Maker of US border's license-plate scanning tech ransacked by hacker

https://www.theregister.co.uk/2019/05/23/perceptics_hacked_license_plate_recognition/

by prostoalex • 7 years ago

235 99 7 years ago

theregister.co.uk

module00003• 7 years ago

Good job vetting your vendors Uncle Sam! Somehow, we'll end up paying (taxpayers) to clean this up - just like we paid to deploy it. Sure would be nice if we had any voice/vote in these things...

azinman2• 7 years ago

You think people voting on vendors would somehow result in less data leaks?

module00003• 7 years ago

It would result in us not approving the project/vendor at all.

edit: We(citizens) don't like being spied on, and it just rubs salt in the wound that we have to pay for it.

wbronitsky2• 7 years ago

If you are a citizen and have not been disenfranchised, and I grant you that many fall outside of these buckets, you absolutely have a say. That say is that you can elect whomever you want to decide these things for you. It is the central mechanism in a representative democracy.

inetknght• 7 years ago

...and then the person we voted for doesn't win the election and the person who does win the election doesn't listen to the citizens they're supposed to represent.

pingucrimson• 7 years ago

Re representative democracies, why are opinions on disparate issues like the economy, abortion, climate change, etc. all packaged into one party? At least 99% of people won't find a party that agrees with them on every single issue, so it feels like there should be a better system.

drewmol2• 7 years ago

Unfortunately, in the US, we've allowed our representatives to enact a hard cap on the number of representatives. So the representative you elect decides these thing for an increasingly larger number of citizens as population increases. So while you have a say, the weight of that say on choosing a representative is ever decreasing.

jorblumesea2• 7 years ago

This is a flawed viewpoint. The idea that any single company can stand up to a nation state is absurd. The level of resources that Russia or China brings to bear for a single hack is far beyond what any company or even groups of companies could defend against.

This is the unfortunate weakness of the Western style democracies in the face of totalitarian states. We have a much more obvious divide between private and public entities. In China and Russia, the lines are blurred and often they get much better support from the government to defend and hack the opposition. Even to the point where China will hack US companies and just give the IP to Chinese companies.

DogRunner2• 7 years ago

Even to the point where China will hack US companies and just give the IP to Chinese companies.

You can be sure that the USA is giving the "acquired" IP to their us companies as well.

UncleSam• 7 years ago

I try my best!

glitcher• 7 years ago

The files also include .mp3 files, presumably from someone's desktop or laptop PC. Among the songs: Superstition, by Stevie Wonder, and Wannabe by Spice Girls, and a variety of AC/DC and Cat Stevens songs.

Quite an odd detail to add to the article, why was this seen as relevant?

kabwj• 7 years ago

Reminds me of when they reported on the contents of the hard drive of Bin Laden.

Isamu• 7 years ago

He was a Spice Girls fan?

sct202• 7 years ago

It humanizes the victim from computer hard drive hacked to this is a person with quirks who you could know.

DogRunner2• 7 years ago

And let everybody know: hey again it's a Windows desktop system in a critical environment and surely everything else is Windows based products.

rdiddly• 7 years ago

Also allows me to do some musical profiling. This identifies them as probably a GenXer or so. Because you would've had to be between about 15 and 25 to like the Spice Girls in 1997, let's say up to 30 y.o. to keep their MP3 ironically and/or nostalgically. And I'm claiming there's no way in hell you would've "discovered" them later, so that's a 15-year age range, birth years bounded 1967-1982, current ages 37-52.

Stevie Wonder and Cat Stevens tend to push it more toward the older end of that range.

AC/DC correlates with that entire cohort, so doesn't provide any additional or contradictory information. Unless we knew whether it was Bon Scott era or Brian Johnson, heh heh.

Expected age 46 ± 5.

dev_dull• 7 years ago

Are they worth it as a target? With an RPI and openalpr I can easily build my own license plate reader in one evening. This technology is so far out of the bag already.

I’m critical of people like me (millennial, working in tech) and I think I have good reason. I hear so many bizarre technological “solutions” to what are ultimately policy issues. If we spent half that time instead lobbying our representatives we would be in a much better place as a society. Can you name your state rep? How about you write them a little today rather than succumb to cynicism or spitballing tech.

ttul• 7 years ago

Perceptics is a pretty big player in the license plate camera market. This breach is extremely embarrassing for them and will doubtless put their future work with government in jeopardy as they become a political target. I wonder if this hack was perpetrated by China as retribution for the Huawei blockade? The Chinese perhaps have an arsenal of such breaches ready for release when the right politician needs a nudge.

jermaustin1• 7 years ago

Reading the license plate is trivial, its processing, and doing the advanced queries that make ALPR solutions real.

Sure you could create a bunch of pi cams able to handle a few reads per second, but then say you want to know what plates have traveled with your target plate between multiple camera sets to see if someone is being followed, or you have cell phone pings and want to search all cameras in the radius of that tower for a plate.

