- Hi, welcome everybody.
We would like to talk today about a research project
we did, hacking traffic lights,
and we would like to, to share our findings and well,
the things we found in our research.
First of all who are we?
My name is Wesley Neelen
and my colleague's name is Rik Van Duijn
and we both have been mainly pen testing in the past year
for about seven, eight years.
And of course, we also have our own interests,
for example, I like to play around with internet of things
and the security of it and innovations like that
and Rik likes to play with malware and the investigate that.
I would like to at least one disclaimer,
we are no smarter traffic experts,
we're just, two guys that are interested
in this kind of innovations.
We decided to use it to do a research on it.
We do use bicycles because we're Dutch,
but that doesn't really help us in our investigation
in our research.
Well, a small introduction.
What we've seen that there they're creating a platform,
multiple vendors are creating a platform
to exchange information between traffic information.
For example, roadsigns can repudiate States on a network,
the parking spots, how many are still available,
and how many are occupied.
Audit traffic data, for example,
is there a traffic jam and stuff like that.
But they are even trying to connect the traffic lights,
the actual traffic light systems to the same network.
So it can act on the beat,
the messages that are sent on the network.
And one of the examples
is that they actually want to connect the road users
to the networks as well.
For example, cyclists, cars, trucks,
and even the rescue vehicles, their emergency vehicles.
Well, I have to mention that in this research
we mainly have been focusing on the cyclist,
and the reason for this is that there was an app available
that allows you as a cyclist to install it.
And if you're cycling on a road, you will get the time
to green will be decreased or maybe even instant green.
Because it was available, we focused on that.
Important factor is that in the Netherlands,
there are a lot of bicycles, 23 million,
and we have a lot of cycling infrastructure
so well imagine that on every intersection,
there is almost a cycling a traffic light
so it's quite important in our country.
Like Sal, we see multiple apps being released,
so we are mainly interested
in the fact that we are able to talk
to traffic lights somehow.
And for example,
how are we able to talk to them?
And what if we are able to manipulate it,
what is possible and what can we manipulate?
That was pretty interesting
and the reason we started the research.
One of the things we see in Netherlands
there's an ongoing partnership,
and the goal of that partnership,
three lights there's more traffic,
and the goal is to improve the safety,
comfort and traffic flow.
A lot of things are happening in its partnership,
but some of the things are, for example,
a cyclist app that I was talking about,
they're trying to giving the user the ability
to install an application on its phone.
And when he's cycling on an intersection,
the cyclist lies, time will be decreased to go to green,
or maybe even instantly go to green
if there's no other traffic at the intersection.
But another thing is, for example, for trucks,
they're trying to realize a green flow
on multiple traffic lights, the trucks have to stop less,
which is of course a great idea.
And emergency vehicle,
that's maybe even the most interesting one
because those will get instantly green,
if they will be passing a connected traffic light,
but also other users the road users will be notified,
that there is a vehicle coming,
coming up emergency vehicle.
Important thing within the partnership is VRIs.
VRIs are the systems that are actually at an intersection
that are actually, controlling the actual traffic lights
and they are replacing the old system for intelligent ones.
So that it is compatible with the network
and it is possible to communicate with,
but also that it is able to send their own information
through the network.
And what we've seen that's currently about 500 IVRIs
or VRI has been replaced for IVRIs
which is about 10% of the total amount of VRIs.
And to give you an idea how the things are connected
to each other, on the right, you will see...
You see the road users,
for example, cars, cyclists, or trucks.
And they are well connected to the network,
for example, by using an app like I said earlier,
but it's also possible that it might be an onboard computer
within the truck for example.
And those systems are talking to the well to cloud services,
which are also like the apps created by multiple vendors,
and in the clouds, the information that is sent
to the clouds can be sent onto the network.
And for example, to traffic lights.
And one of the important things
in there is that mostly this is done by using Camo PX,
which is a standard that allows you to communicate
with each other within that traffic light network
or traffic network.
And Rik will be explaining more on that.
- Cool.
Where we initially looked the first app,
that allowed users to get the green light,
we saw a lots of references to CAM objects,
and we saw that the app was building CAM objects
with the position and stuff like that in it.
And for us, it was unclear what those were.
