There’s a well-known movie trope in which a hacker takes control of the traffic lights in a city, causing general mayhem or creating a clear getaway path. Unlike many Hollywood representations of hacking, this is actually possible in principle; many cities install Emergency Vehicle Preemption (EVP) systems in their traffic signals to turn them green when an emergency vehicle is approaching. To see what it would actually take to control one of these, [xssfox] reverse-engineered a Strobecom II EVP system.
Most EVP systems, particularly older ones, use a strobing infrared light to alert a traffic signal to an approaching emergency vehicle. To avoid misuse, vehicles often encode a vehicle ID in the infrared signal. There have been some claims that a Flipper Zero can trigger these systems, but none that were well-verified, and probably with good reason; anyone actually trying this against a live system is courting serious legal trouble. To see whether this was actually possible [xssfox] obtained real hardware and tried to reverse-engineer the infrared protocol.
There are two main manufacturers for optical EVP systems: GTT Opticom and Tomar Strobecom. [xssfox] managed to buy a Tomar power supply which handled the processing for signal transmission, and which worked with Opticom systems. Looking at the output of this revealed that it encoded data by skipping pulses, which should be simple enough for Flipper Zero to replicate.
To reverse-engineer the Strobecom protocol, [xssfox] managed to buy a Strobecom optical signal processor, which would normally detect an emergency signal. This worked by modulating the length of infrared pulses. After some brute-forcing, a transmitter using an Arduino Nano and an infrared LED managed to activate the preemption signal, and even to transmit a vehicle ID. It seems that Strobecom systems, at least, are fairly demanding in terms of the signals they accept; signals had to be precisely timed, and in at least some systems, a valid vehicle ID would be needed to change the light.
If you’d like to learn more, we’ve gone into the technology of North American traffic signals before.
Sure are a lot of big, fat, easily-bumped switches for something going into a government vehicle. In the past, they seem to have preferred internally-configured bricks for things like this… even for radios. They sought to make them “idiot-proof”. I have several of the old Motorola bricks that have been reconfigured for 6m.
Shown is the receiver that is part of Traffic Light control. Not the transmitter that goes into the vehicle. I would assume that one is indeed just a black box.
This is the receiver, which would be mounted inside the traffic light control box. The transmitter would be smaller and likely configured with internal dip switches.
In Japan pedestrian crossing turns green when a wheelchaired person approach near the cross button.
In Soviet Union, traffic lights turn you green.
Where do they do that? In Kansai, they seem to still require the person to push the walk button. There are some dedicated walk buttons here and there that will cause the chirping sound to turn on when the crosswalk light turns on, but I’ve never seen any automated system. Sounds like it would be too easy to exploit or if someone in a wheel chair just happened to be rolling down the sidewalk, every crosswalk the passed would suddenly start changing. I’m starting to think you’re referring to an urban legend.
There’s no way this is widespread, I’m not sure where you’ve seen it, but keep in mind that it means the wheelchair itself has an active transmitter, that’s not going to be personal property. Whatever you saw might be a single implementation at a specific hospital with the traffic system on the facility property.
Back in the old days of the visible-strobe 3M OptiCom days (some time in the last century, pre-WWW), strobe hacks were well-known, even then, but were awfully visible.
I was riding in a taxi one day back then. When we came to a red light the driver reached above the visor and pushed a button. No visible flash, but the lights changed immediately.
So I asked him about it. He freely admitted he got it mail-order, it used infrared, and it saved a lot of time and got him more fares per day.
Bold.
I can imagine that if you made a spoofer it would immediately appear on AliExpress etc for all to buy.
Im not sure how you’d manage the need for a valid vehicle ID but presumably it could have a few encoded to try.
Of course these days you’d very quickly be noticed by traffic cameras if there’s any syncing between them and you’re clearly not a fridge truck.
Yes this used to be the case but back when 3M still owned Opticom (you know your history here) they moved to a multi frequency hop much like your garage door opener. Regardless, these are old systems and most have been replaced with GPS or cloud based systems.
