As public transportation evolves, bus systems face new risks. Many systems still rely on older technology (outdated OT devices – such as standalone diagnostic tools), which wasn’t built to handle today’s complex cyber attacks. While modern buses use technologies like collision avoidance (ADAS) and dedicated short-range communications (DSRC) for vehicle-to-everything (V2X) and vehicle-to-infrastructure (V2I) communication to enhance safety and efficiency, some critical systems like telematics and vehicle control units (VCU) are often overlooked. This leaves them vulnerable to potential threats, highlighting the need for strong cyber security controls to protect the entire bus ecosystem.
Public Wi-Fi also presents a hidden danger. While offering convenience to passengers, Wi-Fi presents a potential cyber security risk. Public Wi-Fi networks are often vulnerable to attacks, allowing hackers to intercept data or inject malware into the system. In buses, this could mean that attackers gain access to onboard systems and compromise both passenger safety and privacy. Without strong encryption and security controls, Wi-Fi can become an easy entry point for cyber criminals, enabling them to steal personal data or intercept sensitive information.
Adding to the challenge, regulatory gaps and IoT security in transport lacks consistent global standards, leading to uneven protection. Regulatory gaps further amplify this issue, as different regions have different security requirements.
Another growing concern is supply chain attacks, where hackers compromise trusted software vendors to insert backdoors, creating hidden vulnerabilities within transportation systems. This highlights the crucial need for unified security standards and proactive monitoring to safeguard not just the technology, but the entire infrastructure against evolving cyber threats.
Attackers might also manipulate firmware in smart buses or even kiosks, causing data theft or service disruptions. Without a proactive security approach, public transport systems are exposed to many cyber threats. It’s important to tackle these risks early to prevent real-world problems. Incident examples are:
- Data breaches: Sensitive information, such as passenger data and payment details, can be targeted by cyber criminals, leading to identity theft and financial losses.
- Operational disruptions: Cyber attacks can disrupt essential services, causing delays and compromising passenger safety.
- Unauthorized Access: Weak security measures can allow attackers to infiltrate communication systems, leading to unauthorized control over critical functions, or even offer the option the manipulate the bus navigation system, leading to safety hazards.
Here a few real-world examples of incidents affecting bus systems:
- USA, Honolulu Oahu Transit Services (June 2024)
- Incident: A cyber attack caused outages in TheBus and Handi-Van systems managed by the Honolulu Department of Transportation Services.
- Impact: Disruption of online services, including GPS and Holo Card readers, led to financial losses as riders were not charged.
- USA, Virginia Greater Richmond Transit Company (GRTC) (February 2024)
- Incident: GRTC experienced a cyber security breach (ransomware), part of a series of attacks targeting public transit systems.
- Impact: The attack temporarily impacted certain applications and parts of the GRTC network. The breach highlighted vulnerabilities in public transportation cyber security, emphasizing the need for enhanced protective measures.
In addition, this article discusses a vulnerability in buses, due to insecure systems in their communication networks. Researchers found that these vehicles, equipped with devices like GPS, telematics and entertainment systems, could potentially be hacked, allowing attackers to access sensitive data or even take control of the vehicle. Vulnerable telematics gateways units (TGUs) were connected to the vehicles’ internal networks (CAN bus) over which attackers could potentially send malicious commands affecting critical functions like steering, braking, or transmission
Other possible dangerous scenarios:
- Traffic sensor manipulation: Unauthorized actors hijack traffic sensors to falsify data, resulting in altered traffic light sequences and route disruptions
- Bus fleet GPS tampering: Unauthorized access to IoT-based GPS devices on buses enables cyber criminals to modify routing data and and secretly track their locations
Figure 1: Modular gateway and applications platform. Image credit to Wavecom Technologies.
Figure 1: Modular gateway and applications platform. Image credit to Wavecom Technologies.
IoT gateway in buses | Gateway to security and safety
IoT gateways in buses are essential to keeping everything running smooth and safely. As buses get smarter, they connect to various services like telematics and ticketing systems, all of which need protection. These gateways act as the first line of defense, ensuring that communication between devices is safe and secure, without impact on the bus performance. They allow buses to function seamlessly while protecting passengers’ data and preventing hackers from accessing critical assets. Gateways safeguard crucial communication channels, such as GPS tracking and real-time data exchange from cyber attacks. Hardened gateways ensure buses maintain strong security without affecting performance, providing smooth, safe transit for passengers.
Cyber side of smart buses | Securing data on the go
Securing smart bus systems isn’t just about protecting data, it is about ensuring the safety and integrity of modern public transportation. To protect critical connections, gateways protecting the critical assets and its network connections, making them cyber resilient, follow industry best practices. These include implementing network segmentation, access controls based on the least privilege principle and adopting a Zero Trust approach. It is essential to enforce communication only with authorized assets, prioritize and segregate critical traffic, and maintain clear separation of duties between critical and non-critical systems.
Better together | How cyber security strengthens smart buses
Buses, as key components of smart city infrastructure, require robust cyber security to protect their systems from malicious attacks. If attackers can exploit vulnerabilities like OS command injection or file overwriting, they can disrupt the bus’s operation, steal data, or even take control of the vehicle. Via OS command injection a cyber criminal can manipulate a bus’s system to execute unauthorized operating system commands. This can occur through user inputs, like those from ticketing systems or onboard devices, allowing hackers to take control of the bus’s underlying systems. Once injected, malicious code can disrupt operations, steal data, or manipulate vehicle functions. It is a critical risk in smart buses, requiring strong security measures to prevent exploitation. Implementing security controls like OS command injection prevention ensures that no malicious code can exploit vulnerabilities and take control of the system. Check Point Quantum IoT Embedded – The Nano Agent offers this comprehensive security solution.
Preventive cyber security controls are essential to ensuring a bus maintains a strong security posture throughout its lifecycle. With continuously monitoring for vulnerabilities like OS command injection and file overwriting, these controls help secure the bus’s systems from early deployment to decommissioning. The bus’s security remains resilient with watchdog systems that monitor for irregularities, ensuring that operations run smoothly without interruptions – protecting both passengers and critical data from cyber threats.