We started googling,
and we figured out that it's actually a part
of the intelligent transport system standard,
which is a European standard.
There's a different one as far as we know,
there's a different one in the U S
and there might even be a different one in your country.
Important part of this standards
are the cooperative awareness messages.
CAMO, CAM messages in the U S
they're called basic safety messages.
These contain all kinds of information
about the Intelligent Transport System,
it could be a car telling you it's a speed stuff like that.
When we looked into the objects itself,
we noticed that they contain lots of different information,
we can see the position, what type of vehicle you are,
important to note.
We later we can see why you shouldn't use the station
type to determine what a user is and what they can do,
but there is also a different container,
there's a high frequency container,
which contains data that changes often.
Stuff like data, the direction, information like that,
and there's a low frequency container
containing having data that's more static
such as if my lights are on or off,
or, and this was my history, my path history.
But more importantly,
we came across a special vehicle container.
And this new container contains information
such as I'm...
I'm transporting dangerous goods,
or I am in emergency vehicle
and I need to have a green lights right now stuff like that.
This for us was the point where we were like, okay,
can we manipulate this?
And can we send this to the traffic lights that are
connected to our apps?
When we started looking into this, we actually figured out
that the intelligent transport system standard,
already has a security standard in it.
It's based on public infrastructure,
where a very simplified the...
Your vehicle receives a certificate,
the certificate contains information about your vehicle
and well not necessarily your identity,
but that you are a vehicle and what you are allowed to do.
Which allows other systems on the road
to actually validate what you are sending to them.
Part of the CAM messages and the certificate
are the SSP and ITSA ID.
The ITSA ID,
is the Intelligence Transport System Application ID,
and it describes some base permission
such as you are allowed to send CAM messages.
And there's a service specific permission,
that's also in there that allows you to actually say,
I'm allowed to do this.
For example, I'm in emergency vehicle
and I'm allowed to tell the world
that I need green lights right now.
Every message you send out, you sign,
and it's combined with the certificate
in order to let other systems on the road,
identify that the message you are sending them
is actually valid you're allowed to send it,
and that you actually have the correct permissions
to request this.
When we were preparing this presentation,
we actually came across some interesting work
already that's being done on this,
there's a cool paper by Joseph Kamel
which goes onto assume
let's say our authentication authorization
is already correct,
What is it?
What can we do with a valid car?
Can I say to others,
I'm putting on the emergency brakes right now,
will other cars immediately start braking?
There's really interesting research being done.
There's also some cool software being released
in order to look for abuse on the network already,
the security for this exists.
However, when we started looking into the apps
that obviously we'll talk about soon,
we noticed that there's still some work to be done.
- Yeah, like earlier mentioned,
we saw multiple well Android applications
that a cyclist could install on his phone
and if he installed it and he's going to...
He's approaching an intersection, he will get green,
the time will be decreased to green,
or he would instantly get green.
When we started, we were like, okay, what's going on?
How does this app work?
And what is it exactly doing?
And what we did, we Decompiled the applications,
and we saw that CAM PX are being sent over MQTT.
And that was pretty interesting
because if we are able to create those CAM PX ourselves
and send it over MQTT,
for example, using Byton, well,
we might be able to trick the system.
The thing was at that time,
we didn't know where the CAM PX exactly were at that time.
We had quite a hard time imitating the behavior
and well making it, doing it in Byton the same.
And also because the ASN and the Protobuf and coding
that was done by the application.
Well during that time we decided to take another approach
and let's use another tool, which was called FRIDA,
and at that time it was the first time we used it.
And it's really an amazing tool,
it allows you to look into an application,
for example, an existing Android application,
that's running on an Android device.
And for example,
bring the information that's in the function
or call out a functions and do modifications for example.
After trying, we were able to print out the CAM PX,
and on the right you could see the snippet
of that information, and like Rik was talking about,
you see the basic container station type
and GPS coordinates.
We were like this pretty interesting,
what and how the system will react
if we are going to manipulate this information.
In order to do so,
we also use data and we were able to write a script
that's on the left and what it is doing,
it's again, just hooking
before the publish karma function is being called.
The CAM PX is published on MQTT
just before that we modified information.
For example, the speed, the GPS coordinates
and information like that.