The reading isn't hard, its fully solved, the economical and real-time searching of plates and evidence compilation is the much harder problem.

bredren5• 7 years ago

It’s true. There is also a lot of data cleaning and grouping to do. Building sighting histories gets computationally intensive with scale.

xrd• 7 years ago

Isn't the article stating that the hackers are posting the actual license plate scans of people crossing the border? That seems like a big deal to me.

jstarfish• 7 years ago

I hear so many bizarre technological “solutions” to what are ultimately policy issues.

Tech is empowering, much moreso than playing politics.

Consider something like the Kafkaesque nightmare that is applying for (and keeping) food stamps. It doesn't need to be complicated (nor should it be!), but you can either try to convince elected officials to make the poor a priority and fix the process or roll up your sleeves and write a script to complete the forms in triplicate, generate mailing labels with delivery confirmation, remind users of deadlines and pull phone records to prove the social worker never called like they said they did in the denial letter.

Or you could petition, harass, bribe and cajole your way into enacting change, and have it all overturned with a change in administration.

In some part these technical solutions exist to fix people problems. Look at the internet itself-- where problems exist (a country's politicians/dictator makes the nation unroutable), you don't wait for a coup, you route around it.

But also in some part these solutions are just modern rent-seeking, so...

kortilla• 7 years ago

you don't wait for a coup, you route around it.

No, we’re still waiting for a coup in China, North Korea, and on and on for the citizens to access the internet.

rarecoil• 7 years ago

Or you could petition, harass, bribe and cajole your way into enacting change, and have it all overturned with a change in administration.

This is the reason why technological solutions are popular among the Silicon Valley crowd. No matter what, political solutions are plagued by human emotion and self-interest, and thus they become sticky, "corrupt", and slow. Technological solutions are subversive of that structure at the least, and a force multiplier in others.

The computer will generally do what you tell it to do. You can spend hours of effort on something and get a deterministic result that will do the thing. You can spend your whole life in politics and get nothing out of it because the entrenched power structures won't let it happen.

bobthepanda• 7 years ago

More technology to process forms just enables the bureaucracy to create more forms, in the same way that computer programs have gotten more fat off of the increased power and capability of modern devices. It makes the process shitty for everybody else who don't want to pay for, can't pay for, or aren't covered by the nifty tech. Exhibit A being TurboTax.

Technology is a band-aid, not a solution, and technology can also be used to make progress towards solving the problem decay, or actively worse.

JohnFen• 7 years ago

Consider something like the Kafkaesque nightmare that is applying for (and keeping) food stamps.

I have long thought that this particular process was intentionally difficult as a means of helping to weed out people who aren't really in need.

zelon88• 7 years ago

I think the reason why this is significant is not so much that the proprietary files were leaked, rather the amount and breadth of personal information exposed along with the insinuation that this company's network (who maintains large amounts of personal data of unwitting participants) is not secure.

I bet a little digging and we will discover that this network was hopelessly undefended and their software is horribly riddled with holes and poor security practices.

It was obviously done to impact the company as an entity rather than to target individuals or the government. It's quite obvious, to me, that the attackers wanted to dump a large liability in someones lap and perhaps for good reason. If this company can't secure the data it collects about innocent civilians then it shouldn't be allowed to collect it.

skybrian• 7 years ago

Politics is about convincing as many people as possible to vote your way, and to make a big difference, you have to do it at scale. Changing people's minds is hard. Much like sales, it also has downsides like making a pest of yourself.

It's important, but I am a bit frustrated by shallow encouragement that makes politics sound like it's easy. It's like saying "get a job" rather than providing actually helpful resources and training to find a job.

gumby2• 7 years ago

Are they worth it as a target? ... This technology is so far out of the bag already.

The point is that if you have access to their systems you can affect what is reported. For example you could add a bogus plate to the data stream, or remove one, or perform a substitution. I think we can all imagine cases were doing such a thing might be useful to someone.

Others have also pointed out that it’s possible that this company has some particularly interesting recognition technology, but I agree with you that this is really a second order issue.

adossi• 7 years ago

I was thinking that if you can see the logic behind their license plate recognition algorithm you can engineer modifications to license plates that would make them unrecognizable by the police. For example, adding a weird black square on a few of the numbers that look fine to the naked eye but for whatever reason screw their scanners up.

threatofrain• 7 years ago

How does lobbying work? Is it backed by some kind of power other than the eager generosity to provide free policy consultation?

anigbrowl• 7 years ago

What makes you think the object of the attack was to duplicate their technology?

craftinator• 7 years ago

I would be more interested in the security implications. Hackers now have access to the source code; what kind of attack surfaces does this yield against customers who purchased the compromised software?

8note• 7 years ago

if you have the ML that parses the plates, you could make adversarial plates that it couldn't find

module00003• 7 years ago

> Can you name your state rep? How about you write them a little today rather than succumb to cynicism or spitballing tech.

