Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Security Transportation

One Single Malicious Vehicle Can Block 'Smart' Street Intersections In the US (bleepingcomputer.com) 98

An anonymous reader shares a BleepingComputer report: Academics from the University of Michigan have shown that one single malicious car could trick US-based smart traffic control systems into believing an intersection is full and force the traffic control algorithm to alter its normal behavior, and indirectly cause traffic slowdowns and even block street intersections. The team's research focused on Connected Vehicle (CV) technology, which is currently being included in all cars manufactured across the globe. More precisely, it targets V2I (vehicle-to-infrastructure) protocols, and more precisely the I-SIG system implemented in the US.

The Michigan research team says the I-SIG system in its current default configuration is vulnerable to basic data spoofing attacks. Researchers say this is "due to a vulnerability at the signal control algorithm level," which they call "the last vehicle advantage." This means that the latest arriving vehicle can determine the traffic system's algorithm output. The research team says I-SIG doesn't come with protection from spoofing attacks, allowing one vehicle to send repeated messages to a traffic intersection, posing as the latest vehicle that arrived at the intersection. According to simulated traffic models, the Michigan team says that around a fifth of all cars that entered a test intersection took seven minutes to traverse the traffic junction that would have normally taken only half a minute. Researchers don't believe this bug could be exploited for actual gains in the real world, but the bugs' existence shows the protocol is poorly coded, even four years after first being proved unsecured.

This discussion has been archived. No new comments can be posted.

One Single Malicious Vehicle Can Block 'Smart' Street Intersections In the US

Comments Filter:
  • This kind of thing is always a potential problem. If you allow uncontrolled inputs, you always need to check if somebody is acting maliciously. Technical improvements could obviously help, but it's at least as important to have legal mechanisms to back them up. Spoofing the system needs to be illegal with real penalties for violations and reasonable mechanisms for spotting the spoofers. This is the new equivalent of making it illegal to use emergency lights if you aren't an emergency vehicle.

    • by cayenne8 ( 626475 ) on Tuesday March 06, 2018 @03:19PM (#56218247) Homepage Journal
      This concerns me more:

      Connected Vehicle (CV) technology, which is currently being included in all cars manufactured across the globe.

      Ok...this is a new one on me.

      When did they start this? What do I look for in my car for this?

      More importantly, how can I disable this? I don't want my vehicle connect to any company, entity, or any other vehicle.

      • by Anonymous Coward

        They already did that with airbags. Technically you are legally required to have your airbags in working order during the transfer of title of a car. Practically speaking nobody does. But if there was an accident and the airbags didn't deploy, in theory the new owner of the vehicle could come back and sue you, and the government could come after you on criminal charges (I don't have the specific vehicle code entry for you. This was secondhand information from a professor who also worked for a local vehicle

        • by HiThere ( 15173 )

          On what basis do you claim "Practically speaking nobody does." I don't think I've ever even heard of someone intentionally disabling the airbag, except one person whose mother weighted less than 80 pounds, and wouldn't legally be able to ride in the front seat if the airbag wasn't disabled. (Not sure how the law currently reads.)

        • by Khyber ( 864651 )

          "Technically you are legally required to have your airbags in working order during the transfer of title of a car"

          Not if you do it as-is by selling it under a salvage title.

          And the strictest road state - CA, only requires emissions testing and brake/lights inspection. That's it.

      • by fustakrakich ( 1673220 ) on Tuesday March 06, 2018 @04:37PM (#56218709) Journal

        More importantly, how can I disable this? I don't want my vehicle connect to any company, entity, or any other vehicle.

        Sorry, just like with the video games, there is no offline single player mode any more.

      • You can't disable it. That's the point.

      • > When did they start this? What do I look for in my car for this?

        The article was wrong, clicked their source where they claim it is in every car is this info:

        2016 -- Issue Notice of Proposed Rulemaking
        2018 -- Issue regulation mandating V2V technology
        2019 -- Begin phase-in period for new car production
        2021 -- V2V technology included on 100% of new car production

        Only currently in select 2017 Cadillac models.

      • by AmiMoJo ( 196126 )

        Connected vehicle has been around for ages. In fact it will probably become mandatory soon, in order to automatically report accidents. If the airbags deploy the vehicle sends an SoS over the mobile network, with the location of the crash.

        The easiest way to disable it is probably to disconnect the antenna. Then it will just think it is in a bad signal area and not start throwing up error messages.

      • NA Miata is always the answer. Join the cult, we have turbos.

