>> Thank you. Okay, thank you for coming. I will be talking about hacking traffic control systems from U.S. and a few other countries. So this is quickly about me, just to make a point that I'm not new in the security business/industry. I have been around for a long time. I've been doing different kinds of research and this is my last research. And I want to give thanks because I got a lot of help from some people, from my company, and when you put everything together, it's a lot of help and it allows you to save a lot of time. Are you curious when you go on the roads of the highway and you look at the highway signs and stuff?  You will see a lot of different devices.  Most common are the traffic signals and the traffic cameras.  But if you pay attention, you will find a lot more different devices around.  And I was curious about that and I wanted to research some of them and I didn't know anything about that, so I took a look around.  And when I was looking around, I found some news that the Department of Transport from London was going to implement some traffic wireless detection system and it got my attention because London is a big city and these devices are wireless. So it's an interesting technology and possible attack vector. So I started to look around specifically for this technology.  It took me a while because they were aquiring the devices from [indiscernible] so is I kept digging and I found out that the vendor name, the maker. It was very interesting because when I kept searching, I found out that it was really widely deployed, mostly in the U.S., but also in a few more countries, so this is information from the customers.  They have more than 250 customers worldwide.  The customers were like city Department of Transport, State Department of Transport. And in the last piece of news from the vendor, I saw that they state they have 200 thousand wireless sensors deployed worldwide.  Most of them are in the U.S.
So you can see, this is an image from the vendor, the deployment around the U.S.
You can see most of the important cities are there, including Las Vegas. For instance, one popular deployment is Washington, D.C. They say 1,300 are installed there in Washington, D.C. When you research, you find documentation and I found a manual, a 100 page user manual and it has just one paragraph about security. So it was a really good indicators that probably these devices weren't really secure. So there was a challenge to cultivate the device because the device is not something you can easily buy around because customers are usually Governments. So what we did was social engineer the vendor saying we needed to do some testing and we needed a couple of devices.  Which is weird because when they get involved, they get them by the hundreds. So after some talks, they agreed, so we got a couple of devices and at that time I was in Puerto Rico so I then I shipped them and then came to the U.S. with the devices and then returned to the Argentina and then the U.S. and then Argentina and then back to the U.S. The point is you can easily travel around with these devices without any problems.  So what are the devices?  I have one here, you can see this small device.  So this goes in the road, so basically they are magnetometers, so they detect. They are normally in the natural magnetic field of the Earth and that way it can detect when a car goes over it. So for the technology, you have to make a hole in the road with the sensor and then it's filled with epoxy. So the battery life is ten years. This is what the vendor says. And it TI transceiver, which is CC‑2430 which is pretty common for the specifications. It runs on 2.4gHz and it has a microcontroller by is the MSP430, which is also pretty common.  I lost my notes but I think they run TinyOS. So this is, like, a view of how internally the sensor, you have the ‑‑ in the top, the antenna. So below is the electronic board and then the battery and then the plastic that's protecting it. So we open it and there you can see the antenna at the top. Here, we'll push it out between the board, and here is the battery.  Here is the transceiver and the microcontroller and then the device that is used for detecting the magnetic inference. And then we have the access point, which is this wide box, as you can see here.  You can usually find this on a pole next to the traffic light or sometimes another pole around. So basically what the access point does is get the wireless data from the sensor from the traffic detection and relays it to the traffic control systems.  It has a Coldfire processer and also runs software and interfaces with the traffic controller with a pressure car in order to communicate with the traffic systems.  Then we have repeaters.  I don't have one of that, but it's similar to the access points and the wide box. And basically what it does is to extend the range when the sensors are too far away from the access point. So they transmit on two different channels.  