start	end	text
0	5980	Hi, welcome everybody. We would like to talk today about a research project we did,
5980	10400	Hacking Traffic Lights, and we would like to share our findings and our...
11200	13800	well, the things we found in our research.
14760	20000	Well, first of all, who are we? My name is Wesley Nele and my colleague's name is Rick van Duin.
20260	25680	And we both have been mainly pen testing in the past years for about seven, eight years.
25680	31320	And of course, we also have our own interests. For example, I like to play around with Internet
31320	36200	of Things and the security of it and innovations like that. And Rick likes to play with malware
36720	43940	and investigate that. I would like to... at least one disclaimer, we are no smart traffic experts.
43940	49760	We're just, well, two guys that are interested in this kind of innovations. So we decided to use...
49760	54800	to do research on it. We do use bicycles because we're Dutch,
54800	59380	but that doesn't really help us in our investigation, in our research.
61320	67920	Well, a small introduction. Well, what we've seen that there is... they are creating a platform,
67920	72700	multiple vendors are creating a platform to exchange information between traffic information.
72700	79000	For example, road signs can report die states on a network, the parking spots,
79000	85680	how many are still available and how many are occupied. Other traffic status, for example,
85680	91120	is there a traffic jam and stuff like that. But they are even trying to connect the traffic lights,
91120	98560	the actual traffic light systems to the same network so it can act, well, on the messages
98560	103820	that are sent on the network. And one of the examples is that they actually want to connect
103820	110400	the road users to the network as well. For example, cyclists, cars, trucks, and even the
110400	116300	rescue vehicles, the emergency vehicles. Well, I have to mention that in this research, we mainly
116300	121740	have been focusing on the cyclist. And the reason for this is that, well, there was an app available
122440	129100	that allows you as a cyclist to install it. And if you're cycling on a road, you will get,
129100	135620	well, the time to green will be decreased or maybe even instant green. So, because it was
135620	141200	available, we focused on that. Well, important fact is that in the Netherlands, there are a lot
141200	146980	of bicycles, 23 million, and we have a lot of cycling infrastructure. So, well, imagine that
146980	153880	on every intersection, there's almost a cycling traffic light. So, it's quite important in our
153880	163780	country. Well, like said, we've seen multiple apps being released. So, we are mainly interested
164260	169620	in the fact that we are able to talk to traffic lights somehow. And for example, how are we able
169620	174580	to talk to them? And what if we are able to manipulate it? What is possible? And what can
174580	181320	we manipulate? So, that was pretty interesting and the reason why we started the research.
182280	186860	Well, one of the things we see in the Netherlands, there's an ongoing partnership.
187700	193120	And the goal of that partnership is to realize smart traffic. And the goal is to improve the
193120	199440	safety, comfort, and traffic flow. Well, a lot of things are happening in that partnership,
199440	204440	but some of the things are, for example, the cyclist app that I was talking about.
204840	210240	They are trying to give the user the ability to install an application on its phone.
210240	216720	And when he's cycling on an intersection, the cyclist's time will be decreased to go to green,
216720	221120	or maybe even instantly go to green if there's no other traffic at the intersection.
221900	229660	But another thing is, for example, for trucks. They are trying to realize a green flow on multiple
229660	235040	traffic lights. So, the trucks have to stop less, which is, of course, a great idea.
235600	241940	And the emergency vehicles, well, that's maybe even the most interesting one,
241940	247780	because those will get instantly green if they will be passing a connected traffic light.
247780	255460	But also, other users, the road users, will be notified so that there is a vehicle coming,
255460	264480	coming up, emergency vehicle. An important thing within the partnership is VRIs. VRIs
264480	270180	are the systems that are actually at an intersection that are actually, well,
271180	277360	controlling the actual traffic lights. And they are replacing the old systems for intelligent
277360	282380	ones, so that it is compatible with the network and that it is possible to communicate to it,
282380	285840	but also that it is able to send its own information to the network.
286060	293480	And what we've seen that currently about 500 IVRIs or VRIs have been replaced for IVRIs,
293480	298600	which is about 10% of the total amount of VRIs.
300060	303680	And to give you an idea how the things are connected to each other,
303680	309680	on the right, you will see the road users, for example, cars, cyclists, or trucks.
310300	315760	And they are, well, connected to the network, for example, by using an app, like I said earlier,
315760	320260	but it's also possible that it might be an onboard computer within the truck, for example.
320260	326740	And those systems are talking to the, well, to cloud services, which are also like the apps
326740	333920	created by multiple vendors. And in the cloud, the information that is sent to the cloud can be sent
333920	339760	onto the network. And, for example, to traffic lights. And one of the important things in there
339760	348940	is that mostly this is done by using come objects, which is a standard that allows you to,
349620	354320	a traffic light network or traffic network. And Rick will be explaining more on that.
354540	360720	Cool. So when we initially looked at the first app that allowed users to get a green light,
360720	366940	we saw lots of references to come objects. And we saw that the app was building come objects
366940	371500	with the position, stuff like that in it. And for us, it was unclear what those were.