    • a cell jammier can do the same thing

  • by Ecuador ( 740021 ) on Tuesday March 06, 2018 @03:15PM (#56218219) Homepage

    Eh, a single malicious vehicle can block "dumb" intersections too if it just stops right there in the middle!

    • by nomadic ( 141991 )

      Right, don't quite get the "eureka" aspect of this.

    • by Anonymous Coward

      I think the big difference is for a malicious vehicle to do it in the traditional sense, you'll have a pretty damned good idea who's doing it. With this, they may just be parked in a parking lot near the intersection, and their "vehicle" may be a backpack.

    • Many crossings are big enough to drive around an obstacle as big as a car.

    • by mjwx ( 966435 )

      Eh, a single malicious vehicle can block "dumb" intersections too if it just stops right there in the middle!

      Actually that's the worst place to put it to block an intersection... you'll just change it from a junction into a roundabout. If you want to block an intersection, park it in the path of traffic.

      However a quick glance of the summary says that the vehicle does not need to be in the intersection... or even a vehicle at all. Just a radio sending a control signal... and not even a malformed one, just spamming a legit signal.

  • Crashes do this all the time now. If there's a wreck on the freeway I use to get to work, it clogs the entire freeway so that traffic slows to a snail's pace. The alternative routes also fill up fast. Doesn't take rocket science; just old-fashioned stupidity and inattention.

    It doesn't help that crash inspectors have to "do science" on the wreck to understand it better. Why waste tens of thousands of commuter hours to clear up the insurance of 2 people? Selfish allocation of resources. Take lots of pictures

    • by Anonymous Coward

      They don't do major investigations unless someone is injured or killed or evidence of a major crime exists, so.. unwarranted rant maybe.

      • by Tablizer ( 95088 )

        Often somebody is injured, but why so slow to move them? I realize sometimes you have to be careful about broken backs, but it seems the delays are too common for that: not everybody busts their back. Granted, I don't know all the details, but it seems like unjustified delay due to silly laws or rules.

        • There are signs up and down the highway in SC telling you to move the vehicles off the road if there are no injuries. Some people do, others do not. But in both cases, the cars passing the accident (or person changing a flat tire, etc.) slow way down to gawk, which causes additional delays and addition crashes, which causes even more slow downs and more crashes, which causes... well, you get the picture. Once you're past the wreck, the speed limit instantly goes from 5 mph to 80. Stop rubbernecking ya l

    • While I hate getting stuck in traffics as much as the next person. I am comforted in the fact that there is an inspector to "Do Science" on the wreck so the justice system has data to work with. Freedom and Justice doesn't and shouldn't be equated with an economic outcome. Because if such thing shows that it was because a fault in the road, that needs to be fixed asap, or the person made a living collecting off of insurance claims by getting into an accident on purpose. Should be punished and jailed, to k

    • by Ichijo ( 607641 )

      Why waste tens of thousands of commuter hours to clear up the insurance of 2 people?

      It isn't their fault the freeway stays priced below market equilibrium when crashes occur. If the free market were allowed to work, people would carpool home and back to work again the next day, or take the train or bus, etc. and the crash would not have wasted any commuter hours.

  • by b0s0z0ku ( 752509 ) on Tuesday March 06, 2018 @03:21PM (#56218267)

    A transponder hooked up to a Raspberry Pi and a battery could be made to have the same effect... fun times...

    BTW - the Trump administration delayed the CV/V2V mandate in the US, and it's not mandated in the EU yet. One of the few Trump administration decisions that I wholeheartedly and completely support.

  • by Daetrin ( 576516 ) on Tuesday March 06, 2018 @03:31PM (#56218321)
    https://www.xkcd.com/1958/ [xkcd.com]

    Just slightly more complex, a malicious actor with a single vehicle can block a "dumb" intersection by driving doughnuts in the middle of the intersection.
    • Reminds me of the time someone on the college I went to re-arranged all the traffic cones into a smiley face so they could photograph it from the third floor dorm room. The smiley face blocked the whole street but people still tried to navigate through the features of the face to arrive at the other side.
  • "Researchers don't believe this bug could be exploited for actual gains in the real world,"
    • "Researchers don't believe this bug could be exploited for actual gains in the real world,"

      The researchers don't seem to have a very active imagination...
      - Large numbers of people with spoofers, say rush hour traffic or a caravan moving in one direction across the city, to have high probability of all vehicles moving in the same direction to always have a green light.
      - The local bum^H^H^H grifter^H^H^H panhandl^H^H^H... errr... apparently disadvantaged contractor seeking private funding for self improvement, sitting on the side of the road causing large backups of people waiting a

      • more... (Score:4, Interesting)

        by Comboman ( 895500 ) on Tuesday March 06, 2018 @05:10PM (#56218913)
        - Set up spoofers around your competitor's business. Everything else being equal, customers will avoid a business located in a problem traffic area.