One channel they get the information from the sensor and in the other channel they relay the data to the access point. So this is the range for the communication between the sensors and the access point, which is a maximum 150 feet. And then if you want to extend the range, you add the repeaters and the maximum range by vendor recommendation is 1,000 feet. Of course, I mean, if you have equipment antenna, you can probably go further away. How these devices work, well, like I said, the sensor goes in the road, there are configurations. One of those ‑‑ this one, it is at an intersection. So here you have a set of sensors that are used for stop detection.  That means that once a car is detected as stopping, they are waiting for the signal, the sensor will detect it. And then you have advanced detection to detect when the car is coming and is waiting far away from the stop bar. So the sensor sends the data to the access point. So basically the traffic system uses this information to know how to best set the timing, for instance, for the green light. If they see there's a lot of traffic, they will set the timing longer, maybe 20 or 30 seconds, depends on the configuration.  Also some intersections, probably most of you, some of you have seen these late night, sometimes you are waiting at that intersection and the traffic light won't change or will take a lot to change. Sometimes that's because the detection mechanism is not working very well.  So that's the stop bar detection.  So when a car is waiting, the traffic control system will set some parameters so that the traffic light will change faster and you get the green light and you can go. This is called the access point connect to the traffic controler by the [indiscernible] and can also connect to some internal network.  Another configuration is metering.  So this one, you have the detection that will detect when the car is waiting, and also queue detection to measure the length of the queue. Then at the freeway, you have several wireless sensors to ensure that the traffic is in the freeway just before the access ramp to the freeway. So this way the traffic control system knows how to set the proper timing to the ramp meter.  If they see there's no traffic at this freeway, they will turn off maybe the ramp meter or they may allow the cars to go faster on the freeway.  If there's a lot of traffic, they will allow the cars to go slower on the freeway.  Another kind of use is for travel times. So basically you get an array of sensors at some point on the freeway and then maybe or two miles away another array of sensors. What they can do with this technology is to identify a car. So basically they detect the car, they do some possible assessing, and they will create a fingerprint of the car.  So after a mile or two, they will re-identify the car so they can know what the travel time for that lane. So that information is the information that you later see on the electronic signals on the freeway. And also it can assess the speed limit. If they see there's a very low speed in some lane, they could slow down just a little. So in order to configure the device is to access the Windows software that basically we have over here. So it is very easy to compile. You get the source code. You get the hard coded root for the access point. So you connect to the access point with this software and then you can access the sensors, too. And you can configure them, install update work, et cetera. And then you have some server software that you can use to concentrate all of the configurations interest the access points from the different intersections.  And also the vendor provides a SaaS that allows you to connect to any access point worldwide and look at some information and set some specific configuration. I didn't touch this because it is server-side and of course would be illegal.  So the access point goes to a location and it is connected with a traffic system. So basically they don't have any encryption. So all of the wireless communication is cleartext. This was interesting because it took me a while to make this thing work because, I don't know, it took me a while, but when I saw there was no encryption, I told them and they said, yes, it is doing encryption.  And the only paragraph I mentioned earlier that I found in the user guide was the next one. So you can read it there. So basically they said the information doesn't carry any comments, it's only data, there's, like, nothing here so there's nothing to attack.  That's what I understood because it's really difficult to understand what they tried to say there, but that's the only paragraph about security in the whole user manual. So when I continued insisting that I wasn't seeing any encryption any place, that I wasn't looking at the communication and there was no encryption, they came back after many e‑mails with this answer.  You can read it. 
	>> [Laughter] 
	>> Right. It's funny because the customers are Government. 
	>> [Laughter]. 
	>> And I don't know if it's intentional or just a lie from the vendor because the vendor was lying all the time, but this is a really crazy answer.  It works at the sign, so there is no issue there. 
	>> [Laughter]. 
