Hacking US crosswalks to talk like Zuck is as easy as 1234 Crosswalk buttons in various US cities were hijacked over the past week or so to – rather than robotically tell people it's safe to walk or wait – instead emit the AI-spoofed voices of Jeff Bezos, Elon Musk, and Mark Zuckerberg. And it's likely all thanks to a freely available service app and poorly secured equipment. In …
@ Craig 2:
This is no different than any other computer system in which the default account/passphrase was left unchanged by system administrators.
One could create a system where a difficult-to-replicate, uniquely-coded, physical hardware key was required to access each computerised system.
That would lead to service personnel potentially having to carry around a backpack full of hardware keys, and, if all manufacturers did not agree to this scheme, or did not simultaneously implement this sceme, people would mostly buy the insecure systems, because they'd think the hardware key thing was "too hard".
"This is no different than any other computer system in which the default account/passphrase was left unchanged by system administrators."
I can't defend not changing default passwords, but the default password should be something pseudo random and not common across all devices in the first place. That would at least add an extra layer security for little effort.
It is compromised by using the cheapest labour possible to install and maintain. Not manufacturers fault here, unless you count missing "force change password, at least eight characters, alphanumeric, upon first setup" as a manufacturers fail. Maybe they even had such a routine, and were forced to remove it since it increased labour cost.
shame we don't have any crossing buttons that talk to you where I live.
I think the real point there is, why does the US have talking crossings in the first place? Much like their signs which light up "WALK" or "DON'T WALK" and therefore require some amount of literacy in English are now incorporating little standing or walking figures – as the rest of the world has been doing since maybe the 1950s – a bleep is much more universal. In the UK we also have a tactile indicator on most crossing buttons, particularly those which do not bleep because they are part of a traffic light system and not really button-controlled at all. This is a little knurled knobby thing on the bottom of the button box which starts rotating when it it safe to cross. Ingenious.
M.
Edinburgh in the UK had the world's first talking crossings in the 1980's. They were used at crossings where there was a central island as blind users couldn't easily tell from a beeping sound if traffic on their side of the road had been stopped. The crossings said messages such as "Traffic travelling towards Princes Street has been signaled to stop." The early models used a loop of tape in a tape player.
The current crossings just use a tactile indicator that you can feel turning when it is the pedestrian crossing phase.
Manager: "We've got some new talking crosswalk buttons that we're going to deploy. The instruction guide says that we should change the default management passcode, so we should probably change it - we don't want them getting hacked."
Team member: "We could set a different passcode on each one."
Manager: "Great idea. But we'd need to record that somewhere. We could try our asset management system, but each asset requires an asset code which we'd have to permanently mark on the asset and we don't have the budget to do that for a crosswalk button.
And anyway the asset management system would need a custom field adding for this and we don't have the time or budget to have that done.
And we would then need a special "Crosswalk button deployment procedure" which would have to be written, reviewed and approved.
And then we would need an on-site post-install check to ensure that the new procedure had been followed for each new crosswalk button.
And we'd need an annual audit to make sure that all procedures were being followed properly and consistently, and we really don't have the time or budget to do any of that.
So let's just change the code to '2345'.
Or we could just leave it at '1234' - nobody's going to want to hack a crosswalk button..."
> And we would then need a special "Crosswalk button deployment procedure" which would have to be written, reviewed and approved.
I HOPE that one already exists! Imagine, all drivers get green, and all pedestrian get green. At the same time. You need a procedure and norm how to do this anyway.
A few other lines from your post are the same direction, system is probably already in place.
> we don't have the budget"
But this wins.
"And anyway the asset management system would need a custom field adding for this and we don't have the time or budget to have that done."
You beat me to the narrative.
It's like the explanation for Dark Matter/Energy, it's where all the accounting is done for the other 4%.
If PC-Principal would hear this he would go nuts using the italo-american slang for removing problematic people.
Let's say I get access to one of these and change the pin myself. We have the following statement from the article.
