Come on.
There we go.
Cool. All right. Welcome back, everybody. We have another Q&A with a couple of our speakers today.
We are going to be meeting with Rick and Wesley. How are you guys doing today?
Good. Good, basically. About good.
Awesome. I'm joined by my fellow goon, Pasties. Hey, Pasties.
Hey.
So, we do have a tradition with DEF CON Talks.
We're not going to let something like going virtual stop us from doing it.
We have two first-time speakers here at DEF CON.
They have been gracious enough to continue the ritual with us of shot the noob.
So, gentlemen, thank you very much for joining us at DEF CON.
We really appreciate you helping us put out wonderful content.
Cheers.
Cheers. Congrats.
Thank you.
All right.
Now, let's get down to it.
It's a good way to loosen up.
Yeah.
So, let's see.
I'm ready for talking.
Me too.
All right. So, Rick and Wesley gave us a presentation on hacking traffic lights,
which you can see on the YouTube server.
So, if you want to check that out, and hopefully you already have.
But if you have questions, then you can go into the TrackOneLiveQA channel on Discord and ask the questions there.
Rick, do you want to just kind of give just a real quick brief introduction of yourself?
And then we'll ask Wesley to do the same.
You guys kind of give an overview of your talk.
Super quick.
Okay.
Well, my name is Rick.
And I've been a pen tester for seven or eight years now.
And together with Wesley and Erik and Theo, we founded a company called Zolder, which is Attic in Dutch.
Because that's where we grew up, where we started playing with computers in our attics, having fun.
So, that's what we do.
And our talk is about smart traffic.
And ways we found playing with those apps.
You want to manipulate traffic as it flows.
And the reason we're here is because we noticed that this is something that's actually happening.
We were initially thinking that this is not something that's there yet.
And now you can actually see that this is something that's going to be impacting our lives way more than we were currently expecting.
We're going to have cars talking to each other, cars talking to traffic lights, all that kind of stuff.
So, when we looked at this innovation, we were like, okay, is this future ready?
Or is this more like a starting off kind of thing?
And, well, we figured that there's still some room for improvement.
Excellent. All right.
And Wesley?
Yeah, well, my name is Jesse.
Also, I've been mainly working as a pentester, also seven, eight years.
So, that was pentesting customers, advising them on how to fix the issues in a technical way, but also the phishing part of it.
Well, and together we started Solr.
And at Solr we are doing quite some security research.
And this is one of our research projects.
Because, yeah, we just like to investigate this kind of innovation.
Because, well, it actually surprised me that these kind of innovations are already in such a...
Well, they are already in quite a big process on creating this kind of platform.
So, that, well, surprised me that it's quite far already.
It's still in the beginning, but the ideas are very big.
And they are trying to build crazy stuff.
Was this something, like a topic that you guys just stumbled upon, or did you have it in the back of your head?
Or did you just see, like, the Italian job and you're just like, is that even possible?
Well, I mean, if you see that, you're like, immediately, like, I want that, obviously.
But I remember very clearly that Leslie was like, oh, look at this.
And he showed a video.
Yeah, we stumbled upon some articles in the Netherlands that they were telling, explaining
that there is an application that allows you to talk to, well, traffic lights, directly or indirectly.
And that was just, we just wanted to know, how does this work?
Because it was like, okay, so you're going to allow user input to the traffic system.
That sounds a little bit scary to me, because probably I can fake this.
And, yeah, what would the impact be if we could do that?
So that's the reason why we dived into it.
Yeah, we investigated it, and it's just fun to play around with it.
That's great.
So we do have a question from the chat.
Was there anything in particular that worried you, especially while you were doing this project?
Well, to be honest, no.
What I noticed is that we were able to manipulate the system.
We could get a green light.
But it's not like you can disable local security systems.
So let's say you're requesting a green light now at a certain traffic sign.
It doesn't mean that the others get ignored, and you don't get priority.
As for the impact of our own research, it didn't worry me so much.
But what does worry me is how will we, the entire world, implement this better.
Because if you're going to have systems talking to each other, that would mean all kinds of vendors talking to each other.
All the car vendors would need to have the same standards.
All the traffic signs need to go with all the cars.
Then it gets weird.
When it's that big, it can also get scary.
But for now, no.
I think that's the most challenging part.
A lot of companies have to work together to make this a success.
For example, to monitor for abuse on the network.
They all have to work together in the same way.
So that will be a big challenge.
What kind of thing really got you guys interested in this?
How did you get started with figuring out that you wanted to look into the traffic lights?
Sorry, I had some issues with the connection.
Can you repeat it?
Sure.
What got you interested in this topic that made you want to start looking into how the traffic lights work and how you can interact with them?
Yeah, like I said, I was surprised that they are being connected.
