Can Wired Cities Outsmart Hackers?

The future is here, but so are the hackers.

ByABC News
May 3, 2015, 3:40 AM
The view from the 63rd floor of One World Trade Center is seen on Nov. 3, 2014 in New York City.
The view from the 63rd floor of One World Trade Center is seen on Nov. 3, 2014 in New York City.
Andrew Burton/Getty Images

— -- Editor's note: A response to this column from Sensys Networks has been added below.

A monster storm is on a collision course with New York City and an evacuation is under way. The streets are clogged, and then it happens. Every traffic light turns red. Within minutes, the world’s largest polished diamond, the Cullinan I, on loan to the Metropolitan Museum of Art from the collection of the British Crown Jewels, is whisked away by helicopter.

While this may sound like the elevator pitch for an action film, the possibility of such a scenario is more fact than fiction these days.

Cesar Cerrudo is the chief technology officer at IOActive Labs, a global security firm that assesses hardware, software and wetware (that is, the human factor) for enterprises and municipalities. A year ago, Cerrudo made waves when he demonstrated how 200,000 traffic sensors located in major cities around the United States—including New York, Seattle, Washington, and San Francisco—as well as in the UK, France and Australia, could be disabled or reprogrammed because the Sensys Networks sensors system that regulated them was not secure. According to ThreatPost, these sensors “accepted software modifications without double-checking the code’s integrity.” Translation: there was a vulnerability that made it possible for hackers to reprogram traffic lights and snarl traffic.

A widely reported discovery, first discussed last year at a black hat hacker convention in Amsterdam, highlighted a more alarming scenario than the attack of the zombie traffic lights. Researchers Javier Vazquez Vidal and Alberto Garcia Illera found that it was possible, through a simple reverse engineering approach to smart meters, for a hacker to order a citywide blackout.

The vast array of attacks made possible by the introduction of smart systems are many. With every innovation, a city’s attackable surface grows. The boon of smart systems brings with it the need for responsibility. It is critical for municipalities to ensure that these systems are secure. Unfortunately, there are signs out there of a responsibility gap.

According to the New York Times, Cerrudo successfully hacked the same traffic sensors that made news last year, this time in San Francisco, despite reports that the vulnerabilities had been addressed after the initial flurry of coverage when he revealed the problem a year ago. It bears saying the obvious here: Cerrudo’s findings are alarming. With the information of how to hack the Sensys sensors out there, was San Francisco’s security protocol nothing more than dumb luck? How could it be that the same issue was imperiling the safety of San Franciscans?

The integration of smart technology into municipalities is a new thing. The same Times article notes that the market for smart city technology is expected to reach $1 trillion by 2020. As with all new technology, compromises are not only possible, but perhaps even likely, in the beginning. The problem here is that we’re talking about large, populous cities. As they become ever more wired, they become more vulnerable.

The issue is not dissimilar from the one facing private sector leaders. Organizations must constantly defend against a barrage of advanced and persistent attacks from an ever-growing phalanx of highly sophisticated hackers. Some of them work alone. Still others are organized into squadrons recruited or sponsored by foreign powers—as we have seen with the North Korean attack on Sony Pictures and the mega-breach of Anthem suspected to be at the hand of Chinese hackers—for a variety of purposes, none of them good.

More From Credit.com: How the Sony Hack Is Changing the Way I Work

The vulnerabilities are numerous, ranging from the power grid to the water supply to the ability to transport food and other necessities to where they are needed. As Cerrudo told the Times, “The current attack surface for cities is huge and wide open to attack. This is a real and immediate danger.”

The solution, however, may not be out of reach. As with the geometric expansion of the Internet of Things market, there is a simple problem here: lack of familiarity at the user level—where human error is always a factor—with proper security protocols. Those protocols are no secret: encryption, long and strong password protection, and multi-factor authentication for users with security clearance.

More From Credit.com: Millions of Anthem Customers Exposed: What It Means for You

More From Credit.com: How to Protect Yourself From Identity Theft

While the above-noted protocols are not a panacea for the problems that face our incipiently smart cities, they will go a long way towards addressing security hazards and pitfalls.

Cerrudo has also advocated the creation of computer emergency response teams “to address security incidents, coordinate responses and share threat information with other cities.” While CERTs are crucial, the creation of a chief information security officer role in municipal government to quarterback security initiatives and direct defense in a coordinated way may be even more crucial to the problem-sets that arise from our new smart cities. In the pioneering days of the smart city, there are steps that municipalities can take to keep their cities running like clockwork.

It starts with a proactive approach to security.

Any opinions expressed in this column are solely those of the author.

Adam Levin is chairman and co-founder of Credit.com and Identity Theft 911. His experience as former director of the New Jersey Division of Consumer Affairs gives him unique insight into consumer privacy, legislation and financial advocacy. He is a nationally recognized expert on identity theft and credit.

The following is a statement by Sensys Networks in response to Mr. Levin's column:

Our equipment does not control traffic signals. Our equipment provides an input to third party traffic controllers who are responsible for the safe operation of traffic signals. It is impossible to manipulate our systems, or data, to cause conflicting movements or phases to be displayed (as depicted in the type of “action film” Mr. Levin fantasizes). Both the controller software and conflict monitor prevent the possibility of this scenario.

One cannot use our wireless protocol to access data or send information to a customer network or the Internet. Our systems do not use Wi-Fi or any other wireless Internet protocol; we use a proprietary wireless protocol that does not contain or control any Internet protocol information. We developed our technology this way so that unauthorized users who attempt to access our wireless signal could not hack into our customer’s private networks or the public Internet. This is the central security concern of our customers, and is the reason we developed our technology with these protections in place.

Our systems were not “hacked.” Mr. Cerrudo has not “hacked” San Francisco’s, or any other, operational system. A “hack” occurs when existing security protocols are breached or circumvented to gain access to restricted information or intellectual property. No such access has been demonstrated by IOActive. It is impossible to gain such access via the wireless interface. It’s worth noting, too, that any act of hacking an operational traffic system is illegal.

Enhanced anti-vandalism features are available for our customers. All vehicle detection equipment is subject to interference and other acts of vandalism. To minimize any potential inconvenience of such acts, Sensys Networks developed software features that incorporate several advanced anti-vandalism capabilities that provide 1) protection against attempts to download unofficial code; 2) protection against attempts to insert false detection data; and 3) notification of customers in the event of an unauthorized data manipulation attempt. These software features are available to all our customers.