April Fools - Wirelessly controller traffic light

Hello guys,

Some time ago, a person who shall not be named emailed me and talked about new traffic lights that can be controlled wirelessly. Since access points are getting pretty powerful these days, it makes sense that they are now embedded in traffic lights to control them. The reason behind making it wirelessly accessible is to make maintenance easier for technicians so that they don't have to open the whole thing. They just have to connect to the AP inside the traffic light to do it.

Here is the maintenance page. The URL of that page is blurred for security reasons:

Since there is no reference to it on other pages and it's so basic, I guess they forgot to remove it on production units (or maybe it is just meant to be used by technicians/developers or it is security by obscurity). On other pages you can input parameters of the traffic lights when it is in automatic mode such as operating times (it will blink yellow when outside of it), how long does each light last, etc...


He even sent me one of those traffic light. As a side note, you would be amazed by the size of those things:

Here is a close-up where the AP is:

The network cable you can see is used to interconnect different traffic lights at crossroads to synchronize several of them. 

Well, of course, since they don't want people to just hack in and mess with the traffic lights, they did not make it easy to connect (SSID is random) and to find that page. However, the person who contacted me managed to grab the handshake while the maintenance guy was doing maintenance and apparently, they use the same easy passphrase ("Maintenance123") on ALL those new traffic lights. By decrypting the traffic, he figured out the page where you can control the traffic light manually.

We both tried to contact the company to let them know about the flaws since it's pretty unsafe/dangerous to be able to change the light on live traffic lights and especially since they use the same passphrase on all of them. But they never got back to us.

New stuff

Hello everybody,

sorry for not posting anything since some time now, but we have been really busy these days and we got new stuff for you:
- 1.0 rc4 last week
- 1.0 final release date
- Planned features in 1.1
- New logo
- New website

I guess you saw there was a release, 1.0rc4 a bit more than a week ago.
This fixes a lot of stuff (and add some new). It fixes compilation not only on linux but also on BSD plateforms (OpenBSD compilation is fixed) and others ...
The changelog speaks by itself ;)

Here are some planned features for 1.1:
- Be able to use directly cowpatty tables in aircrack-ng (without having to convert them to airolib-ng).
- OSX capture (and maybe injection) with some adapters (Ticket #653).
- Improved WPA handshake detection.
- Bug fixes (of course)
- ...

We also have been working on a new website. Here is a preview: http://www.aircrack-ng.org/new_index.html.
The goal of this new design is to be able to reduce the traffic on the website, currently around 1Tb each month and also to be give a quick access to important information.
As explained in an earlier post, it will not replace the wiki, it will just be the home page and be next to the wiki (you can keep all your bookmarks).
If you (still) have any remark (or improvements) about the new design, you can still post them in the forum (you don't need to register to post).

The logo contest is over and we have a new logo. Here is a preview (winner: segini75). We will also sell t-shirts soon (I know a good website for europe but I still have to find one for the US).


Last but not least, the new website (and new logo) will be launched at the same time as the 1.0 final release in a week or two if no big bugs are found in rc4 :)

Paying the bill

I finally found who is the responsible or at least the IP address of the author of this DoS (if generating 1.5Tb of traffic in 2 days and making the monthly traffic exceed thus making the website down is not a DoS, then what is it?) and you can be sure that this guy will have to pay the traffic, sooner or later.

Administrative stuff is taking too long so I think it will be easier to pay the bill now to have the website back up.

Aircrack-ng cost me around 60 euro per month (+ domain names that have to be renewed each year, wireless cards, traffic, ...) and although we have around 30K unique visitors each day, unfortunatly donations are quite low (the total for last year was around 80 euro). The reason why I'm writing this post is to ask for donations to pay that bill (around 130 euro).

So, any donation to tdotreppe@aircrack-ng.org (paypal) is really welcome.

Website down

Unfortunatly, the website is down due to an error in traffic calculation.

We usually use 30-40Gbytes per day and we have 1200Gbytes of traffic per month, so enough for each month.
But the 14 and 15 April, their system say we use 688 and 884Gb (= more than 10Mbytes/sec for 24 hours) of traffic (so 20-30 times what we usually use) thus exceeding the allowed traffic per month.

I'm contacting them to try to fix it as soon as possible.

Edit:
Here is an update: http://aircrack-ng.blogspot.com/2009/04/paying-bill.html