First, I was surprised that there are even being connected to the internet.
That just surprised me and it allows me to input.
So I was just curious if we can manipulate this.
Well, of course, it's cool.
If we would be able to turn a traffic light to green over the internet, that's just fun to do so.
Yeah.
I mean, like you said, the Italian job, and I think it's in Hackers.
That's something that would be extremely cool.
We couldn't do it like that, but still.
We got a light to go green, so that's already an inspiration.
Yeah.
So, we got another question from chat.
So, your talk primarily mentioned cycling apps.
And I do know you guys covered a little bit about privileged roles like ambulances.
You briefly mentioned those.
I went into how they authenticate.
I think that was with the PKI bits.
Is there a level of protection difference that you feel was between the messages that you're sending and messages that ambulances are sending?
Well, from our perspective, we looked at these apps for cyclists.
So, we were able to publish those against web services that were expecting cyclists.
And we did try, like, okay, now we're a bus or a tram.
It doesn't look what happens.
We didn't really notice a difference.
That's probably due to the fact that we were talking to a service for cyclists.
So, there are systems for ambulances.
But those are closed.
So, you wouldn't know what security systems are in place currently.
But the ITS standard, so the Intelligent Transport System standard, does propose, like, the PKI system where they say, like, okay, you get a certificate.
And the certificate describes the roles you have.
So, you are allowed to get to do, like, sirens are on and stuff like that.
But that's a standard that's not necessarily implemented.
Correct.
Even if you implement it.
Let's say the Dutch government implements this and offers this to the different suppliers here in the Netherlands.
Yep.
And you go to, I don't know, ambulance builder company, I don't know.
And you say, like, okay, you need to be compliant with this standard.
They're going to be like, it's a small country, 18 million people, go away.
I feel like even, like, an 18 million strong country would be capable of swaying a little bit in that kind of, like...
I know sales people.
They will work.
They will promise it.
Yeah.
I don't know.
Sometimes you put a little bit of pressure on them.
There was one application available which we were at least able to download.
It was for trucks.
So, the trucks would get a green flow, yeah, if you're driving a truck.
But the vendors had authentication on that.
So, it was still a closed application for us.
So, that's the reason why we dived into the cycling.
Because that was available for us.
So, how widespread is this?
Does the cycling app work with, like, any traffic vendors?
Is this, like, an international standard that this just works everywhere?
Or is this something that, like, a city has to opt into?
Or they just have to choose this particular traffic light vendor or something?
Do you guys...
Well, they are working on the standard.
They are replacing all the old traffic light systems for new ones.
So, they will be intelligent.
And they are capable to talk with each other.
That's the goal.
But they are still trying to replace all the traffic light systems to be able to do that.
So, currently, it's just the vendors doing it on their own traffic light systems.
On their own.
But the final goal is to be able to talk everyone to everyone.
And be compatible with everyone.
So, it's not yet cross-vendor.
They will try to implement standards so you can actually have your app...
That was where my next question was going to go.
It's like, how does the cross-vendor stuff work?
If this was more than just, like, one system that's doing it.
Yeah, I mean, I don't know.
This is what surprised me.
There are more companies that do this than I expected.
And there are actually more companies that build traffic lights.
Which also surprised me.
But they all want to be the next Google, right?
So, they all want to be the next Google.
They all want to, like, look at our app.
Look at our traffic light.
It's the smartest in our way.
So, everybody has to follow our standards.
But they are, luckily, they are cooperating under a bigger project.
But that's, like, on a separate track.
But they are doing wonderful things.
And also interesting.
We are doing it in the Netherlands right now.
But, of course, we want to be compatible with the whole of Europe.
So, it's also a challenge.
It's a really big project.
And we are trying to achieve that.
We do have a bunch more questions coming in chat.
Do you want to ask any more?
I don't want to take up all the space.
No, go for it.
Okay, cool.
So, one is sort of a safety question.
This seems, like, good to address.
Because you guys did bring it up beforehand in our little chat.
Do you guys wind up, if you could effectively shut down an intersection to a direction by spoofing a long-stream cyclist?
It's not quite what we had going for, but it's along those safety tracks.
And Phoenix does, like I'm curious, do.
No, we haven't tried that, no.
Just, like, consistently sending those messages to see if you can just sort of keep it great?
Well, yeah, we've tried to do multiple messages in a couple of seconds, or just in a loop.
And the system was just trying to turn green light on every time.
So, yeah, it waits until the system allows it to go to green.
So, it was just constantly requesting green.
And the system would do it whenever it was possible.
But it was not pressing or something.
It would just keep on working.
Maybe if you do it a lot, like a denial of service, you might succeed in it.
But, yeah, that was not our goal.
