Give me the Green Light: An Intro to Hacking Traffic Systems

Give me the Green Light: An Intro to Hacking Traffic Systems

Speakers: Andrew Lemon, CEO, Red Threat

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=QzUAltEfIMo

Overview

In "Give me the Green Light: An Intro to Hacking Traffic Systems," Andrew Lemon, CEO of Red Threat, delivers a high-octane exploration into the vulnerabilities of intelligent transportation systems (ITS). This talk serves as a condensed, yet comprehensive, introduction to the complex world of traffic light controllers, their underlying protocols, and the surprisingly accessible attack vectors that exist within these critical infrastructure components. Lemon, drawing from 13 years of professional pentesting experience, demystifies how these systems operate, how they can be acquired for legitimate research, and the significant security flaws that, if exploited, could lead to widespread disruption and safety hazards.

The presentation is particularly relevant in an era where smart cities and interconnected infrastructure are becoming increasingly prevalent. Lemon not only dissects the technical aspects of traffic control systems, from archaic hardware to modern web interfaces, but also critically addresses the ethical considerations inherent in researching such sensitive infrastructure. His candid accounts of attempts at responsible disclosure and the industry's often hostile response underscore the challenges faced by security researchers in this domain, making the talk a vital contribution to understanding the current state of ITS security.

This article delves into Lemon's methodology, his key discoveries, and the practical implications for both attackers and defenders. It highlights the surprising ease with which these systems can be compromised, often due to a reliance on outdated protocols, default credentials, and a lack of proper network segmentation. Ultimately, Lemon's work serves as a stark warning about the potential for chaos if these vulnerabilities remain unaddressed, while also providing actionable insights for improving the resilience of our urban landscapes.

Background

▶ Watch: Introduction to Andrew Lemon and talk overview (0:00)

The journey into hacking traffic systems began for Andrew Lemon with an unexpected engagement from the intelligent transportation community. Tasked with presenting on "hacking traffic systems through the eyes of a hacker" with only two weeks' notice and no prior experience in the domain, Lemon embarked on a rapid and intensive research sprint. His motivation stemmed from a broader interest in smart city infrastructure, envisioning how traffic control systems fit into a larger ecosystem of public Wi-Fi, automated streetcars, and surveillance cameras, all of which present potential attack surfaces.

The problem of securing traffic systems is multi-layered, rooted in a history of proprietary development, extended lifecycles for hardware, and a slow adoption of modern security practices. Many systems in use today, even in major metropolitan areas like Washington D.C., rely on hardware that is decades old and long past its end-of-life, such as the 2070 traffic controller. This legacy infrastructure often predates contemporary cybersecurity concerns, leaving it exposed to vulnerabilities that would be trivial to exploit in other IT contexts.

A significant hurdle encountered by Lemon and other security researchers in this field is the industry's often adverse reaction to responsible disclosure. Lemon recounts an incident where, after discovering a critical vulnerability in a traffic controller, he received radio silence for two weeks, followed by a cease-and-desist letter from the vendor's legal team. The vendor claimed the device was end-of-life and wouldn't be patched, simultaneously threatening legal action under the Computer Fraud and Abuse Act (CFAA) if the vulnerability was disclosed, citing "national security" concerns. This adversarial stance discourages ethical research and leaves critical infrastructure exposed, as researchers are either silenced or forced to operate in a legal gray area to improve security. The lack of ethical avenues for studying and exploiting these systems legally, outside of owning them, further exacerbates the problem, making it difficult for security professionals to gain the necessary expertise to defend against real-world threats.

Key Findings

▶ Watch: Vendor's legal threat regarding vulnerability disclosure (2:40)

Lemon's research uncovered several critical vulnerabilities and systemic weaknesses prevalent in traffic control systems, highlighting a significant security deficit across the industry.