	>> So the other issue is no authentication. So nothing prevents an attacker to access a sensor or to access a repeater. I mean, access point I protect because you have to ascertain the internal network, but sensors and repeaters can be accessed wirelessly.  Also, the connection point doesn't indicate the sensor or the repeater, so the access point gave any data that matched the protocol and that matched the address of the sensor, then they would just accept it as data and trust it. So another issue is that the P1 update are not encrypted at all. So basically you can go and change the wire on the sensor or the repeaters. So when I told all of this to the vendor ‑‑ well, this is from ‑‑ the communication from the vendor, when I was looking at different communications for the presentation, I thought, this is what they said to me when I reported the issue. What they said to me when I reported the issue was they were encrypting it in the next version.  But what's the problem?  If these sensors are built in the road worldwide, because of the architecture being nonexistent, hopefully they update it with encryption without actually changing the sensor. So basically they will have to do a physical replacement to have a secure update. So is let's see about the protocol they used. So basically the standard is 250 port physical level. It's the same as CV and other wireless possibilities. It's very low rate. And this is because it's very low power consumption. And it has 16 channels from 2.4 GFS. And they have their own protocol which is the sensor are wireless protocol, which is a kind of a media access protocol. It's kind of a ‑‑ it's very similar and it's used TDMA.  So they divide the timeframe in 64 slots, so the access point to one sensor, okay, you have to transmit with every sensor.  They do that and also to optimize the power consumption, so the sensor doesn't need to be awake all the time. So sensors will only listen and transmit during a specific time slot, but the access point will get data at any point. It will get it and process it. So if there is no detection, there's no car around, then it will stop it. The access points just acknowledge when they get detection data from the sensor. If there is not knowledge, then the sensor will retransmit a few times and then will get to sleep. So basically [indiscernible] so these are for the kind of packet, and then the other is for the sequence number. The sequence of packets in its transmission.  And the following two bytes are for the address of the sensor because the sensors are identified by these two bytes. So the access point knows from where the data is coming. And then it's the data part. So this is for the type of packet, as you can see. And then there's a space from the access point side, they used what they call hollow code which is used so the sensors can know if they are getting information from the right access point. Because the access point doesn't have a specific address, the sensors will know they are getting the right information by the color‑code. By the channel and the color‑code. So the data is 4 to 50 bytes. So the data that the sensor sends, sometimes the battery level, the thin wire version, the detection of the car, if there is traffic or not, and then from the access point to the sensors and repeaters, you get some configuration data and also configuration information, and also updates. This is 100 packet from the sensor to the access point. That means there is no detection in any event, so basically they transmit every 50 seconds.  And this is a slightly different packet which means there's a detection of a car. This is also interest the sensor to the access point when they send the information, like configuration information.  Sometimes you can query the sensors with the access point to know how they are configured.  So is here they send the channel, the physical address this they get from the factory that you can change, so they receive all this information.  And finally, from the access point to the sensor, this is used to synchronize when they say use this timing. So for the [indiscernible], they provide the [indiscernible] which is a format that looks this way. So these two bytes are the address of it. They have it twice.  Because when it's running the device, it will copy it to the address which is specified here.  If it's running [indiscernible], it will copy the update to the other address and then they will reroute and change.  So basically the security mechanism is just one check at the end of each line, which is a very simple check and then you have a check for all of the thin wire which is also an excerpt. So basically you engineer it and then you can update it. The packets for the three‑wire update is very simple, it's just applying the thin wire to the access point, hit the sensors in PY update mode and then you have to broadcast it by the access point. So basically they broadcast every line of the file.  You can see here the file ‑‑ okay, that's one line as you can see there, and that is what is broadcasting. So in order to do this research, I needed some hardware because you need the wireless communication and then you have to be able to modify packets, so basically I got USB dongle for sniffing to 802.15.4 protocol, which is this device, it's very small. You can see it here. It's pretty good.  You just plug it and it will start working with the dongle provided.  And then I go to the programming board, all from Texas Instruments, so you get the programming board, you get the radio transceiver and a sniffer. Just plug in the programming board by USB to the computer and then you have the framework to program it, which is the IAR and then you have the studio and the software. You can see the software, it is for sniffing. So you can see you can start getting the packet. You get the packet from the access point to the sensor. And here you can see the data. And if you know the protocol, you know it's Clear Text because all of the information is there, you have the options. So just look at the type of protocol you want to capture and then set up the radio channel here. And then with the [indiscernible], you have the RF studio, which is pretty cool, you just choose the right receiver and you can manually craft packets.  You can also get packets, too. It's just like a complete packet and you can just send one or 100. And finally, the software for programming the device is just coded in C and you can upload the device. It's very simple. So the vendor says there's over 200 thousand worldwide.  