1 00:00:00,000 --> 00:00:01,800 Hi, welcome everybody. 2 00:00:02,040 --> 00:00:10,400 We would like to talk today about a research project we did, Hacking Traffic Lights, and we would like to share our findings and our... 3 00:00:11,200 --> 00:00:13,800 well, the things we found in our research. 4 00:00:14,760 --> 00:00:16,260 Well, first of all, who are we? 5 00:00:16,260 --> 00:00:20,000 My name is Wesley Nele and my colleague's name is Rick van Duin. 6 00:00:20,260 --> 00:00:25,680 And we both have been mainly pen testing in the past years for about seven, eight years. 7 00:00:25,680 --> 00:00:29,580 And of course, we also have our own interests. 8 00:00:29,580 --> 00:00:34,380 For example, I like to play around with Internet of Things and the security of it and innovations like that. 9 00:00:34,380 --> 00:00:38,780 And Rick likes to play with malware and investigate that. 10 00:00:38,980 --> 00:00:43,940 I would like to... at least one disclaimer, we are no smart traffic experts. 11 00:00:43,940 --> 00:00:47,760 We're just, well, two guys that are interested in this kind of innovations. 12 00:00:48,060 --> 00:00:49,760 So we decided to use... 13 00:00:49,760 --> 00:00:51,820 to do research on it. 14 00:00:51,820 --> 00:00:59,380 We do use bicycles because we're Dutch, but that doesn't really help us in our investigation, in our research. 15 00:01:01,320 --> 00:01:03,920 Well, a small introduction. 16 00:01:04,360 --> 00:01:12,700 Well, what we've seen that there is... they are creating a platform, multiple vendors are creating a platform to exchange information between traffic information. 17 00:01:12,700 --> 00:01:22,980 For example, road signs can report die states on a network, the parking spots, how many are still available and how many are occupied. 18 00:01:23,360 --> 00:01:27,960 Other traffic status, for example, is there a traffic jam and stuff like that. 19 00:01:28,420 --> 00:01:40,080 But they are even trying to connect the traffic lights, the actual traffic light systems to the same network so it can act, well, on the messages that are sent on the network. 20 00:01:40,760 --> 00:01:46,180 And one of the examples is that they actually want to connect the road users to the network as well. 21 00:01:46,180 --> 00:01:52,760 For example, cyclists, cars, trucks, and even the rescue vehicles, the emergency vehicles. 22 00:01:53,460 --> 00:01:58,580 Well, I have to mention that in this research, we mainly have been focusing on the cyclist. 23 00:01:58,580 --> 00:02:05,280 And the reason for this is that, well, there was an app available that allows you as a cyclist to install it. 24 00:02:05,280 --> 00:02:14,100 And if you're cycling on a road, you will get, well, the time to green will be decreased or maybe even instant green. 25 00:02:14,620 --> 00:02:17,780 So, because it was available, we focused on that. 26 00:02:17,940 --> 00:02:25,640 Well, important fact is that in the Netherlands, there are a lot of bicycles, 23 million, and we have a lot of cycling infrastructure. 27 00:02:25,640 --> 00:02:32,040 So, well, imagine that on every intersection, there's almost a cycling traffic light. 28 00:02:32,040 --> 00:02:34,700 So, it's quite important in our country. 29 00:02:36,260 --> 00:02:41,520 Well, like said, we've seen multiple apps being released. 30 00:02:41,920 --> 00:02:47,800 So, we are mainly interested in the fact that we are able to talk to traffic lights somehow. 31 00:02:47,800 --> 00:02:50,520 And for example, how are we able to talk to them? 32 00:02:50,520 --> 00:02:52,920 And what if we are able to manipulate it? 33 00:02:52,920 --> 00:02:53,600 What is possible? 34 00:02:53,600 --> 00:02:55,720 And what can we manipulate? 35 00:02:56,300 --> 00:03:01,320 So, that was pretty interesting and the reason why we started the research. 36 00:03:02,280 --> 00:03:06,860 Well, one of the things we see in the Netherlands, there's an ongoing partnership. 37 00:03:07,700 --> 00:03:11,680 And the goal of that partnership is to realize smart traffic. 38 00:03:11,680 --> 00:03:15,320 And the goal is to improve the safety, comfort, and traffic flow. 39 00:03:16,260 --> 00:03:24,440 Well, a lot of things are happening in that partnership, but some of the things are, for example, the cyclist app that I was talking about. 40 00:03:24,840 --> 00:03:30,240 They are trying to give the user the ability to install an application on its phone. 