And our goal was to imitate the behavior
that you see in right in the image,
to let the system believe that there is a cyclist
cycling on the intersection all the time,
and add in the loop.
The thing was at that time,
we weren't just recognized as one cyclist.
And that was well, we wanted to bypass it,
we want it to be continuously while a loop of cyclists
that are passing the intersection.
So we are trying to bypass that
and the way to bypass it was quite simple,
because we found out that just before the...
If we just, before the CAM has been published,
disconnect and connect on the MQTT channel,
we are recognized as a different and a new cyclist.
By just disconnecting and connecting,
we are able to just before every CAM Pics was being sent,
we are able to act like we are different cyclists
instead of one.
That was cool.
We were able to, get that flow continuously.
Later on we found another similar application,
which is also an application,
and if you install it as a cyclist,
you will get the time will be decreased,
or you will instant get a green,
depending on the situation at the intersection.
But this application was even easier
because it was just sending one post request.
As you can see in the slide with similar information
that we saw in previous app, like speed, GPS coordinates,
and then information like that, also the station type,
and that was being sent to the server.
Somehow this is probably converted for example,
to CAM by the backend.
We didn't have to take care of that at all,
we just have to send one post
and the dishes will react on it.
And the interesting thing, there was no authentication,
so there is no way to distinguish a cyclist from each other
within the system.
And as it was quite an interesting Burp,
because maybe we can,
fake a lot of cyclists in the city, for example.
We wrote a pilot script to just send this post
with the correct information.
And well, we recorded the demo on it,
and I would like to show the demo.
Here you will see a video, where we are at a traffic light
at a connected traffic light on an intersection,
and in this video,
there is other traffic at the intersection,
now you will see that the system reacts and waiting sign
turns on, but it will wait until it goes to green,
when it's safe.
That's quite important to note,
the safety system stays intact,
it will never turn two lights at green at the same time.
That's luckily and good that, that's still in the place.
Also, we recorded a second video also at a traffic light,
but in this case without any other traffic,
and as you can see, while it reacts quiet quickly,
and instantly, if we send one post request
the system instantly turns to green.
So this goes quiet quickly.
What could we do with this vulnerability?
Its abuse of functionality but, like we mentioned,
it is not able to see multiple cyclists
it's just using every request and doing an action on that.
What we could do is use the previous script
and do it on a lot of traffic lights at the same time,
because that system was running in 10 cities currently.
And you could just interrupt the traffic
in a complete city at a time.
- So in conclusion, I think as we are,
the place we are now is that there's no real
use of the security part of the standard.
They are using corporate,
cooperative awareness messages
to determine where vehicles are.
But there's no clear distinction on what they are,
who you are, or if you even authorize to do so.
Luckily now we're working with the public data
where cyclists are being...
being used, but there are some closed data's
going on for trucks, for emergency vehicles.
And especially those would,
could pose a real threat for traffic.
Luckily security systems will stay intact.
So there's no like hacker style,
all the lights green at same time, cars hitting each other,
stuff like that, just currently were able to annoy you,
which is already fun.
The reason we are giving this presentation
is we really believe that this is something that's coming
and we need to be sure that this is actually working
properly, meaning that authentication,
authorization are correctly implemented.
We've seen it with e-mail, we're still having issues
determining if a mail you've received is actually
for the person you received it from.
And it's really important
that the moment our physical lives,
traffic is being controlled by these systems
that this is something that's actually properly working.
We would recommend that...
these apps will start to use some form of authentication,
at least knowing that there's one person operating one app.
If they choose the spoof, whatever it is they do,
at least we would know,
they would only be able to control one digital cyclist.
And it's becoming more and more important to detect monetary
abuse on the backend of things,
meaning that the central system receiving all these messages
and distributing them to the different traffic lights
would need to look for unexpected or implausible behavior
and block users accordingly.
Which would reduce the impact
of somebody trying to manipulate this,
and after that we need,
if the moment we have the authentication
or authorization of the control, we will have to see,
and look into abuse from a allowed user,
but that's the next step.
This is much as our presentation encompasses,
if you have any questions and you want to join the Q and A,
it will be on the 6th of August between 1:30
and two o'clock, or if you need to contact us directly,
check it out on Twitter.
- Thank you.