Hackers can play with construction cranes like toys

At a construction site, big equipment sometimes looks like big toys.

Researchers say cyber attackers can indeed take over some construction cranes  — and play with them in a very destructive way.

Watch here:

Locking the Doors

You’d like your garage door opener to be secure so bad guys don’t get inside your house.

Now, we find out that your garage door opener may be more secure than the remote controllers that run some of the big construction cranes.

And that could be a big problem.

Researchers at cybersecurity company Trend Micro showed how attackers can hack some crane controllers at the S4x19 security conference in Miami this week.

Hacking Cranes

Trend Micro’s Stephen Hilt said a hacker could use a device as small as a wrist watch to move the crane up, down, and side-to-side.

“Any and every possible direction that they’re configured,” he told Archer News. “In our white paper, we talk about how a garage door opener has more security than these things.”

“There’s definitely some serious concerns that we have,” said fellow researcher Jonathan Andersson.

How it Works

The remote controllers use radio signals to operate cranes, hoists at factories and ports, and other big machines.

The researchers found that a determined hacker could play radio signals that would tell the crane what to do.

Andersson compared the hack to a bad guy using a recording of your voice to fool someone on the phone.

“I might be able to trick them into thinking it’s you, right?” he explained to Archer News in Miami. “This is kind of exactly how it works. I would record the radio signal and play it back and trick the crane into doing what I want.”

Emergency Stop

The person running the crane might try to hit the emergency stop button.

But the research shows a bad guy could override it.

It’s not unlike a situation where two people with two remotes are fighting over which channel to watch on a television, Andersson said.

But a real fight over a 200-hundred-foot crane could be more damaging.

What are the odds?

Chances of this kind of attack are low right now.

But the consequences could be destructive.

“You’ve seen these kinds of cranes that are used to construct tall buildings. You can imagine what happens if one of them would collapse or if something would go wrong. It would create lots of problems,” Andersson said.

“It’s dangerous enough to operate a crane,” he added. “Whether it’s environmental conditions, like weather or rain and situations like that, without having to worry about digital hackers and things. But, unfortunately, we live in this world where these things have to be considered.”

Who Would Try It?

The attacker might be a competitor who wants to slow down another company’s work, or an attacker who wants to cause big-scale damage.

Or someone who simply wants to play with big toys.

A 14-year-old in Poland hacked the tram system in Lodz, Poland, in 2008, using a modified television remote control to run the trams on his own.

“He treated it like any other schoolboy might a giant train set, but it was lucky nobody was killed,” said Lodz police spokesperson Miroslaw Micor, according to The Register. “Four trams were derailed, and others had to make emergency stops that left passengers hurt. He clearly did not think about the consequences of his actions.”

Fixes

The researchers said they contacted crane makers and worked with them to create updates so people using cranes can patch and protect their systems.

They’re going public now so anyone with a crane will know they may be vulnerable — and there is a solution.

Andersson warned, however, that these kinds of controllers — and these kinds of security holes — may still out there in many things, from tow trucks to mining equipment.

And someday an attacker may decide to use them.

“You might purchase a piece of radio equipment or piece of technology and just kind of make the assumption that it should be secure,” Andersson said. “That’s not always the case. And I think, especially with things that are used in safety critical environments, we need to take a closer look at these things.”

Main image: Enrique Lopez