Yes I can name (all) of my state's representatives. No I'm not going to write them. Your letter and sending information get filed under an equivalent of "dissenters". That's kind of the entire point here.

atemerev6• 7 years ago

Looks like Russians (disclaimer: am Russian, work in infosec).

Some previous hacks that were attributed to Russians, like Shadow Broker leak, actually were executed by somebody else, I think. This one is more suspicious, in my opinion.

Cakez0r• 7 years ago

... Based on?

atemerev6• 7 years ago

"Boris Bullet-Dodger" is a Russian joke name, «Борис-хрен-попадёшь» (and it is rare enough to be picked up by somebody who is not Russian). Repacking everything in rars in 2019 is also a Russian thing. If you are interested why I think Shadow Broker was not of Russian origin (as opposed to Guccifer 2.0, who was), I can also provide my insights.

The choice of the venue to leak the information and some other minor details lead me to strongly suspect one of our state-sponsored APTs.

sschueller• 7 years ago

Wouldn't the first thing a good hacker would do is to make sure he doesn't get cought? A good start would be to make it look like someone else did it, especially a entity that can't be checked or would cooperate to catch the actual hacker like the Russians or Chinese.

mirimir2• 7 years ago

Yes, that's standard practice. Even hobbyists like me do it.

Also, any good hacker would be sure to leave behind multiple access paths. But maybe a professional hacker would refrain from dumping stuff, because that alerts the target. So the dump implies that they're not very professional.

throw2016• 7 years ago

This is dystopia, but this is not just any dystopia, this is dystopia with 'justification', this dystopia is 'legal' and for many that word somehow makes everything ok, but for the rest of us trivializes everthing of value.

There is so much cognitive dissonance and denial in the tech community and their role not just in building but also defending and whitewashing narratives that its becomes difficult to see movies and read about surveillance dystopia and be expected to feel creeped out and then return to current reality where its sort of normalized and ok.

nikisweeting• 7 years ago

Were logs of license plate scans leaked, if so, is there anywhere we can find the dump to see if our plates are in it?

canada_dry• 7 years ago

Related to this, I'd love to see some in-depth wire brushing done on how the US got blanketed with 4 way cameras at every intersection and how this data is used/kept, and by whom.

I first noticed it in major centers years back, but now it seems even small towns have cameras at every intersection.

From an IT perspective it's a pretty interesting project, but from a tin-foil-hat perspective it's astonishing when you imagine the ability to link all these cameras together in real-time.

LeifCarrotson• 7 years ago

We have them all over the place in Michigan. I specifically asked my friend who's a civil engineer with the county road commision when some were being installed just down the road from my house why they were being added. I was personally concerned at the prospect of red light cameras, which are currently banned in the state.

The explanation was that they were updating the stoplight controls. One of the inductive sensors in the road had failed, and it was cheaper to have a guy in a bucket truck stick a couple cameras on the pole than to rip up the road. The cameras are used to see the volume of vehicles in each lane and dynamically adjust light timings. And since I drive through the intersection multiple times a day, I have noticed an improvement. They skip the left turn sequence if no one is waiting, and rarely have a big backup when volume is high in one direction for the commute. Also, the left turn timer used to be very short (like 2 cars making it through on green, one on yellow, and the 4th car often took control and went on red), which was nice when there was only one car and you wanted to go straight, but annoying when you were one of 6 or 7 cars in line and an extra five seconds would let everyone make the turn but instead you had to wait through multiple light cycles. Now it seems to often hold the turn cycle long enough to let the whole line empty out.

But I totally agree that the idea of a soft update to either issue red light tickets or track license plate activity is extremely concerning. Might end up with a stray paintball from my backyard accidentally hitting the lens if they make that a policy change.

Shivetya• 7 years ago

Camera control of lights is a blessing for many motorcyclist, there are just some lights that will not trip. Plus like the guy told you, it is far cheaper. Plus I know in Atlanta they use the cameras to adjust timing and such and did show improvements.

if there is no retention, or a press here to save last five minutes in case they witness an accident that would be good

24bug47• 7 years ago

Sometimes I ask people about the cameras and the white boxes (those ubiquitous white boxes on poles, often solar-powered, along highways pointing perpendicular to moving traffic). I ask what they think - who put them up, what data they collect, where that data goes. I am routinely met with blank stares and "I don't know what you're talking about". It baffles me.

BurningFrog• 7 years ago

My 2016 car came with three cameras. My phone has two.

Cameras are already everywhere. As they become even more dirt cheap, that will only hyper-increase, even if governments somehow completely stays out of it.

Sometimes you enter into a new technological era, and you have to accept that things have changed.

blibble• 7 years ago

so it's probably some off the shelf ANPR tech that sends info into a database?

same as my local supermarket's car park?

Maker of US border's license-plate scanning tech ransacked by hacker

Related Stories