371500	377180	So we started Googling and we figured out that it's actually a part of the intelligent transport
377180	382000	system standard, which is a European standard. There's a different one. As far as we know,
382000	386180	there's a different one in the US and it might even be a different one in your country.
387900	394380	So important part of this standard are the cooperative awareness messages. So come messages.
395040	401940	In the US, they're called basic safety messages. These contain all kinds of information about the
401940	409220	intelligent transport system. So it could be a car telling you its speed, stuff like that.
409760	417520	So when we looked into the objects itself, we noticed that they contain lots of different
417520	425160	information. So we can see the position, what type of vehicle you are. Important to note,
425160	432320	later we can see why you shouldn't use the station type to determine what a user is and
432320	438080	what they can do. But there's also a different container. So there's a high frequency container,
438080	444580	which contains data that changes often. So stuff like data, the direction,
444580	453660	information like that. And there's a low frequency container, having data that's more static,
453660	459020	such as my lights are on or off, or this was my history, my path history.
460220	469120	But more importantly, we came across a special vehicle container. And this container contains
469120	476500	information such as I'm transporting dangerous goods, or I'm in emergency vehicle, and I
477380	483580	need to have a green light right now, stuff like that. So this for us was the point where we were
483580	488460	like, okay, can we manipulate this? And can we send this to the traffic lights that are connected
488460	495540	to our apps? Well, when we started looking into this, we actually figured out that the
495540	501580	intelligent transport system standard already has a security standard in it. It's based on
501580	509920	public key infrastructure, where, very simplified, your vehicle receives a certificate.
509920	515860	The certificate contains information about your vehicle and, well, not necessarily your identity,
515860	521780	but that you are a vehicle and what you are allowed to do, which allows other systems on
521780	531200	the road to actually validate what you are sending to them. So part of the comm messages
531850	539820	and the certificate are the SSP and the ITS-AID. So the ITS-AID is the intelligent transport system
539820	545400	application ID, and it describes some basic permissions, such as you are allowed to send comm
545400	553100	messages. And there's a server-specific permission that's also in there that allows you to
553100	557940	actually say, I'm allowed to do this. So for example, I am an emergency vehicle and I'm allowed
557940	566060	to tell the world that I need green lights right now. So every message you send out, you sign
566860	573400	and it's combined with the certificate in order to let other systems on the road identify that
573400	580260	the message you are sending them is actually valid, you are allowed to send it, and that you
580260	587640	actually have the correct permissions to request this. So when we were preparing this presentation,
587640	591420	we actually came across some interesting work already that's being done on this.
591420	599740	So there's a cool paper by Yosef Kamel, which goes on to assume, let's say our authentication
599740	608240	authorization is already correct. What can we do with a valid car? So can I say to others,
608940	614220	I'm putting on the emergency brakes right now, will other cars immediately start braking?
614220	618940	So there's really interesting research being done. There's also some cool software being released
618940	629280	in order to look for abuse on the network already. So the security for this exists. However,
629280	635440	when we started looking into the apps that Wesley will talk about soon, we noticed that there's
635440	642500	still some work to be done. Yeah, like earlier mentioned, we saw multiple
643120	649800	well, Android applications that a cyclist could install on his phone. And if he installs it,
649800	656280	and he's approaching an intersection, he will get green, the time will be decreased to green,
656280	662500	or he will instantly get green. So when we saw that, we were like, okay, what's going on? How
662500	668900	does this app work? And what is it exactly doing? And what we did, we did decompile the applications,
668900	675540	and we saw that CommonPX were being sent over MQTT. And that was pretty interesting, because
675540	680260	if we are able to create those CommonPX ourselves and send it over MQTT, for example,
680260	686220	using Python, well, we might be able to trick the system. The thing was, at that time,
686220	692700	we didn't know what CommonPX exactly were at that time. So we had quite a hard time imitating the
692700	699040	behavior and, well, doing it in Python the same. And also because the ASN and the protobuf encoding
699040	705760	that was done by the application. So, well, during that time, we decided to take another approach,
705760	710920	and let's use another tool, which was called Frida. And at that time, it was the first time
710920	716640	we used it. Well, and it's really an amazing tool. It allows you to, well, hook into an application,
716640	720940	for example, an existing Android application that's running on an Android device.
720940	726120	And, for example, print the information that's in the function or call other functions and do
726120	733660	modifications, for example. So, well, after trying, we were able to print out the CommonPX.
733820	739700	And on the right, you can see a snippet of that information. And like Rick was talking about,
739700	744460	you see the basic container, the station type, and GPS coordinates. So we were like,
744460	749420	this is pretty interesting. What and how the system will react if we are going to manipulate
749420	757540	this information? So in order to do so, we also used Frida. And we were able to write a script
757540	763120	that's on the left. And what it is doing, it's, again, just hooking before the published com
763120	768420	function is being called. So the CommonPX is published on MQTT. But just before that,
768420	774440	we modify the information, for example, the speed, the GPS coordinates, and information like that.
