Traffic Light Radio

You know that scene in the action movie where the stereotypical "hacker" character hacks into the city "traffic system" so the flights will favor their getaway?  Apparently that's totally possible. Actually It's so easy it's probably actually happened. This is something we all assumed was fiction that apparently could be accomplished by a 14-year old with an iPad.

Am I exaggerating?  Sadly no. While oldschool intersection lights one stood alone running on timers 24/7, modern units are "smarter." Modern systems have traffic sensors, multiple timing schedules, and can even receive data from systems at other intersections. All this input requires they be networked. Rather than build hard wired systems almost all traffic lights are run by a controller on a wireless switch. Most of them operate on in the ISM band at 900 MHz, 5.8 GHz, or in the 4.9 GHz band as allocated by the FCC for public safety. More here.

The problem is that most of these networks have no passwords and use no encryption. If you identify the frequency you can often send and receive data from the system. Identifying the signal requires a simple packet sniffer and a bit of logical deduction. To quote the now infamous paper by the Computer Science Department at U. of Michigan:

"The systems in question use a combination of 5.8GHz and 900MHz radios, depending on the conditions at each intersection (two intersections with a good line-of-sight to each other use 5.8GHz because of the higher data rate, for example, while two intersections separated by obstructions would use 900MHz). The 900MHz links use "a proprietary protocol with frequency hopping spread-spectrum (FHSS)," but the 5.8GHz version of the proprietary protocol isn’t terribly different from 802.11n."

A layperson might read that reference to 802.11n as encryption. That is not the case. It's a reference to IEEE 802.11n-2009, a common wireless MIMO networking standard. It can also use 16-QAM, 64-QAM, BPSK or QPSK modulation. The maximum ERP on these wireless radios is only about 4 watts but it's certainly feasible to connect to them by line-of-sight from down the block. The 5.8 GHz signals were particularly vulnerable. The Michigan study found none with any encryption and all had a readily accessible SSID. The 900 MHz radios had a 16-bit ID. That sounds like a lot but the maximum number of addresses possible with 16-bit integer is only 65,536. It may seem like a large number but a computer program can crack that in short order.

The logic for locking down your network is the same logic that leads you to lock your front door and your car. This problem here isn't mischievous hackers.. it's just a lack of foresight.

MIMO, MISO, SIMO and SISO

FM is old technology. AM radio is so outdated it might as well be smoke signals. I am reminded of that every time I see a newer more efficient data compression that gets us a sliver closer to Moores law. We are approaching Shannon's entropy (a theoretical top-end to data compression) and AM and FM are nowhere near it. Here is an array of acronyms that will come up in the new broadcasting. I'll start with the new and work backwards toward now.I'll start with MIMO. It sounds like a Iphone app but it ain't. It's a MIMO (Multiple Input and Multiple Output) system. MIMO has several subtypes including MIMO, MISO, SIMO and SISO. Amusingly it's pronounces my-mo or me-mo. My this is complicated. It's a set of ideas used in wireless communications. It was first conceived at Bell labs back in the mid 1970s, but the first production system wasn't launched until 2001. It's a multi-layer beamforming broadcast. let's stop there. New word, Beamforming:

noun, Beamforming is a signal processing technique used in sensor arrays for directional signal transmission or reception. This spatial selectivity is achieved by using adaptive or fixed receive/transmit beampatterns. The improvement compared with an omnidirectional reception/transmission is known as the receive/transmit gain.

"Beamforming" uses interference to shape directionality of the signal. When transmitting, a beamformer controls the phase and relative amplitude of the signal at each transmitter, in order to create a pattern of constructive and destructive interference in the wavefront. Information received at different sensors is combined in such a way that the expected pattern of radiation is interpreted optimally . This way signals from multiple transmitters can be timed to arrive simultaneously or at known times to return in a planned series, what we call spatial multiplexing. Instead of just spitting out a signal equally in every direction with equal power to be received at-will, MIMO shapes and manipulates it's contour to create a known quantity in reception.

SIMO is a multiple antenna technique. It stands for Single Input Multiple Output. The system uses a single antenna at the transmitter but multiple antennas at the receiver. The receiver can select whichever antenna receives the optimal signal or combine received signals to created the best result possible. It's called switch diversity. More here.

MISO is a system that uses multiple antennas at the transmitter and a single antenna at the receiver. Appropriately the acronym stands for Multiple Input Single Output. It uses Space Time Coding (STC) at the transmitter to transmit signals by two antennas at two different times consecutively. It's all still received at the single receiving antenna that can parse, combine or select between the two signals for lowest noise, and best signal.

SISO is conceptually easier to grasp. SISO stands for Single Input Single Output. It's what we do now. The transmitter and the receiver have one RF chain, as they call it. It's cheap and simple and it works... but it ain't perfect.