41 00:03:30,240 --> 00:03:41,120 And when he's cycling on an intersection, the cyclist's time will be decreased to go to green, or maybe even instantly go to green if there's no other traffic at the intersection. 42 00:03:41,900 --> 00:03:44,520 But another thing is, for example, for trucks. 43 00:03:45,020 --> 00:03:51,280 They are trying to realize a green flow on multiple traffic lights. 44 00:03:51,280 --> 00:03:55,040 So, the trucks have to stop less, which is, of course, a great idea. 45 00:03:55,600 --> 00:04:07,780 And the emergency vehicles, well, that's maybe even the most interesting one, because those will get instantly green if they will be passing a connected traffic light. 46 00:04:07,780 --> 00:04:17,280 But also, other users, the road users, will be notified so that there is a vehicle coming, coming up, emergency vehicle. 47 00:04:19,140 --> 00:04:23,960 An important thing within the partnership is VRIs. 48 00:04:23,960 --> 00:04:33,840 VRIs are the systems that are actually at an intersection that are actually, well, controlling the actual traffic lights. 49 00:04:34,020 --> 00:04:45,840 And they are replacing the old systems for intelligent ones, so that it is compatible with the network and that it is possible to communicate to it, but also that it is able to send its own information to the network. 50 00:04:46,060 --> 00:04:58,600 And what we've seen that currently about 500 IVRIs or VRIs have been replaced for IVRIs, which is about 10% of the total amount of VRIs. 51 00:05:00,060 --> 00:05:09,680 And to give you an idea how the things are connected to each other, on the right, you will see the road users, for example, cars, cyclists, or trucks. 52 00:05:10,300 --> 00:05:20,260 And they are, well, connected to the network, for example, by using an app, like I said earlier, but it's also possible that it might be an onboard computer within the truck, for example. 53 00:05:20,260 --> 00:05:28,760 And those systems are talking to the, well, to cloud services, which are also like the apps created by multiple vendors. 54 00:05:29,220 --> 00:05:35,740 And in the cloud, the information that is sent to the cloud can be sent onto the network. 55 00:05:35,740 --> 00:05:37,900 And, for example, to traffic lights. 56 00:05:37,900 --> 00:05:52,320 And one of the important things in there is that mostly this is done by using come objects, which is a standard that allows you to, a traffic light network or traffic network. 57 00:05:52,420 --> 00:05:54,320 And Rick will be explaining more on that. 58 00:05:54,540 --> 00:05:55,240 Cool. 59 00:05:55,320 --> 00:06:04,420 So when we initially looked at the first app that allowed users to get a green light, we saw lots of references to come objects. 60 00:06:04,420 --> 00:06:09,080 And we saw that the app was building come objects with the position, stuff like that in it. 61 00:06:09,080 --> 00:06:11,500 And for us, it was unclear what those were. 62 00:06:11,500 --> 00:06:20,180 So we started Googling and we figured out that it's actually a part of the intelligent transport system standard, which is a European standard. 63 00:06:20,180 --> 00:06:21,060 There's a different one. 64 00:06:21,060 --> 00:06:26,180 As far as we know, there's a different one in the US and it might even be a different one in your country. 65 00:06:27,900 --> 00:06:32,460 So important part of this standard are the cooperative awareness messages. 66 00:06:32,460 --> 00:06:34,380 So come messages. 67 00:06:35,040 --> 00:06:37,600 In the US, they're called basic safety messages. 68 00:06:38,160 --> 00:06:44,040 These contain all kinds of information about the intelligent transport system. 69 00:06:44,040 --> 00:06:49,220 So it could be a car telling you its speed, stuff like that. 70 00:06:49,760 --> 00:06:58,400 So when we looked into the objects itself, we noticed that they contain lots of different information. 71 00:06:58,400 --> 00:07:03,100 So we can see the position, what type of vehicle you are. 72 00:07:03,100 --> 00:07:13,640 Important to note, later we can see why you shouldn't use the station type to determine what a user is and what they can do. 73 00:07:14,260 --> 00:07:16,640 But there's also a different container. 74 00:07:16,640 --> 00:07:20,180 So there's a high frequency container, which contains data that changes often. 75 00:07:20,180 --> 00:07:26,100 So stuff like data, the direction, information like that. 76 00:07:26,100 --> 00:07:39,020 And there's a low frequency container, having data that's more static, such as my lights are on or off, or this was my history, my path history. 