But when it's working appropriately, you sending a bunch of messages is just like an annoying pedestrian
just pushing the sidewalk button a thousand times before it turns red.
Yeah, all the time. You're just pushing it.
And if it turns off, you're just pushing it on again.
And that's the behavior that it creates.
Yeah, that's great.
Did you guys reach out to any of the... I mean, I guess this is one app maker in specific.
But did you reach out to them for any comments or tell them about this at all?
Yeah, we reached out to both vendors.
Yeah, they were going to look into it.
Classic response?
Sorry?
I said classic response. Sorry.
Yeah, they were actually pretty interested.
They sent a few calls.
One of the vendors had an old plan.
We have this plan, this plan, this plan, this plan.
What do you think works?
And the other vendor was like, OK, could you help us with this?
Those were cool responses.
But at the same time, they were like, yeah, but these are device calls.
How do we do that?
Yes, the standard has a security solution in it, but there's nobody providing the public key infrastructure
There's no authorities yet in the smart traffic space.
So, they are willing. They are looking into it.
But also at the same time stating, it's quite hard.
How bad is it for a bike?
Which we actually agree on.
This is fun and it can be annoying, but that's about to extend to the impact.
So, the reason why we're talking about this is we think it's really important that other people know that this is even happening.
And maybe we should look into this.
Yes, we should.
It's got to be the basis for a lot of infrastructure for all of us.
And also they had quite an interesting challenge.
Because they don't want to harm the privacy of the users.
So, they don't want to track every cyclist in the city.
Yes, that's good.
But that's quite an issue.
Because you need somehow an identifier to know that a bicyclist is the same as before.
But then you've got some privacy issues.
So, they don't want to track the users, but they want to know that it's the same.
So, that's quite a challenge for them.
Yes, an interesting challenge.
You guys just did a natural lead into two both very important questions that were in the chat.
Anna asks, do you have a guesstimate for when an implementation of a system like this could be secure enough to be a no-brainer?
If it was implemented globally as a vendor thing, and do you think that the benefits are actually worth the risks of having this kind of connectivity into our traffic systems?
I actually think it's worth it.
Might be worth it.
You mean for cyclists?
No, no. I mean, for cyclists, this seems like the safest thing.
You want to see what I can do?
Pedestrian crossing signs are regularly not placed someplace that as a biker I can hit.
But I still want the pedestrian crossing light quite frequently.
So, I can definitely see why I would want to use this kind of system, but that doesn't mean tying my phone into critical infrastructure, basically.
We actually have quite some bike roads in the Netherlands.
We have more bikes than people.
So, people use this as a mode of transport.
I think there are probably only people that really enjoy the whole bike thing.
And I actually think if you make it hard to get an account of this,
maybe even like the, how many boats do you see in these pictures?
Like the Google CupJab.
Then, at least, if somebody's proof, he's one bike.
Or if he's really persistent, he's probably 10 bikes.
But I mean, he's not going to hire a pig farm somewhere to get all the CupJabs.
So, I think they would have very little security extra features on it.
Very little tracking.
And it would still make it more difficult for somebody to play with this.
But I think in a broader perspective, where, I don't know, traffic is talking to each other.
Traffic lights, road signs.
There's an incident and all the cars get alerted to it.
An ambulance needs to get somewhere.
And all the traffic lights ahead of it know when to turn green for that particular...
So, the ambulance gets there faster.
Those kind of innovations are, I think, really important.
Economically, because if the trucks are faster and easier to get there, it's better for us.
If we have less traffic, it's better for us.
But also from a safety perspective.
Because I do believe that eventually machines will be better at driving than we are.
And if that's the case, if we have such a system, then it's really important that this whole thing is a bit more secure.
I don't know how long it will take.
Probably a pretty long time.
But when the big car companies...
Like, we're going to do this.
I think it might go far.
So, based off of some past experience with car research, do you feel like this is a place where the vendors are going to...
Like, they're intentionally trying to set this up correctly?
Or do you think this is going to be another one of those situations where security is a second-class citizen?
I don't know.
Any thoughts?
I have very little experience with car security.
How is car security?
No ecosystem.
I mean, there is a car-hacking village, and I've never known those guys to fail.
So...
It was fun.
Yes.
Cliver, do you have any questions lined up?
Let's see.
Well, we can throw the one from Fenix out there.
Fenix asked, in your talk, you mentioned you saw one app sending what looked like CAM data being sent over MQTT,
which maybe implies it's just being directly routed to the controlling systems.
Are you looking to do follow-up research on the server side or controller components?
Well, we would really like to do so, but of course, the vendor has to give the access in order to do so.
So, yeah, of course, we would really like to do research further on this and dive into it.
So, yeah, I would definitely like it to do so.
But, yeah, the vendor also has to work with us together.