1. NTCIP Protocol Weaknesses: The primary Achilles' heel identified is the reliance on NTCIP (National Transportation Communications for ITS Protocol), a standard adopted in 1996 that heavily leverages SNMP (Simple Network Management Protocol). While SNMP itself isn't inherently insecure, its implementation in NTCIP often exposes deeply problematic configurations. Lemon points out that many Management Information Bases (MIBs), which are essentially text files defining SNMP objects, contain globally read-writable values with no authentication or authorization required. This means that anyone with network access can read and write critical system parameters.
2. Default and Unchangeable Credentials: A pervasive issue is the widespread use of default credentials. Lemon discovered an undocumented OID (Object Identifier) for "intellect an admin" (Intellect Admin) where "admin" is the default password. Crucially, the value for "admin" is globally writable via SNMP, allowing an attacker to change the administrator password without prior authentication. This vulnerability is compounded by the fact that many municipalities fail to change these defaults.
3. Web Interface Bypass: Many modern traffic controllers feature a web interface that, while seemingly offering a more secure interaction, often merely translates user actions into underlying SNMP commands. Lemon demonstrated a critical bypass where, by knowing the full URL to specific configuration pages (e.g., security settings or password reset), an attacker could directly access these pages without authentication. This allows for the disabling of security features or setting new passwords, effectively granting full control.
4. Outdated and Unpatched Firmware/Hardware: A significant number of deployed traffic controllers, including those in critical infrastructure environments like Washington D.C., are running end-of-life hardware (e.g., the 2070) or severely outdated operating systems. Lemon specifically cited a newer controller model that essentially packages an Android 6 tablet with an Ethernet card, making it vulnerable to "every vulnerability since 2008." This lack of patching and reliance on ancient systems creates a vast attack surface.
5. Network Exposure: Many traffic control systems are directly exposed to the internet due to misconfigured firewalls or a lack of network segmentation. Lemon demonstrated that these devices are easily discoverable on public search engines like Shodan and Censys using specific search strings, allowing remote attackers to identify and target them.
6. Physical Security Deficiencies: Beyond remote vulnerabilities, physical access presents a straightforward path to compromise. Standard "number two" keys for traffic cabinets are readily available online for around $50, and police access keys (skeleton keys) are also acquirable. Furthermore, many cabinets are left unlocked or are vulnerable to simple tampering, such as homeless individuals wiring in 110V outlets for charging phones, which is identified as a major threat by technicians.
7. CVE-2024-38944: Lemon successfully disclosed a critical vulnerability, CVE-2024-38944, achieving a CVSS score of 9.8. While specific details of this CVE were not fully elaborated in the talk, its high severity rating underscores the profound impact of the identified flaws.

These findings collectively paint a picture of an industry grappling with legacy systems, an aversion to security research, and a critical need for fundamental improvements in cybersecurity posture.

Technical Deep Dive

▶ Watch: Speaker's motivation: City Skylines and civil engineering (4:00)

Andrew Lemon's methodology for dissecting traffic control systems began with an OSINT (Open-Source Intelligence) approach, leveraging tools like ChatGBT to identify major manufacturers (e.g., Econolite, Siemens, McCain) and then scrutinizing their websites, DNS records, and publicly available user manuals. Municipalities often publish detailed specifications of their traffic control systems, including reasons for not upgrading (e.g., budget constraints for systems still running Silverlight). This public data proved invaluable for understanding system architectures and potential vulnerabilities without requiring unauthorized access.

The core of Lemon's research involved acquiring actual hardware. He eschewed illegal methods, opting for online marketplaces like eBay and surplus auctions. He successfully purchased an Econolite Intelite controller for $150, acknowledging that a full intersection setup could cost upwards of a million dollars. Powering these devices proved to be a challenge, as manufacturers charge exorbitant prices for proprietary cables ($210 from Econolite). Lemon overcame this by reverse-engineering the power requirements, using 23 wire nuts to get the unit operational, and later documenting a more streamlined method on his blog. His ultimate goal, a tongue-in-cheek benchmark, was to see if the device "could run Doom," which required acquiring a more advanced, $3,000 controller through persistent lowball offers on eBay.

The Achilles' heel of traffic control systems, as Lemon revealed, lies in the widespread adoption of NTCIP, which layers upon SNMP. NTCIP was developed in 1996 by the traffic industry, essentially creating their own SNMP standard rather than fully embracing the existing IETF standard. SNMP operates using MIBs (Management Information Bases), which are essentially text files defining data objects and their properties (e.g., read/write access). Lemon highlighted that many NTCIP MIBs are publicly available (e.g., NTCIP 123 for dynamic message signs) and contain critical information.

A crucial discovery was that many NTCIP MIBs, especially for features like dynamic message signs (DMS), contain globally read-writable OIDs (Object Identifiers) with no authentication or authorization. For instance, an OID related to a "long power loss message" allows an attacker to dictate the message displayed on a DMS after a power cycle (e.g., "all your bases are belonging to us"). Lemon demonstrated this live, showing an OID (specifically 1.3.6) that is globally writable, enabling defacement of signs. He used a MIB browser like IReasoning to "SNMP walk" the device, enumerating all available OIDs.