This story reminded me of the various conspiracy theorist nonsense tropes, and one of them is the ‘lasers from space’ one, and it made me wonder if you could send a normal IR remote signal from space with a laser, and I think it would be possible.
So there you have your ‘plausible’ deniability vehicle if you need it :)
So now I wonder if anybody who frequents HaD ever tried to send normal remote signals over a very long distance with a laser. I mean IR lasers are widely available, and if they can’t be modulated fast enough in output you can sit something in-between to do so I think, right?
Traffic lights with red light or other camera systems could be configured to take a photo of every vehicle passing through the light when this feature is activated. After your vehicle is photographed in a few separate instances there won’t be much plausible deniability.
Yes it’s happened
If I stand on the sidewalk and turn the light green, then a car goes through the green light, can a picture of that car say anything but that the car went through green? And I think it’s legal to pass green. Hell there might be a ambulance behind you that turned it green, a picture says nothing.
if using a camera it would also need to video the IR signals, which is technically possible but they won’t pay for that unless half the cars abuse it.
You are not wrong. However… the costs of building a satellite with a precision targeted geo-tracking IR laser and getting the whole package into orbit would give the fun experience of watching someone else drive through an intersection 20 seconds early a fairly hefty price tag.
You’re going to try to convince the judge that some guy you don’t know if following you around — on foot, btw, standing in the sidewalks turning various lights green for you all around the city?
Don’t believe you; do believe you’re lying, 30 days in jail.
No you say you didn’t do it, then the prosecutor will say ‘the system was activated moments before you went through the green light” then your lawyer says “can you show that my client was the one activated it? Where is the evidence? theoretically it could be anybody near the crossing, hell even a satellite with a laser”.
Then the judge agrees the prosecutor should show evidence the driver activated it and you walk free… unless the cops searched your car and found the device of course, in which case the prosecutor says “you had the device to activate it in your car, which together with the activation while you were there leads to probable cause”
Then the judge who has previously looked up related regulation selects the applicable sanction, which probably is a fine on first offense.
Was going to postulate this. I suspect it’s the standard now.
Using a spoofer would be a very poor idea today.
Aiming a strobelight and aiming a laser are two very different things.
Not a laser, but fresnel lens suffices to concentrate the beam from a TV-B-Gone well enough to turn off a neighbor’s monster TV from 150 yards away and through their living room window.
No, wasn’t me, of course. Must have been nuked from orbit.
Only way to be sure.
Most people don’t realize that Tomar founded Tomar Strobecom to develop methods to torture epileptics but parleyed that into the traffic signal controls so he could more efficiently chase down victims as well.
Of course the ultimate defense against this by the cities is to properly set up the traffic light system so it allows for sane traffic flow, thus removing the incentive for people to want to hack it.
There is no reason for me to approach and have to wait on a red light ( sometimes forever) with no cross traffic
This is just silly. There is a reason, that you and pedestrian traffic are not tracked. Instead you trigger a system that must (by law) go through a number of cycles to ensure safety. In very tightly controlled areas there triggers are often removed as any changes in pattern would disrupt three carefully calibrated traffic pattern.
Some of the information in this article is misleading. I install systems like this, the older systems did not use an infrared light they used to strobe light the strobe lights emit both regular visual light that you can see and infrared light what you can’t see. Most apartments in the Northeast do not include a vehicle ID. The preemption in the traffic signal is not expecting an encoded ID. Very few departments in code and ID and the apartments that do, tend to be larger cities. If you wanted to figure out the encoding it’s pretty simple on the back of the unit there are several dials that you can use to set the encoded message. It’s important to note that triggering any one of these preemption devices will light a flood light that is located on the traffic signal that allows the emergency vehicle operator to know that they actually triggered the preemption that they have the only green light at that intersection. It might also be helpful to note here that some departments don’t allow police to use up the comms or preemption devices because it’s dangerous because of the speeds that they’re using at least my local only emergency medical services uses preemption.