"The hardware is built to be simple and durable, while the software controlling it is a basic industrial system accessed via Bluetooth."
It stands to reason there are two options a company like this can take. A physical reset requiring access to each device or hard coded credentials that override the pin.
I wonder which they chose. They didn't bother to force the pin change on first use so it would appear they don't think about these things.
I also note the following "Brute-forcing the passcodes won't work as after too many goes, the devices lock you out". This is not true but I will not divulge why it isn't true for obvious reasons unless of course it's some sort of time delay but even so there are ways round that and I can guarantee with absolute certainty that once you have the pin for one you have the pin for all within a set municipality. No one in their right mind is going to use random pins with a record of every single one.
My understanding of these things is this needs a software redesign with a firmware upgrade. It's not going to go away.
I find it amazing that we have all this amazing technology that people don't understand fully to be able to make it secure. That includes me as well. I do think regardless of that we should know what questions need to be asked and ask them. How do you not ask how do I access it and then ask how is it secured so no one else can access it? It never used to be like this. I remember a time phones came with default unlock codes and everyone knew to change them.
This is such a fail on a national scale. There are countless movies and series out there about hacking traffic lights, how they are all secured and very securely centrally controlled so a hacker must go through many hoops (Ghost In The Shell hacking level, or the more-show-than-actual-hack Hackers movie from 1995)... Then reality comes in 30 years later and all our jokes, all our irony, all our sarcasm got reality in a way SO BAD... All that panic of traffic lights being hacked by Russia or China and then... No surprise my irony and sarcasm detectors are broken, and continue to stay broken since we know it is currently getting worse, and I can still feel lucky to be on this side of the pond.
> panic of traffic lights being hacked by Russia or China
Actually this shows it is NOT trivial to hack walk-light signs. Apparently you have to GO to Bluetooth range (30'/10m?) for EVERY light. Or at least cluster (intersection) of lights. You can't just sit in Mom's dacha on the other side of the world because Last Mile.
You know how antennas work? Even a simple larger stick antenna can give you four times the range, no modification to the circuits. Invest a bit more into the calculations of the antenna and 10 times range is in, go parabolic and you can get further. Then invest into a better receive circuit, and double again. For sending the antenna gain is not that important, can be compensated with more power. Oh, and separate antennas for sending and receiving of course. All that stuff can easily be hidden in a normal car (Europe size normal, US normal would allow a lot more).
The actual distance limit is when sending and receiving are so far from each other things start to kick in like light speed, wavelength and reflections. With some math (you know, like 4G 5G starlink etc) you can get that compensated to some extend, but the light speed is the final distance limit. But I don't know the bluetooth timing requirements for communication, so don't ask where those limits are, but I suspect at more than 3 km (3km, twice since send and receive, equals 0.02 milliseconds. Check in powershell [decimal]6000/299710000*1000 - we cannot use 299792458 here since we are in the atmosphere, not vacuum. [decimal] 'cause that forces powershell to use 128 bit floating point).
Bluetooth is packetized on 2.4 GHz. That gives you lots of problems. You're going to have to work very hard to connect over distances of 3 km just because the signal is likely to be attenuated by everything in between. You can turn your transmit power up very high if you want, but the light controller won't. Normal Bluetooth connections use collision avoidance so it's not hard to identify the signal you're interacting with, but it isn't trying to avoid collisions with something 2 km away. If you're able to receive your signal at that distance, you have to manually tell it apart from all the other signals between you and it, and you have to do this for every packet it sends. It's not just Bluetooth devices that will interfere. 2.4 GHz WiFi and any other use of the unlicensed band is possible.
Even if you can fix both of these problems, you still have to have someone with relative physical proximity wherever you want to attack, and it's not clear how much control you may have over the box if you succeed. If anyone knows that you're likely to do it, they can detect a signal that's much more powerful than it would be on 2.4 GHz and identify that you're doing it and where you are.