Beyond documented OIDs, Lemon uncovered undocumented OIDs through extensive enumeration. This led to the discovery of default credentials: intellect for the username and admin for the password. Critically, the OID corresponding to the admin password was also globally writable, allowing an unauthenticated attacker to change the administrator password. This effectively grants full control over the device.

The presentation also touched on the MMU (Malfunction Management Unit), a hard-soldered safety component designed to prevent conflicting green lights by forcing an intersection into a flash state if an unsafe condition is detected. Lemon's extensive efforts to bypass the MMU – including sniffing and spoofing the SDLC bus (the serial data link between the MMU and the controller) and gaining direct control of light drivers – were ultimately unsuccessful. This underscores the robust safety mechanisms in place for preventing the "all green" scenario often depicted in fiction, making such a direct, catastrophic hack extremely difficult, if not impossible, without physical modification of the MMU itself.

Remote access methods were also detailed. While the underlying communication is often serial (SDLC), newer systems increasingly use Ethernet. Many controllers are connected via Cradlepoint devices, often running on isolated 192.168.x.x or 172.16.x.x LAN segments. However, these Cradlepoints often have backend networks or point-to-point VPNs, meaning that compromising credentials on one controller can lead to a compromise of an entire network of controllers, as credentials are often not unique.

Demo / Proof of Concept

▶ Watch: Pentesting methodology for smart cities/new systems (5:00)

Andrew Lemon's presentation included several compelling demonstrations and proof-of-concept scenarios, both direct and conceptual, derived from his extensive lab work.

His physical lab setup prominently featured an Econolite Intelite traffic controller, acquired legally from eBay. This device served as the primary platform for his technical deep dive. A significant, albeit humorous, proof of concept was his successful endeavor to make the traffic controller "run Doom." This was not merely a novelty; it demonstrated the ability to achieve root shell access on the device, a complex process that required "an ungodly amount of effort." While the screen draw speed wasn't sufficient for a smooth Doom experience on the first controller, he eventually acquired a $3,000 controller that could indeed run it, using the physical buttons for interaction. This showcased deep system compromise and control beyond the intended functionality.

A key demonstration of the NTCIP/SNMP vulnerabilities involved using an MIB browser (specifically IReasoning's MIB Browser) to interact with the traffic controller. Lemon explained how to perform an SNMP walk to enumerate OIDs. He specifically highlighted an OID, 1.3.6, which was globally writable without authentication. This OID could be used to deface dynamic message signs (DMS), allowing an attacker to change the displayed message to anything desired, such as "red threat was here" or "lemon was here." This live example clearly illustrated the lack of access controls on critical system parameters.

Further illustrating the authentication bypass, Lemon described how the web interface of some controllers, despite appearing to be a modern, secure front-end, merely translates user input into underlying SNMP commands. He demonstrated that by knowing the full URL for specific configuration pages (e.g., /web_security or /password_reset), an attacker could directly navigate to these pages without logging in. This allows for the disabling of security features or resetting administrative passwords, effectively bypassing all authentication mechanisms the web interface supposedly provides.

While the "all green" traffic light scenario from movies like The Italian Job was discussed, Lemon clarified that his attempts to achieve this were unsuccessful due to the robust, hard-soldered MMU (Malfunction Management Unit). The MMU's role is to prevent conflicting signals by forcing the intersection into a four-way flash if an unsafe state is detected. This highlights the inherent safety mechanisms that, while perhaps not impenetrable, make direct manipulation of light sequences for catastrophic collisions incredibly difficult without deep physical tampering. Instead, Lemon emphasized that more realistic and impactful disruptions could be achieved by causing a four-way flashing mode (effectively a four-way stop) or selectively disrupting key off-ramps, leading to cascading traffic jams and mass confusion.

He also showed examples of how GridSmart cameras (often found on Shodan with default credentials like admin:admin) could be accessed. Disconnecting such a camera from the system would force the intersection into manual timing mode, leading to inefficient traffic flow and confusion, as evidenced by a friend's video of a pedestrian crossing counting down erratically. These demonstrations collectively provided concrete evidence of the widespread and often easily exploitable vulnerabilities in traffic control systems.

Defensive Implications

▶ Watch: Learning traffic control: Starting from zero with ChatGPT (6:00)

Andrew Lemon's talk provides a stark warning for municipalities and transportation authorities, outlining critical defensive measures necessary to secure intelligent transportation systems. The implications for defenders are clear: a multi-faceted approach addressing both technical and operational security gaps is urgently needed.

