All hackers need to compromise traffic lights is a laptop and a radio connected to it, with researchers able to alter traffic lights from a vehicle.
The traffic light controllers often aren't encrypted and have default usernames and passwords that are posted online. The traffic light controllers are linked by an induction loop that is hidden underground, with cameras able to provide traffic light colors to the controller. It only takes a minimal amount of research before hackers are essentially given the blueprints.
"There's an assumption that these devices are secure," said Branden Ghena, University of Michigan computer science PhD student and study lead researcher. "We all just trust them so much. This is critical infrastructure. We were shocked that was going on."
It's important for companies and utility companies to change passwords, if not disable default usernames, in an effort to offer boosted security. If cybercriminals compromised the light system or disabled the malfunction management unit (MMU), it'd give them the opportunity to change the lights to unsafe traffic patterns.