"You know how antennas work? Even a simple larger stick antenna can give you four times the range, no modification to the circuits. "
That can get a bit obvious. If you are just on the corner fiddling with your phone, you look like everybody else with no clue about their surroundings.
Apparently you have to GO to Bluetooth range (30'/10m?) for EVERY light
Trouble is, every device contains a Bluetooth/WiFi/GSM module these days, so if you have a full compromise you may well be able to worm your attack to all (or your one desired) light, at least in dense urban areas, and to begin it from some internet-connected device you can safely compromise from Mom's siheyuan.
But, still preferable to having unnecessary central control like in movies.
The traffic lights are not being hacked the pedestrian crossing buttons are. Having been to the Polara and looked through support docs for three separate button models and watched support vids on using the software. The buttons do not control the traffic lights a traffic controller does, 7 different manufacture's traffic controller models are covered in the support docs. The buttons make in Polara's words a pedestrian call the traffic controller deals with it.
So no setting all lights to green at a crossroad. But it may be possible to tell pedestrians to cross on a green traffic light, one intersection at a time. Those units seem over engineered just to send a request to for a red light to cross and to then signal pedestrians when the light is red.
Some units support contactless activation for those indecisive pedestrians that can't decided to cross or not by helpfully making that decision for them*. Still its missing that killer feature AI. Something for a future model I'm sure.
* Before someone takes issue that's meant as a joke.
Why on earth would you want crossing indicators to speak? Just for starters not everyone is going to be an English speaker particularly in the US where plain bollocks predominates. Imagine in Canada or just Quebec bilingual prattling crossings.
In these parts the crossings just bleep every few seconds just to let you know they are on the job (not having a smoko or elevenses) and when it's safe to cross they go a bit mental:
https://freesound.org/people/abcopen/sounds/166212/
I don't imagined Harald Bluetooth, or any other demented scandinavian, was required to to infest these devices.
In congested areas the traffic lights are linked backed to a central traffic control to manage congestion in real time in peak periods but fall back to a preprogrammed autonomous mode at other time or with comms failure.
Keep it simple (and safe/secure.)
TBH (like a lot of things) because they could
TBF it might be a mandatory requirement that such crossings say something for visually impaired people (although I agree the bleeping should be enough).
Keep in mind speech generation of canned phrases can be done with as little as a speaker that can be toggled to produce a "click"*
What's astonishing (to me) is the size of memory on these things.
*which AIUI is how Castle Wolfstein on the Apple II did it.
All (as far as in aware) British have a physical device to inform blind or partially sighted it's time to cross. That's why some don't have an audible indicator, as there it to much other noise around and it can lead to confusion.
Oh the device. Stick your hand under controller and you'll feel a little knob (stop it), when it's time to cross, it rotates.
That used to be true on the old crossing controllers.
The new ones fitted here are no longer electro-mechanical so they can't give any haptic signals. All they do is emit a piercing beeping sound.
So if you are deaf and sight impaired you might be in trouble.
"Oh the device. Stick your hand under controller and you'll feel a little knob (stop it), when it's time to cross, it rotates."
That's only if the button is actually connected up to a controller. Many aren't, but it lets people feel like they have some control if there's a button they can push.
As a blind user, the ones that speak the default phrase, which just announces that the walk sign is on, are no better than the ones that beep, click, or any audible signal. However, the purpose of this system and why it was hackable in the first place is to put custom messages for crossings, and when that feature is used which is somewhat rare, it is used to speak the street name. This has two advantages, one of them a convenience they might not intend and one the main reason for it.
The main reason is in the case where a corner has two buttons for either way you could cross from it. You push your button, someone else pushes the other one. When it starts making noise, which one of you can cross? I've been blind for a while, so I've got a lot of experience figuring this out from traffic noise. Incidentally, traffic noise is how I know when to cross when there is no audible signal, and I do that every day. Still, if the thing can make noise, it can clear this up by saying what street is free, and it makes it more convenient to cross if, for example, traffic is not being obliging and helpfully timing the cycle. There are also those who have lost their sight recently and have less experience. They'll learn it, but the more helpful information available, the better their experience will be.