1. Mandatory Security Audits: The most fundamental recommendation is to conduct regular and thorough security audits. Lemon explicitly states, "pay me to come hack your stuff," emphasizing the value of authorized penetration testing to identify vulnerabilities before malicious actors do. These audits should cover network infrastructure, application security (including web interfaces), and the configuration of traffic controllers themselves.
2. Aggressive Software and Firmware Updates: The prevalence of outdated firmware and end-of-life operating systems (e.g., Android 6) is a critical vulnerability. Defenders must prioritize and budget for software updates and firmware patching, ensuring that all components, especially those with network connectivity, are running supported and patched versions. This includes replacing or upgrading ancient hardware that can no longer receive security updates.
3. Robust Network Segmentation: Exposing traffic controllers directly to the internet is a cardinal sin. Lemon strongly advocates for network segmentation, stating, "There's no reason why I should be seeing a stoplight on the internet." Systems should be isolated on dedicated local area networks (LANs), protected by VPNs, or entirely disconnected from public networks where possible. If remote access is absolutely necessary, it must be secured with multi-factor authentication and strict access controls.
4. Implement IDS/IPS and Logging: For systems that must remain connected, even within a segmented network, Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are crucial. These tools can detect suspicious activity, such as unauthorized SNMP commands, attempts to access administrative interfaces, or brute-force login attempts. Coupled with centralized logging (e.g., Syslog), defenders can monitor for security events and respond rapidly to potential compromises.
5. Change Default Credentials: The discovery of widespread default credentials (e.g., intellect:admin) and the ability to change them unauthenticated via SNMP is a severe risk. All default passwords must be changed immediately upon deployment to strong, unique credentials. Regular password rotation policies should also be enforced.
6. Secure Physical Access: While often overlooked in cybersecurity discussions, physical security is paramount. Standard traffic cabinet keys (#2 key) and police access keys are easily acquired. Defenders must implement more robust physical locks, consider smart locks (while being aware of their own potential vulnerabilities, as highlighted by Lemon's mention of a digital key compromise incident), and ensure that cabinets are always securely locked. Regular patrols to check for unlocked cabinets are also advisable.
7. Awareness of Undocumented OIDs: Security teams should be aware that undocumented OIDs can exist and may expose sensitive functionality. While not a direct defensive action, understanding this risk can inform more thorough penetration testing and code review if source code is available.
8. Educate Personnel: Technicians and operators should be educated on cybersecurity best practices, including the risks of default credentials, the importance of secure remote access, and how to report suspicious activity.

By implementing these countermeasures, transportation authorities can significantly reduce their attack surface, enhance the resilience of their traffic infrastructure, and protect public safety from malicious exploitation.

Key Takeaways

• Traffic control systems are critical, vulnerable infrastructure: Despite their importance to public safety and daily life, these systems often rely on outdated hardware, unpatched software, and insecure protocols, making them prime targets.
• NTCIP and SNMP are primary attack vectors: The widespread use of NTCIP, built on SNMP, exposes many systems to unauthenticated read/write access of critical parameters via easily discoverable MIBs and OIDs.
• Default credentials and authentication bypasses are rampant: Many controllers use easily guessable default credentials, and even modern web interfaces can be bypassed to disable security or reset passwords without authentication.
• Systems are frequently exposed to the internet: Poor network segmentation and misconfigured firewalls mean many traffic controllers and cameras are discoverable on public search engines like Shodan and Censys, enabling remote attacks.
• Physical security is a significant concern: Standard cabinet keys are readily available, and many cabinets are left unlocked, providing easy physical access for tampering.
• Responsible disclosure is challenging in this industry: Vendors often respond to vulnerability reports with legal threats and denials, hindering ethical research and the remediation of critical flaws.

About the Speaker(s)

Andrew Lemon is the CEO of Red Threat, a company focused on incident response against sophisticated threat actors. With 13 years of professional penetration testing experience and an additional 23 years of "unprofessional, unpaid" experience, he possesses a deep understanding of offensive security techniques. Lemon has presented at numerous security conferences, including Defcon, Girkcon, and various BSides events, and has contributed to the Red Team Village. His work often involves unique and challenging penetration tests, as evidenced by his research into traffic control systems. He is passionate about physical pen testing and has a humorous, albeit persistent, goal of "stealing a baby" by pen testing hospital maternity wards. His online presence can be found under the handle @limited_uppoud (though his preferred handle was taken).