But we are in good contact with them, so who knows?
Hopefully.
Yeah, they actively said that they wanted to work with you.
It's heartening for me.
Is there, like, a next for you guys? Because I know a lot of times you kind of just run out of time for your research.
Are there future plans on what you want to look into going forward, or have you taken this as far as you want to?
No, I don't think it's...
If we get the chance to play with some of the stuff, I mean, there's stuff apparently, and we don't think it can do a thing.
I want to do a thing.
There might be, like, trucks or other car apps that might come out, or other of these cool new innovations.
But getting access is usually the hard part.
But if you can get access, I mean, it would definitely be fun.
But, I mean, the moment you start...
Like, let's say one of these companies allows access to their internal stuff.
It's probably not going to be a difficult thought, unfortunately.
Us too.
Like, had to cut because you were short on time, or anything like that?
We had to remove Burt from Burtner.
That hurt, man. That hurt.
So, we had, like, Burt, the gif, where he's like...
And, um, we had that because we had something like a line, like, they're allowing us to talk to traffic lights.
So we had a Burt surprise.
And then we got feedback, like, no, you can't have that.
We had to remove that because it's probably copyrighted.
Oh, okay, yeah, fair enough.
You mentioned the Italian job.
And the thing is, I spent... I wasted a good four hours cutting together footage from the Italian job, hackers, and watchdogs.
Just so we could have, like, a ten-second video where it's like, this dog is talking about this.
And then show, like, all these crazy car hacks.
And it was such a nice intro, and I was so proud of it.
And the first thing we go back, like, no, that can't happen. We have to remove that.
Oh, that's unfortunate. Fair use.
Fair use.
Yeah.
Yeah, it's still working through.
We're approaching the end of our sessions.
Usually this is where the questions start to die out.
Do you guys have any advice for somebody else that wants to just kind of dig in and begin this kind of research?
I know there's a lot of people out there that think what you guys did is really interesting.
And, like, maybe people think, like, why can't I do that?
Could they? And how would you give them advice on how to start the type of research that you two do?
Well, I think just look into the inventions that are going on in your country.
Because, well, I didn't know that this kind of cool stuff was going on in the Netherlands.
But, yeah, some article pointed us on that.
But I think with some googling you can find some cool stuff and just look into the things that they already have released and dive into it, yeah.
Yeah.
I think get Greenlight mobile app.
And then just see what pops up.
And there's probably some company trying something out.
And then after that just pull it to Burp.
See what it sends to the backend.
And see what happens.
Maybe decompile the app.
See how it works.
I mean, I remember when some of those news articles come out, I don't care.
I can't read them.
And Wesley has like a skill where he's actually like, oh, this is interesting.
And my default mode is like, no care, go away.
And then after like a couple of minutes, he was like, oh, but look, this is really interesting.
And then I was like, oh, wow, he's right.
And so keep an open mind with those kind of things.
Really important.
And I remember when we were trying to, but you were like, okay, this is common.
Can we just create a Python script?
Yeah.
Like ASM1 encoded.
So our own scheme.
And then through Protobuf, Google Protobuf.
And then push it to MP3.
And after a while, they were like, okay, you spent way too much time on this.
Can't we just modify the app?
And I was like, what the fuck?
What do you mean modify the app?
I've been spending way too much time on this.
We are not quitting this venue.
To keep on trying.
And if it doesn't work, try to find a workaround.
Yeah, work smarter.
Frida was way easier because he just instrumented the app.
And modified the browser before he got to the function that actually created the object.
So he was pretty good for it.
To go in.
Sometimes something can be sitting right in front of you and you just need a fresh pair of eyes.
And you're just like, why aren't you just doing this?
Yeah, but that's a lot in our own business.
Yeah, another few is important.
The solution might be very easy.
It's really easy to go full laser on a problem.
We are approaching the end of our time.
I think we've got two minutes left in our session.
Is there anything you guys want to shout out or call out or do before the Q&A session ends?
Yeah, if anybody has more questions and they wanted to reach you after this, how would they do that?
Twitter, I think it's the easiest way. Just a direct message.
What's your Twitter?
Just my name.
Just your name?
Maybe we can drop it in the track one talk as soon as the Q&A session ends.
You can reach out on Twitter if there's anything you want to know or if you want to play around with it.
Or if you want to learn something or you have a question about the tool or something.
Perfect.
Well, thank you both a ton for doing a talk at Virtual DEF CON Safe Mode.
Thank you for doing this Q&A session. It's been great.
Yeah, I hope you guys participate in DEF CON again.
Yeah, it's very cool.
It was really fun.
Yeah.
Alright.
Thanks so much for doing this.
And everybody come on back in about a half an hour and we'll have a couple more speakers and goons here to talk with you.
Thanks guys.