The other benefit is by serving as a proxy for street signs. If I got lost and all the audible signals spoke street names, I could activate one of them to know what street I'm on. In practice, they don't all announce the street names and many streets don't have any audible signals, so that doesn't often work. However, that would be a useful thing if it was widely adopted. I avoid getting lost whenever possible.
I'm guessing that was more information than you wanted, but it can at least explain what the designers were thinking.
In Britain, they just beep, but they have a little knob on the bottom which is motorised and rotates when it is beeping.
It's a lot simpler than having a bluetooth microcontroller in every pushbutton unit.
You have to feel around the underside of the pushbutton box until you find its knob, grab the knob, and wait for it to start twiddling.
"It's a lot simpler than having a bluetooth microcontroller in every pushbutton unit."
A standardized tone can also be universal. If you don't understand the local language, a spoken message (with a strong foreign accent since the job will have been outsourced) can be confusing.
"A standardized tone can also be universal."
And doesn't provide either of the services that the street name announcement does. You have to decide whether the benefit to people who won't understand it outweighs the benefit to people who will. For those who don't understand it, there's still a simple rule: if it is not talking, then you have to wait. If it is talking, you can cross.
"a spoken message (with a strong foreign accent since the job will have been outsourced) can be confusing."
In my experience, the job is not outsourced, probably because you have to go to the controller to install it, and the voice is usually created by automated speech synthesis, meaning a local accent and clear pronunciation, although it can mispronounce street names which are not in the native language.
Where I live we just had these installed city wide. The system does announce "walk light is on Division Street" or what ever street your on.
A best funny situation was during an electrical storm the power loop for traffic control took a hit and every light downtown fell back to flashing red lights in all directions. Drivers just couldn't fathom the need to stop at every intersection and do the "Right of Way" thing!
I was sitting in my favorite pub watching the comedy act at hand out the windows and decided to see what would happen in this situation if there was a pedestrian in the crosswalk, talk about being in the middle of a train wreck.
My observation was older drivers knew the rules that a pedestrian in a cross walk has the right of way at all times. Younger drivers mostly just yelled, screamed, and blew their horn at me which at that point gave me the right to display the single finger salute to them!
The rigid German driver license requirements is something we would love to export! There is a reason why "no speed limit country" has about 1/4th car accident death rate per 100000 people... Though I am in favour of a general speed limit, and politically agreeable would be 160 or 180 km/h (i.e. 100 or 112 mph). Still very fast. If only our car-lobby would not invest on both sides to never compromise we would have had that speed limit 40+ years ago, and we wound be closer to the UK numbers (close to 1/5th of US).
Sorry to burst your bubble...
His Almighty Higness, Emperor of the world, King of All the Americas, Donald, 'I can't tell the truth ever' J Trump has decreed that the ONLY language in his realm is American. Note, not American English but American. Spanish? Forget it? Patois? Illegal. Sioux or Apache? There is a nice Gulag on El Salvador waiting for you.
Don't speak anything but New Yorkese or the ICE Gestapo will be after you. It won't matter if you are a US Born Citizen, you will go to the Gulag, have your head shaved and be branded as an MS13 member.
> Why on earth would you want crossing indicators to speak? Just for starters not everyone is going to be an English speaker
It doesn't need a large arbitrary or abstract vocabulary. I can recognize ten nine eight seven..two one in my adjacent languages (French and Spanish). I may figure the "walk, RUN" noises after a couple cycles.
They'll drop the nearfield comms and switch to needing an internet connection to program/reprogram the crossings.
Advantage: they can use some form of encryption or tunnelling...but the downside is that once the key leaks or is hacked somehow, it won't be one crossing at a time that gets the treatment...it'll be the entire metropolitan area in one go.