774440	779800	And our goal was to imitate the behavior that you see in the right, in the image,
780360	785140	to let the system believe that there is a cyclist cycling on the intersection all the time,
785140	792280	and that in a loop. The thing was, at that time, we were just recognized as one cyclist. And that
792280	798920	was, well, we wanted to bypass it. We wanted to be continuously, well, a loop of cyclists that are
798920	806980	passing the intersection. So we are trying to bypass that. And well, the way to bypass it was
806980	813820	quite simple, because we found out that just before the com is being published, disconnect
813820	819740	and connect on the MQTT channel, we are recognized as a different and a new cyclist. So by just
819740	824560	disconnecting and connecting, we are able to, just before every CommonPX was being sent,
824560	830560	we are able to, well, act like we are a different cyclist instead of one. So that was cool. We
830560	837960	were able to, well, get that flow continuously. Later on, we found another, a similar application,
837960	842880	which is also an application. And if you install it as a cyclist, you will get, well, the time
842880	848500	will be decreased, or you will instantly get green, depending on the situation at the intersection.
848940	853620	But this application was even easier, because it was just sending one post request.
853620	859800	As you can see in the slide, with similar information that we saw in the previous app,
859800	865540	like speed, GPS coordinates, and information like that, also the station type.
866300	872680	And that was being sent to the server. So somehow, this is probably converted, for example,
872680	878600	to come by the backend. So we didn't have to take care of that at all. We just have to send one post
878600	883500	and the system will react on it. And the interesting thing, there was no authentication.
883500	888680	So there's no way to distinguish a cyclist from each other within the system. And that was quite
888680	896660	an interesting part, because maybe we can, well, fake a lot of cyclists in the city, for example.
897120	901600	Well, we wrote a Python script to just send this post with the correct information.
902200	906840	And, well, we recorded the demo on it, and I would like to show the demo.
907340	913020	Here you will see a video where we are at a traffic light, a connected traffic light on
913020	918420	an intersection. And in this video, there is other traffic at the intersection. And you will see that
918420	924940	the system reacts and the waiting sign turns on. But, well, it will wait until it goes to green,
924940	930920	well, when it's safe. So that's quite important to note. The safety system stays intact. So it
930920	937740	will never turn two lights at green at the same time. So that's lucky and good that that's still
938240	945180	in place. Also, we recorded a second video, also at a traffic light, but in this case,
945180	950280	without any other traffic. And as you can see, well, it reacts quite quickly and instantly.
950280	958800	If we send one post request, the system instantly turns to green. So it just goes quite quickly.
958800	964960	So what could we do with this vulnerability? Well, it's abusive functionality, but,
964960	970260	well, like we mentioned, it is not able to see multiple cyclists. It's just,
970260	976200	well, using every request and doing an action on that. So what we could do is use the previous
976200	983100	script and do it on a lot of traffic lights at the same time, because that system was running
983100	991500	in 10 cities currently. So you could just interrupt the traffic in a complete city at the
991500	1004260	time. So in conclusion, I think the place we are now is that there's no real use of the security
1004260	1010340	part of the standard. They are using cooperative awareness messages to determine where vehicles
1010340	1016060	are, but there's no clear distinction on what they are, who you are, or if you're even authorized
1016060	1025160	to do so. Luckily now we're working with the public betas where cyclists are being used,
1025160	1032420	but there are some closed betas going on for trucks, for emergency vehicles, and especially
1032420	1042900	those could pose a real threat for traffic. Luckily security systems will stay intact,
1042900	1047820	so there's no hacker style, all the lights green at the same time, cars hitting each other,
1047820	1055680	stuff like that. So just currently we're able to annoy you, which is already fun.
1057740	1062260	So the reason we're giving this presentation is we really believe that
1063460	1068300	this is something that's coming and we need to be sure that this is actually working properly,
1068300	1074580	meaning that authentication and authorization are correctly implemented. We've seen it with email,
1074580	1080100	we're still having issues determining if a mail you've received is actually from the person you
1080100	1085800	received it from. And so it's really important that the moment our physical lives, the traffic
1085800	1091820	is being controlled by these systems, that this is something that's actually properly working.
1093680	1100980	So we would recommend that these apps will start to use some form of authentication,
1100980	1106660	at least knowing that there's one person operating one app. If they choose to spoof
1106660	1112860	whatever it is they do, at least we would know they would only be able to control one
1113620	1120420	digital cyclist. And it's becoming more and more important to detect and monitor abuse on
1120420	1125980	the back end of things, meaning that the central system receiving all these messages and distributing
1125980	1132960	them to the different traffic lights would need to look for unexpected or implausible behavior
1133760	1141360	and block users accordingly, which would reduce the impact of somebody trying to manipulate this.
1141360	1147620	And I mean after that, if the moment we have the authentication and authorization under control,
1147620	1154960	we will have to see and look into abuse from a allowed user. But that's the next step.
1155080	1162940	So this is as much as our presentation encompasses. If you have any questions and you want to join in
1162940	1170520	Q&A, it will be on the 6th of August between 1.30 and 2 o'clock. Or if you need to contact us
1170520	1174840	directly, check it out on Twitter. Thank you. Thank you.