77 00:07:40,220 --> 00:07:45,860 But more importantly, we came across a special vehicle container. 78 00:07:45,860 --> 00:08:01,480 And this container contains information such as I'm transporting dangerous goods, or I'm in emergency vehicle, and I need to have a green light right now, stuff like that. 79 00:08:01,560 --> 00:08:05,400 So this for us was the point where we were like, okay, can we manipulate this? 80 00:08:05,400 --> 00:08:10,740 And can we send this to the traffic lights that are connected to our apps? 81 00:08:11,400 --> 00:08:20,720 Well, when we started looking into this, we actually figured out that the intelligent transport system standard already has a security standard in it. 82 00:08:20,720 --> 00:08:29,920 It's based on public key infrastructure, where, very simplified, your vehicle receives a certificate. 83 00:08:29,920 --> 00:08:46,640 The certificate contains information about your vehicle and, well, not necessarily your identity, but that you are a vehicle and what you are allowed to do, which allows other systems on the road to actually validate what you are sending to them. 84 00:08:47,040 --> 00:08:56,480 So part of the comm messages and the certificate are the SSP and the ITS-AID. 85 00:08:56,480 --> 00:09:06,740 So the ITS-AID is the intelligent transport system application ID, and it describes some basic permissions, such as you are allowed to send comm messages. 86 00:09:07,400 --> 00:09:15,200 And there's a server-specific permission that's also in there that allows you to actually say, I'm allowed to do this. 87 00:09:15,200 --> 00:09:21,760 So for example, I am an emergency vehicle and I'm allowed to tell the world that I need green lights right now. 88 00:09:22,960 --> 00:09:44,200 So every message you send out, you sign and it's combined with the certificate in order to let other systems on the road identify that the message you are sending them is actually valid, you are allowed to send it, and that you actually have the correct permissions to request this. 89 00:09:44,780 --> 00:09:51,420 So when we were preparing this presentation, we actually came across some interesting work already that's being done on this. 90 00:09:51,420 --> 00:10:02,500 So there's a cool paper by Yosef Kamel, which goes on to assume, let's say our authentication authorization is already correct. 91 00:10:02,920 --> 00:10:06,780 What can we do with a valid car? 92 00:10:06,780 --> 00:10:14,220 So can I say to others, I'm putting on the emergency brakes right now, will other cars immediately start braking? 93 00:10:14,220 --> 00:10:16,260 So there's really interesting research being done. 94 00:10:16,260 --> 00:10:23,620 There's also some cool software being released in order to look for abuse on the network already. 95 00:10:24,440 --> 00:10:27,940 So the security for this exists. 96 00:10:27,940 --> 00:10:38,400 However, when we started looking into the apps that Wesley will talk about soon, we noticed that there's still some work to be done. 97 00:10:39,800 --> 00:10:48,400 Yeah, like earlier mentioned, we saw multiple well, Android applications that a cyclist could install on his phone. 98 00:10:48,440 --> 00:10:58,560 And if he installs it, and he's approaching an intersection, he will get green, the time will be decreased to green, or he will instantly get green. 99 00:10:58,900 --> 00:11:02,360 So when we saw that, we were like, okay, what's going on? 100 00:11:02,360 --> 00:11:03,540 How does this app work? 101 00:11:03,540 --> 00:11:05,940 And what is it exactly doing? 102 00:11:06,200 --> 00:11:13,500 And what we did, we did decompile the applications, and we saw that CommonPX were being sent over MQTT. 103 00:11:13,980 --> 00:11:24,140 And that was pretty interesting, because if we are able to create those CommonPX ourselves and send it over MQTT, for example, using Python, well, we might be able to trick the system. 104 00:11:24,820 --> 00:11:29,280 The thing was, at that time, we didn't know what CommonPX exactly were at that time. 105 00:11:30,060 --> 00:11:36,180 So we had quite a hard time imitating the behavior and, well, doing it in Python the same. 106 00:11:36,180 --> 00:11:41,040 And also because the ASN and the protobuf encoding that was done by the application. 107 00:11:41,860 --> 00:11:49,020 So, well, during that time, we decided to take another approach, and let's use another tool, which was called Frida. 