The article is NOT MISLEADING. Visible strobe‑based preemption systems do exist, but there have also been long‑standing infrared (IR) strobe and IR LED systems. The first widely documented IR optical preemption system was Opticom, developed in the mid‑1960s, with a notable deployment at 28 intersections in St. Paul, Minnesota by 1969. For visible strobe systems, companies like Whelen and Tomar were selling xenon strobe‑based preemption gear in the 1970s, but I haven’t found solid documentation of specific large‑scale deployments yet. This matches what’s in traffic‑engineering reports and vendor histories, so it’s not just anecdotal.
Hi Robert,
Author of the blog post here. The article does mention that xenon tube flashes are used to generate the infrared signal. The Tomar system, while designed for strobing will work with LEDs – they even sell a tester that emits a signal using an LED, though it is short range. I can only really speak to my city which does require encoded vehicle IDs, and I suspect most places where you’d want all green lights are going to be larger cities with encoded signals.
For the Tomar systems, the only thing I’ve seen for setting the vehicle ID is either with PC software or using the J1708/J1587 for transit vehicles. I only briefly looked at 3M so the only reference I saw there was that they code the ID when you purchase them. Regardless, I can’t really go looking inside emergency vehicles to discover the ID.
With Tomar lights, you can purchase them with confirmation lights. These are lights that sit under or to the side of the detector to indicate they have been triggered successfully. I don’t doubt the flood light approach, even if I haven’t seen it though.
In my city I believe fire, ambulance and police all have emergency vehicle preemption.
I had a friend that insisted he could change the lights by flashing his high beams at the intersection… I to explain to him that it worked off of an infrared system but it went right over his head 😂
He was right.
Halogen and HID (Xenon) headlights produced a massive amount of infrared in addition to visible light. It’s also broad spectrum IR – from 700nm up to 3000nm – so it overlaps the common IR emitter wavelengths – 850 and 940nm.
On the right system, like 14Hz MIRT, you can absolutely flash your high beams at the proper speed and cause the light to change.
I think it’s pretty careless to show the general public how this can be done. Because, some dumb ass out there is going to give it a try to cause complete havoc and serious injuries or even death to God knows how many innocent people just for fun on their part. Totally careless!!! Bad use of judgment in my thoughts.
“I think it’s pretty careless to show the general public how this can be done.” If I already knew about it then the general public already knew, at least in broad strokes. “… injuries or even death to God knows how many innocent people” only if “God knows how many innocent people” fail to stop at their red light. Ball’s in your court, General Public.
You’re new here, aren’t you?
“You’re new here, aren’t you?” Sick burn bro.
You’re basically saying this whole site shouldn’t exist, for security through obscurity reasons.
I don’t think there’s much risk of physical harm here; when the traffic preemption system is activated, the traffic signal still goes through the usual green-amber-red transition, just earlier than it would normally. Cars in the intersection still have time to exit before the light changes.
Restricting this kind of thing for those reasons is nearly always a critical failure of judgement. It’s no different from claiming lockpicking shouldn’t be discussed. If the vulnerability is trivial to exploit then people should know, so that it gets changed or so their habits can adjust to the real security profile, as in the case of locks.
I’m pretty sure the modern systems are using GPS based location tracking. At least thats what the guy I follow is showing that he installs.
Worse is when governments speed up signals as part of ticket writing quotas. That makes folk want to shoot these things, traffic cameras…
There is a light that loves going red on me when no one is coming.
The thing to do for first responders is make the things go red all around—but only until they are clear.
If someone has a head of steam and I am waiting…the light should not make the other guy squall his breaks when I am already stopped—and vice versa.
Momentum should be taken into a count—not blind timing.
A lot of these systems are apps now.
I first saw these optical emergency vehicle traffic light overrides in San Jose. California in the 1970s. If there were anywhere in the world that had a concentration of knowhow on to spoof these, it would be in Silicon Valley (back when it was all about Silicon), so I’m not surprised that the receivers are rigorous about what signals they accept.