that control traffic flow in major cities [25988, 29203].

Sources

Back to List