108 00:11:49,160 --> 00:11:51,920 And at that time, it was the first time we used it. 109 00:11:52,100 --> 00:11:53,840 Well, and it's really an amazing tool. 110 00:11:53,840 --> 00:12:00,940 It allows you to, well, hook into an application, for example, an existing Android application that's running on an Android device. 111 00:12:00,940 --> 00:12:07,860 And, for example, print the information that's in the function or call other functions and do modifications, for example. 112 00:12:08,000 --> 00:12:13,660 So, well, after trying, we were able to print out the CommonPX. 113 00:12:13,820 --> 00:12:17,480 And on the right, you can see a snippet of that information. 114 00:12:17,540 --> 00:12:23,260 And like Rick was talking about, you see the basic container, the station type, and GPS coordinates. 115 00:12:23,260 --> 00:12:25,860 So we were like, this is pretty interesting. 116 00:12:25,980 --> 00:12:30,660 What and how the system will react if we are going to manipulate this information? 117 00:12:32,400 --> 00:12:34,980 So in order to do so, we also used Frida. 118 00:12:35,080 --> 00:12:38,660 And we were able to write a script that's on the left. 119 00:12:39,000 --> 00:12:44,520 And what it is doing, it's, again, just hooking before the published com function is being called. 120 00:12:44,520 --> 00:12:47,120 So the CommonPX is published on MQTT. 121 00:12:47,540 --> 00:12:54,440 But just before that, we modify the information, for example, the speed, the GPS coordinates, and information like that. 122 00:12:54,440 --> 00:13:06,320 And our goal was to imitate the behavior that you see in the right, in the image, to let the system believe that there is a cyclist cycling on the intersection all the time, and that in a loop. 123 00:13:06,640 --> 00:13:12,140 The thing was, at that time, we were just recognized as one cyclist. 124 00:13:12,140 --> 00:13:15,000 And that was, well, we wanted to bypass it. 125 00:13:15,000 --> 00:13:20,840 We wanted to be continuously, well, a loop of cyclists that are passing the intersection. 126 00:13:21,520 --> 00:13:24,180 So we are trying to bypass that. 127 00:13:24,260 --> 00:13:39,040 And well, the way to bypass it was quite simple, because we found out that just before the com is being published, disconnect and connect on the MQTT channel, we are recognized as a different and a new cyclist. 128 00:13:39,040 --> 00:13:49,060 So by just disconnecting and connecting, we are able to, just before every CommonPX was being sent, we are able to, well, act like we are a different cyclist instead of one. 129 00:13:49,060 --> 00:13:50,460 So that was cool. 130 00:13:50,460 --> 00:13:54,140 We were able to, well, get that flow continuously. 131 00:13:54,920 --> 00:13:59,200 Later on, we found another, a similar application, which is also an application. 132 00:13:59,200 --> 00:14:08,500 And if you install it as a cyclist, you will get, well, the time will be decreased, or you will instantly get green, depending on the situation at the intersection. 133 00:14:08,940 --> 00:14:13,620 But this application was even easier, because it was just sending one post request. 134 00:14:13,620 --> 00:14:25,540 As you can see in the slide, with similar information that we saw in the previous app, like speed, GPS coordinates, and information like that, also the station type. 135 00:14:26,300 --> 00:14:28,060 And that was being sent to the server. 136 00:14:28,060 --> 00:14:34,220 So somehow, this is probably converted, for example, to come by the backend. 137 00:14:34,820 --> 00:14:37,260 So we didn't have to take care of that at all. 138 00:14:37,260 --> 00:14:40,660 We just have to send one post and the system will react on it. 139 00:14:40,740 --> 00:14:43,500 And the interesting thing, there was no authentication. 140 00:14:43,500 --> 00:14:47,960 So there's no way to distinguish a cyclist from each other within the system. 141 00:14:47,980 --> 00:14:56,660 And that was quite an interesting part, because maybe we can, well, fake a lot of cyclists in the city, for example. 142 00:14:57,120 --> 00:15:01,600 Well, we wrote a Python script to just send this post with the correct information. 143 00:15:02,200 --> 00:15:06,840 And, well, we recorded the demo on it, and I would like to show the demo. 144 00:15:07,340 --> 00:15:13,980 Here you will see a video where we are at a traffic light, a connected traffic light on an intersection. 145 00:15:14,440 --> 00:15:17,640 And in this video, there is other traffic at the intersection. 