A security researcher says he has found a bug in a traffic light control system that would allow hackers to change the lights and cause traffic jams or even accidents.
Andrew Lemon, a researcher at cybersecurity firm Red Threat, detailed his findings. One of the devices Lemon examined is the Intelight X-1, which has a bug that allows anyone to take full control of the lights. The problem is that there is no authentication in the web interface of the device that is exposed to the internet.
See also: Cisco SSM On-Prem bug allows password change
Lemon said he tried to see if it was possible to trigger a scenario that involves changing all the lights at an intersection. But the researcher said he found another device called a Malfunction Management Unit that prevents that scenario.
"It's still possible to change the lights and the timing. If someone wants to, they can set the time to three minutes in one direction and three seconds in the other direction. This is a denial of service , so you can block traffic," Lemon said.
It's unclear how many vulnerable Intelight devices are accessible from the Internet. Lemon said he and his team found about 30 exposed devices.
See also: Microsoft fixes Windows 11 bug causing reboot loops
Lemon said he contacted Q-Free, the company that owns Intelight. However, it appears the company did not respond to the bug, but instead sent a letter (according to Lemon).
«"We only accept reports of vulnerabilities related to Q-Free products currently offered for sale. We do not have the necessary resources to review analyses of outdated data," read a copy of the letter, which appears to be signed by Steven D. Tibbets, Q-Free's general counsel.
The copy of the letter stated that the device Lemon analyzed is not for sale and that the way Red Threat investigated it may have violated the Computer Fraud and Abuse Act. The letter then asked Lemon and Red Threat to pledge not to publish details of the vulnerability because it could harm national security.
See also: GitLab: Critical bug allows attackers to execute pipelines
The discovery of a bug in traffic light control systems serves as a stark reminder of the potential dangers of cyberattacks in our increasingly connected world. While this article focused on the specific vulnerability found in traffic light controllers, it is important to note that this is just one example of how hackers could potentially disrupt our daily lives through attacks.
From power grids to healthcare systems, almost every aspect of modern society relies heavily on technology and connectivity. As such, it is vital for companies and governments to prioritize cybersecurity measures to protect themselves from potential attacks.
Source: techcrunch.com
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