Most of them in the U.S., I would say, based on my research, maybe 80% are in the U.S. And then you have repeaters also.  I have seen the price of the sensors, $500, $600, the access point is $4000, and the repeaters are $1,000 or more. So we're talking about 100 million or more worth of equipment, that probably can be bricked. So you can see there's a huge money impact here.  And, of course, you can cause traffic because you can influence the traffic controller system. Because you can lie to the system.  You can send fake data and say there's a lot of data here and maybe there isn't any traffic there. Or you can say there's no traffic and in fact there is a lot of traffic.  So you can create a whole mess.  I remember a years ago there was a conflict with Los Angeles Department of Transportation over the transport traffic machinery and a couple of them had 2 or 4 intersections, but they were the main intersections of the Los Angeles and they created a chaos for 2 days  just hacking 2 or 4 intersections.  Because, you know, when there's a problem at the intersection, it promulgates over the other intersections and if they are the main of the city, then you have a big mess.  Of course, it is based on the traffic configuration. So you can have a simple accident or a really large accident because, you know, when people say they are waiting at the red light and the red light doesn't change and you have there one minute.  Okay, one minute is fine.  Two minutes, two minutes is still fine.  More than two minutes, the cars will start to go anyway.  And in that way, you get accidents. So what the U.S. Department of Transportation said, they said that sensors and signal failures increase motorist time and delays, making accidents. This is what the U.S. DOT says.  Not me.  I have an issue with the vendor because with the communication, what they get back from the vendor was lie.  They were saying, there is encryption.  I said there is none and they came back and said, yes, there is. So they were lying and saying stupid things.  I had a conflict because I did the testing at home with these devices, which is a nonproduction system, so I don't like to make a statement saying, okay, this devices are insecure and maybe when you go to a [indiscernible] side you see that the configurations can be different or they may have different options and what you found is completely inaccurate. So what I did was, with the devices in my backpack and I made them portable because the access point is power over ethernet and I made it USB, so I connected to the portable batteries and then I connected it to the portable Wi‑Fi router, so I point the access point in my backpack and I could access it wirelessly.  So I went to Seattle, New York, and when I tested it, it was a testing site, it wasn't a production site, so it wasn't very sure. The same in New York. But when I went to DC, which is a big deployment there, it was a production site, so I did some testing there that I will show you now. So this is New York. It was good because I was next to the New York police. 
	>> [Laughter].
	>> Traffic. So here you can see the marks from the sensors in the street. Those circles are the mark and then in the pole, here is the access point. And this is just, like, three blocks away from the Empire State. So there I basically was pointing with my backpack the sensor because of the directional antenna, so I was pointing with my backpack the sensor. 
	>> [Laughter]. 
	>> And I was able to access the sensor.  I was able to see the configuration of that. And if I wanted, I can could have compromised them, changed it. Which I didn't do it. 
	>> [Laughter]. 
	>> So there is ‑‑ we see this later, this is the software from the vendor. I put the access point in discovery mode, which queried for some specific channel. So the sensor started to appear on the graphical interface.  This is a line, you can see green, that's my sensor which I carried in my backpack. But then, there you can see three more sensors that were there in the road. I can't find ‑‑ okay, I wanted to show there was like 5. So I went to DC and just when we get out there to Union Station, I found a nice surprise because I didn't know there were those in there.  So I was looking around outside Union Station and I think it was around the exit ramp and we found some sensors there.  There you can see the mark of the sensor.  Because maybe if you have been there, it is a really complex intersection.  There are, I don't know, how many streets there. And there you can see the access point. So with that configuration, it's for detecting that a car is waiting there at the ramp trying to exit, so it would put faster the green light or if there's no car, it won't get the green light. So you can see that by pointing the sensor. And there I was able to look at the configuration. Basically the wireless data, I could display it in a graphical interface and because I know how to do this, I can see all of the configuration options.  So the traffic I was seeing from the access point to the sensor and from the sensor to the access point. But there is another part we went to do some testing, there were a lot of sensors there and a repeater, too.  You can see here every line is a sensor expect for one which is a repeater.  These are all sensors and this one is the repeater.  So just with one I can access there, changes the configuration, do anything, change the channel. And this was, as you can see, two blocks from the Capitol. I mean, there were some weird people that gave us the spooks, but we didn't get any problem. It was weird. The access point and here on the street, the mark of the sensors, and there was a repeater here. So in this way I could prove that I was right with what I was saying, what I informed. So what are the possible attacks?  So basically you can do [indiscernible] which is [indiscernible] so you can change the sensor, change the frequency channel, change the thin wire, probably brick  them, take packets, but, of course, I will be getting the traffic data. Because if you know how it works and how the guys communicate, you can just send fake data. And in order to do that, I built a special device which I will show you later.  It's basically data saying there is traffic here. So in the real world, it's kind of easy because there's a lot of vendor recommendation, press releases, where they say we are implementing this in New York and DC. Based on a lot of public documents, also, from the Government. And the good part is you can specifically know the coordinates of the devices using Google Street view. 