146 00:15:17,640 --> 00:15:21,440 And you will see that the system reacts and the waiting sign turns on. 147 00:15:21,760 --> 00:15:26,120 But, well, it will wait until it goes to green, well, when it's safe. 148 00:15:26,120 --> 00:15:28,340 So that's quite important to note. 149 00:15:28,560 --> 00:15:30,480 The safety system stays intact. 150 00:15:30,480 --> 00:15:34,860 So it will never turn two lights at green at the same time. 151 00:15:35,220 --> 00:15:39,640 So that's lucky and good that that's still in place. 152 00:15:40,100 --> 00:15:46,500 Also, we recorded a second video, also at a traffic light, but in this case, without any other traffic. 153 00:15:46,500 --> 00:15:50,280 And as you can see, well, it reacts quite quickly and instantly. 154 00:15:50,280 --> 00:15:55,320 If we send one post request, the system instantly turns to green. 155 00:15:55,800 --> 00:15:58,800 So it just goes quite quickly. 156 00:15:58,800 --> 00:16:02,580 So what could we do with this vulnerability? 157 00:16:02,580 --> 00:16:09,420 Well, it's abusive functionality, but, well, like we mentioned, it is not able to see multiple cyclists. 158 00:16:09,420 --> 00:16:14,300 It's just, well, using every request and doing an action on that. 159 00:16:14,300 --> 00:16:25,940 So what we could do is use the previous script and do it on a lot of traffic lights at the same time, because that system was running in 10 cities currently. 160 00:16:26,480 --> 00:16:32,600 So you could just interrupt the traffic in a complete city at the time. 161 00:16:32,820 --> 00:16:45,780 So in conclusion, I think the place we are now is that there's no real use of the security part of the standard. 162 00:16:45,780 --> 00:16:57,380 They are using cooperative awareness messages to determine where vehicles are, but there's no clear distinction on what they are, who you are, or if you're even authorized to do so. 163 00:16:57,620 --> 00:17:19,660 Luckily now we're working with the public betas where cyclists are being used, but there are some closed betas going on for trucks, for emergency vehicles, and especially those could pose a real threat for traffic. 164 00:17:20,420 --> 00:17:28,940 Luckily security systems will stay intact, so there's no hacker style, all the lights green at the same time, cars hitting each other, stuff like that. 165 00:17:29,720 --> 00:17:35,680 So just currently we're able to annoy you, which is already fun. 166 00:17:37,740 --> 00:17:52,720 So the reason we're giving this presentation is we really believe that this is something that's coming and we need to be sure that this is actually working properly, meaning that authentication and authorization are correctly implemented. 167 00:17:52,720 --> 00:18:01,600 We've seen it with email, we're still having issues determining if a mail you've received is actually from the person you received it from. 168 00:18:01,920 --> 00:18:11,820 And so it's really important that the moment our physical lives, the traffic is being controlled by these systems, that this is something that's actually properly working. 169 00:18:13,680 --> 00:18:25,200 So we would recommend that these apps will start to use some form of authentication, at least knowing that there's one person operating one app. 170 00:18:25,200 --> 00:18:35,560 If they choose to spoof whatever it is they do, at least we would know they would only be able to control one digital cyclist. 171 00:18:35,660 --> 00:18:56,520 And it's becoming more and more important to detect and monitor abuse on the back end of things, meaning that the central system receiving all these messages and distributing them to the different traffic lights would need to look for unexpected or implausible behavior and block users accordingly, 172 00:18:56,520 --> 00:19:01,360 which would reduce the impact of somebody trying to manipulate this. 173 00:19:01,360 --> 00:19:12,960 And I mean after that, if the moment we have the authentication and authorization under control, we will have to see and look into abuse from a allowed user. 174 00:19:13,060 --> 00:19:14,960 But that's the next step. 175 00:19:15,080 --> 00:19:19,120 So this is as much as our presentation encompasses. 176 00:19:19,700 --> 00:19:28,880 If you have any questions and you want to join in Q&A, it will be on the 6th of August between 1.30 and 2 o'clock. 177 00:19:29,100 --> 00:19:33,140 Or if you need to contact us directly, check it out on Twitter. 178 00:19:33,420 --> 00:19:34,080 Thank you. 179 00:19:34,080 --> 00:19:34,840 Thank you.