        - Set up spoofers on the streets behind and paralleling your bank heist escape route to maximum police response time.

        - Install a spoofer in your competitor's taxi/uber/delivery van.

        - Install spoofers on the route from the pizza place to your house. 30 minutes or it's free?

    • "Researchers don't believe this bug could be exploited for actual gains in the real world,"

      They forget that people are perfectly willing to do things for the "LOLZ", without direct personal gain.

      • by rastos1 ( 601318 )
        Do you remember Italian Job [imdb.com]? The thieves hacked the city traffic control to re-route a security transport vehicles to the place of their choice. They could also clear the escape path, block the cops, etc ... Or what about Die Hard with a Vengeance [imdb.com] - creating traffic chaos at one side of the city while robbing a bank on another side?
  • In a real city, when this happens, we just ignore the all way stop signal and just walk or bike through the intersection, or use our skateboards.

    Only old people and suburbanites use cars. They deserve to stew.

    • by PPH ( 736903 )

      we just ignore the all way stop signal

      You and all the homeless bums.

      • I'll have you know our houses are worth millions. Whereas the car drivers ... aren't.

        • And you can't go out in the yard.

          I don't live in a city or a suburb.

          This weekend I forgot my laptop out on a table on the back porch.

          I remembered it about a half day later. Obviously it was still there, because nobody steals stuff out here.

          Stay in your crime-ridden shithole, because we don't want you out here.

  • Get one of the programmers on here who brag how much they're being paid to produce code which is flawless and fully documented to rewrite the protocol.

    Once you get one of those experts involved, anything is possible.

  • Next they'll say a stupid truck-driver with slick wheels can jackknife a whole highway shut for almost a day in winter.

  • With a government system that tracks vehicle location and behavior? It will get perverted. Maybe Google or Facebook will buy or sell the information so they can target russian fake news at you while you're moving. George Orwell is probably spinning like high speed roller in his grave.
  • Just quit with all the automated light crap already. The best traffic flow I've ever seen is in parts of Chicago. Where they still have electromechanical timers* and just sync them for a given speed between lights. Yeah, this won't keep some Aspie from freaking out at 1:00AM if he pulls up to a red light and still has to wait for an empty intersection. But who cares?

    *The only benefit I can see for networked signals is the ability to reset them quickly following a power outage.

    • by krray ( 605395 )

      Just forget about lights all together. Damn *American's. It's called a roundabout. There's a couple in the Chicago area suburbs. Only a couple. 30-50% more traffic through the "intersection" with no stopping. What a concept.

      They were talking about a continuous flow intersection on a busy corner where I used to live. The idea died and the intersection has gone from bad to worse. I moved.

      * I am an American myself. Born and raised. :)

  • by nehumanuscrede ( 624750 ) on Tuesday March 06, 2018 @05:01PM (#56218871)

    One idiot can rubberneck, drive slow or attempt to drive whilst playong with their phone and it will bring traffic to a crawl for miles.

    God forbid any flashing lights are visible because everyone and their brother has to stop and gawk at them.

    Malicious can be both intentional or otherwise. The results are the same for 'smart' or standard traffic.

  • can already block an intersection. This is nothing new.

  • A single benign police officer, placed in a Boston intersection, can mess up traffic in the entire city.
  • get rich quick: rob a security van, block the streets with a malicious smart car, escape through the sewer system.
  • "More precisely, it targets V2I (vehicle-to-infrastructure) protocols, and more precisely the I-SIG system implemented in the US."

    Sideshow Bob: Your children are no more than a pair of ill-bred troublemakers.
    Homer: Lisa too?
    SSB: Especially Lisa... But ESPECIALLY Bart.

  • How can they fix that? The thing require authenticating vehicles, which probably means loading a digital certificate in it. But soon or later, keys will leak.

    Perhaps the whole thing was a bad idea, after all.

  • So the system works as intended? When a vehicle stops and blocks traffic (whether intentional or due to a crash or breaking down), traffic is routed away from it. What's the problem here?

  • And no one was surprised. Or, at least, they shouldn't have been.

The rich get rich, and the poor get poorer. The haves get more, the have-nots die.

Working...