	>> [Laughter]. 
	>> Here are a couple of repeaters and here are the sensors.  This is New York.  So you know specifically the GPA is where they are located.  So for vendor specification, you need to be at least 1000 feet away in order to attack them, to be able to connect. So one option to connect is being on‑site. So being near the devices so you can send fake data. So what I did was with these, we programmed a sample proof-of-concept I can show you here. So basically, here is the screen, I put the menu there. These are different attacks. One is from creating fake sensors. The other one is to send fake data. I did some ASCII art and you can see. 
	>> [Laughter]. 
	>> And then I also can send fake data about configuration. I will show you now. So I have here the vendor software, so I will connect to the access point now.  So basically here in every line you get the devices which are the sensors there. And you can see there isn't any device there. So just one, which is my sensor.  So now I will create a fake sensor. It will be replacing an existing one, maybe [indiscernible] and sending fake data. I will push this button here and you will see the sensors being created. So you can see I'm sending fake data to the access point and it is accepting it as valid data. There are a couple of columns here.  Which is that there is a car present at the sensor. And the other is the number of cars being detected.  So now what I will do is send fake data about car detection, about traffic. So I push "now" and you will see here the detection number to be increased a lot. 
	>> [Laughter]. [Applause]. 
	>> So basically the access point is taking this data which is fake, it's made up, and processing it. So this is the data that I would get the traffic control system to make decisions. So if you don't want to be on‑site, what you can do is just program ‑‑ you can see where a transceiver to with a GPS is when you set up the coordinates of the device is, to a car or whatever and just let it go. Because on this you have the map where the buses load, so you can know where to launch the attack automatically by the attached device. Another one I tested and works is from the guy. This is a new service where you can rent drones if you don't have one. So in this case, I attached this to my drone and make it fly at like 350 feet and it worked. And when you have light outside and you have a good antenna, you can go 1,000 feet or more in the sky and launch the attack. Another attack could be to do a thin wire update. So basically you change the firmware and make a worm. And it will detect the sensors that are near, or maybe not near because the sensors will propagate worm, too. When you have the fewer compromises, there's no way to know if you have compromised or not unless you look at the code and see. But if you just use the functionality, you never know if it's compromised or not. Basically you can know in realtime, you can see some media, GPS coordinates on pictures, so you can search people in New York, like right now, and you can compromise the SmartPhone and from the SmartPhone launch an attack.  Right now I think it's kind of [indiscernible] but maybe a radio that can be modified by using this protocol and you can have someone else with his cell phone attacking this device. Another kind of creative attack, this is based on immunity. You can use these as a trigger to a bomb.  So you finger print one car and then use that later and set that as a trigger to a bomb.  So because you see Washington, D.C., maybe you can finger print cadillac one. My final conclusion is that any field guy like me, I live in a small town, many miles from here, can get these devices that are used in other countries and hack them and then you want to hack the U.S. or other countries, the attack tools would cost you $100 or less to build if you buy the part and program it. It's cheap. The Government is buying devices that are being used without testing the security of them.  They are just assaulting the crazy claims from the vendors and they are putting it critical infrastructure on and that is happening right now. And finally, when we talk about being smart, if you get devices like this that blindly trust the data, then the city is not very smart is. Kind of stupid. 
	>> [Laughter]. 
	>> And finally, it is cheap. I'm part of Build It Securley where trying to help the smart vendors to improve the security of the devices.  And if you don't know about this, you can check the site and there are step‑by‑step instructions to build secure protocols, et cetera.  And that's it. I hope you like it. 
	>> [Applause].