And definitely an upvote for Jou's suggestion: "Walk this waaaaay!" in a well know screaming voice. Without doubt, *the* choice for a crossing hack!
So a password like this?
Keep in mind, my example includes backspace, line feed, carriage return, escape, tab, "BEEP" and other characters which are difficult to enter when using a keyboard :D. I use that type of password for deactivated accounts, 50 characters 8bit random, so reactivation alone is not enough.
Talking crossing indicators, very clever. So much fancier than a tone. Why not also distribute the software to program these units via a consumer "app store" rather than via the company's web site where people might have to apply for credentials?
Just because you can, doesn't mean you should.
"Why not also distribute the software to program these units via a consumer "app store" rather than via the company's web site"
Now that the maker has pulled that software from the official Android and iOS app stores, The Register can responsibly reveal just how the trick was pulled off. Or how we're pretty sure it was pulled off.
HTH
So I am told, by a bloke that works with traffic signals, that there's a hardware check for 4-way green on a traffic light.
If it ever happens, this circuit either cuts power on the old lights, or overrides the controller and does a 4-way flashing yellow, which in the US means stop and treat it as a 4-way stop[1]
[1] 9 months ago I was at a local intersection that had 4 lanes both ways, plus turn lanes. The traffic light was completely dead. No lights. I was in a left turn lane on my motorcycle watching gobsmacked as cars proceeded through at 50-60mph both directions without even slowing down until the inevitable moment when two of them tried to occupy the same physical location. This completely blocked the intersection, so I was wheeling my bike up the kerb into the parking lot, when BANG! and two more cars collided at high speed. Just absolutely amazing.
"overrides the controller and does a 4-way flashing yellow, which in the US means stop and treat it as a 4-way stop"
Flashing yellow is an indication to yield. Flashing red is an indication to treat the intersection as a 4-way stop. If there's power, a fault should have the lights go to flashing red so people will stop. If there is no power and traffic signals are not working, that is treated again as a 4-way stop. It's been ages and I can still remember all of this carp from driver's Ed.
"Like the Supremes "Stop in the Name of Love", or "I'm Walking" by Fats Domino. Now THAT would be cool!"
I love it since even if you don't understand the lyrics, you may recognize the tune so it's something like a universal tone, only with great songs.
"it couldn't be connected to the internet even if they wanted to."
And a good thing too. Being able to mess with traffic signals would be a bank robbers dream. They could have every signal in their getaway direction green and snarl traffic in other places so the police would have a hard time getting there.
That would make for a great plot element in a heist movie, where the robbers get away in three mini Coopers in a congested Italian city where the traffic has been brought to a standstill by taking over the traffic light computer with a hacked tape. What's that? It's been done?
"What's that? It's been done?"
Everything's been done. If it hasn't, movie studios won't like it and won't put up the money. Look how long it took to get HHGTTG made. Sci-Fi comedy hadn't been done before until MiB came along and it still took ages and Douglas wasn't there to see it.
These days, the bad guys can break into the city CCTV to get a view of traffic everywhere and switch traffic lights to suit the getaway car in real time. Maybe they can also usurp satnav in the police cars so the map is directing them away from the chase or into grid-locked traffic so they get boxed in. Same theme with a modern twist.
>> The password to launch US nuclear missiles was “00000000” for 20 years.
> Largely because the system was still driven by technology from the 1970s
Numeric locks and codes go back to Ike. Rotating codes by JFK days. Internet not really a thing then. https://en.wikipedia.org/wiki/Nuclear_football#History
https://apnews.com/article/nuclear-football-presidential-satchel-war-df3c1e65cfd21f137fd2fc7e7d62ffab
That wasn't the launch password, that was the arm password.
Launching required two separate keys being turned in two separate locks at the same time. The locks were much further apart than could be managed by one person.
And of course, both required physical access to the controls. Which were airgapped. And reinforcedconcretegapped. And m16 gapped. And doggapped. Etc.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
