Free Wi-Fi Leaves Buses Vulnerable to Remote Hacking – Source: www.securityweek.com

Researchers demonstrated that smart buses, the transportation vehicles that incorporate various systems to improve safety, efficiency, and passenger experience, can be remotely hacked. 

The findings were described on Friday at the DEF CON hacker convention by Chiao-Lin ‘Steven Meow’ Yu of Trend Micro Taiwan and Kai-Ching ‘Keniver’ Wang of CHT Security, a Taiwan-based MSSP.

The researchers started digging into the cybersecurity of smart buses after noticing that free Wi-Fi was available for passengers.

An analysis showed that the same machine-to-machine (M2M) router was used both to provide free Wi-Fi to passengers and for in-vehicle systems used for Advanced Public Transportation Services (APTS) and Advanced Driver Assistance Systems (ADAS). 

The ADAS uses sensors, cameras, radar and LiDAR to assist drivers and prevent accidents. Its capabilities include collision warning, lane departure warning, speed limit indicator, and traffic sign recognition, as well as passenger and driver monitoring for safety purposes. 

APTS consists of various components meant to increase the efficiency of public transport systems, such as GPS devices that provide an accurate location of the bus, interfaces for passengers and operators, route and schedule services, and panels installed at bus stops — all managed through a central system.

The researchers were able to easily bypass the on-board router’s authentication and gained access to its administration interface. Since there was no network segmentation, they were then able to move to APTS and ADAS functionality. 

The experts discovered several vulnerabilities in these systems, including command injections and an MQTT backdoor that enabled remote access to the bus. 

Ultimately, Yu and Wang determined that a hacker could find vulnerable buses on the internet and launch remote attacks.

“Once an attacker understands the protocol via packet analysis or similar methods, it is possible to perform attacks from the internet without needing to be physically present on the bus,” Yu told SecurityWeek.

They demonstrated various scenarios, including how hackers could track the exact location of a bus or access the onboard camera, which is protected by easy-to-guess default passwords.

According to the researchers, through these vulnerabilities hackers could manipulate on-board displays, steal passenger and driver information, and even access the transportation company’s servers. 

“The protocols in use (at least in Taiwan) do not implement any encryption or authentication, even by industry standards,” Yu explained. “This means if an attacker is able to conduct MITM (Man-In-The-Middle) attacks, they can directly modify or forge the content.”

The researchers found that an attacker can connect to the bus’s systems and obtain information such as GPS location, engine speed (RPM), and the vehicle’s average speed. 

This data can be manipulated and the experts described several theoretical real-world attack scenarios. For instance, an attacker could change a vehicle’s GPS location, which would result in emergency response being delayed in case of an accident. A hacker can also falsify the RPM data to hide real mechanical problems or create spurious ones in an effort to cause disruption. 

Attackers can also falsify driver and vehicle state data to trigger false emergency or accident alerts. They could also set a false ‘out of service’ status to disrupt bus schedules and operations. 

The research was conducted on buses in Taiwan, but Yu told SecurityWeek that the vulnerable systems may be used in other countries as well, based on the fact that the vendor offers language options for Chinese, English, Japanese and Vietnamese.

The researchers said they attempted to responsibly disclose their findings to affected vendors, including the maker of the router, US-based BEC Technologies, and the firm that provides intelligent transportation solutions for buses in Taiwan, Maxwin. However, they received no response and the vulnerabilities appear to remain unpatched. 

Trend Micro’s Zero Day Initiative (ZDI) has published several advisories to describe the vulnerabilities found in BEC routers.

Related: New HTTP Request Smuggling Attacks Impacted CDNs, Major Orgs, Millions of Websites

Related: Major Enterprise AI Assistants Can Be Abused for Data Theft, Manipulation