A group of  Dutch safety experts have demonstrated that a traffic light system for bikes connected to a smartphone app can be hacked, potentially causing unsafe situations on the roads in case of an attack.

The smart system, part of which is still in the testing phase, has been installed by ten local councils but in future all traffic at some 1,200 crossroads will be regulated via the internet to improve flow.

The app tells the traffic light a car or bike is coming and adapts to the expected flow, limiting stops and starts. In the case of the bike light, the hackers were able to pretend they were approaching a light making turn to green without being close by.

‘The traffic lights we manipulated did not check if we were who we were supposed to be,’ Wesley Neelen of the Zolder security company told broadcaster NOS. By copying the data sent by the app, Neelen and his fellow hacker Rik van Duijn were able to fool the system into thinking a host of cyclists were approaching the traffic light.

The security flaw may be present in over a hundred traffic lights, said Van Duijn who will be presenting the findings at security conference DefCon on Thursday.

Offline

According to Talking Traffic, a partnership of local authorities and traffic app makers, the unsafe apps could not have led to dangerous situations by making the lights go green from more than one direction, spokeswoman Esther Schoemaker told the broadcaster. The apps have now been taken offline and will be improved.

‘We have no indication yet that it is possible to pretend to be other road users apart from cyclists. It would be more serious, for instance if someone were to pretend to be an ambulance and getting green lights all the way,’ Neelen said.

‘But attackers could cause problems by sending virtual bikes to a crossroads from different directions disrupting flow. ‘We didn’t try that, we just wanted to show that there was a problem,’ Neelen said.