Hacking US crosswalks to talk like Zuck is as easy as 1234 – Source: go.theregister.com

Video Crosswalk buttons in various US cities were hijacked over the past week or so to – rather than robotically tell people it’s safe to walk or wait – instead emit the AI-spoofed voices of Jeff Bezos, Elon Musk, and Mark Zuckerberg.

And it’s likely all thanks to a freely available service app and poorly secured equipment.

In Seattle this week, some crosswalks started playing AI-generated messages spoofing tech tycoon Jeff Bezos. In one video clip, a synthetic Bezos voice can be heard introducing himself from the push-button box, and claiming the crossing is sponsored by Amazon Prime.

Then it veered into parody-turned-social commentary: “You know, please don’t tax the rich, otherwise all the other billionaires will move to Florida too. Wouldn’t it be terrible if all the rich people left Seattle or got Luigi-ed and then the normal people could afford to live here again?”

On the one hand it’s some old-school hacker fun, and on the other, it’s a nuisance for some walkers, particularly visually impaired pedestrians who rely on audio cues to know when it’s safe to cross. The city government isn’t thrilled either: Fixing the tampered buttons is eating up staff time that could be spent elsewhere.

“We take this matter seriously and are working as fast as we can to respond to the situation,” the folks at the Seattle Department of Transportation told the press. “We are also working with our vendor to explore stronger security measures to prevent future hacking.”

It’s not just Seattle. Similar hacks were spotted, or rather heard, in Silicon Valley, where crosswalk buttons have been made to spout AI-generated voices impersonating Mark Zuckerberg, Elon Musk, and Donald Trump telling the SpaceX oligarch to “come back to bed.” A recording for YouTube of the crosswalk hijackings is embedded below.

Youtube Video

Generating AI deepfakes is easy these days, and the tech is only getting better. Whoever’s behind the pranks will likely keep at it. We reckon it’s possible by using a mobile application that was freely and publicly available from the manufacturer of the crosswalk hardware for configuring the gear.

Now that the maker has pulled that software from the official Android and iOS app stores, The Register can responsibly reveal just how the trick was pulled off. Or how we’re pretty sure it was pulled off.

Easy as 1234

The hacked crosswalks all appear to come from a common source: Polara, America’s leading manufacturer of pedestrian signal systems. When working properly, the signals usually say things like “wait,” “walk,” or “walk light is on.”

There are hundreds of thousands of these devices deployed across the country, installed and maintained by municipal governments and contractors. The hardware is built to be simple and durable, while the software controlling it is a basic industrial system accessed via Bluetooth.

All of it can be managed using the Polara Field Service app, which until recently was freely available on both the Google Play and Apple App Store. Unsurprisingly, it’s now been pulled from both platforms – almost certainly in response to the recent wave of hijinks.

Polara made the app public for convenience and so customers wouldn’t need to buy a proprietary device to configure crosswalk units, which is either a good idea or a lost revenue opportunity depending on how you look at it. But it did make it easy for pranksters to get their hands on it.

After installing the app, and linking the smartphone to a nnearby crosswalk system via Bluetooth, the user can configure the spoken messages triggered by button presses, adjust the signal timing, and install language packs – in this case, AI-generated voices, it seems. Noted hacker Deviant Ollam broke down how all this works in a video last year, which you can see below.

Youtube Video

However, getting in requires a password – and anybody who’s worked in security can see where this is going. As Polara’s own documentation states, the default passcode is 1234 and it’s up to the purchaser to change that in production. We’d wager most installers never bothered. That oversight made it trivially easy for anyone with the app to pair with nearby devices and swap out settings – including uploading AI-generated voice clips.

• How to snoop on passwords with this one weird trick (involving public Wi-Fi signals)
• Cheap ‘n’ simple sign trickery will bamboozle self-driving cars, fresh research claims
• Former NSA cyberspy’s not-so-secret hobby: Hacking Christmas lights
• Hacktivism resurges – but don’t be fooled, it’s often state-backed goons in masks

“Polara presumably made for an appealing target because they have a wireless management interface by Bluetooth, they have a huge market share, and the results are hilariously public in the form of spoken voices on every corner,” Ollam told The Register.

He noted that while the app is no longer in public app stores, plenty of people already have it installed – and archived copies are almost certainly floating around online. To fix the situation, someone’s going to have to get out there and change the PINs and keep lists of them. Which is good until the lists leak. Brute-forcing the passcodes won’t work as after too many goes, the devices lock you out, we understand.

“If governments are properly funded right now, there’s a chance we’d actually see work crews going out there, going intersection to intersection. But since at the present moment in time, government departments are being slashed and burned, who knows?” Ollam opined.

“Then again, this is a stunt that’s poking fun at the ruling class. So there’s often been a way of magically making money appear out of nowhere, even while children go hungry in schools that are underfunded.”

In a statement to El Reg, Polana told us none of its systems or code had been compromised, and if anyone did get into in-the-field crosswalk systems, it would have been done using valid PINs, such as the 1234 default:

The biz added: “We are working with affected customers to remove the unauthorized messages and to help protect their systems moving forward. We regret any inconvenience and continue to work directly with our customers to enhance security for their systems and ensure these products remain safe and reliable.”

What can we say? This is why default credentials in production are bad. ®