The Dumbest Hack of the Year Exposed a Very Real Problem | WIRED

Overview

The Dumbest Hack of the Year Exposed a Very Real Problem

In the wee hours of the night last April, someone stopped at roughly 20 street intersections across Silicon Valley and launched an unprecedented cyberattack that would eventually spread to multiple states, embarrassing local officials and prompting them to question their security practices. Authorities suspect the unknown culprit took advantage of weak and publicly available default passwords to wirelessly upload custom recordings that played whenever a pedestrian pressed a crosswalk button.

Details

Instead of the normal recordings telling people to either wait or cross the street, pedestrians heard the spoofed voices of billionaire tech CEOs. A fake Mark Zuckerberg said at one Menlo Park intersection that people would not be able to stop AI from “forcefully” being inserted “into every facet of your conscious experience.” At another, he celebrated “undermining democracy.” At a different intersection, an altered Elon Musk described President Donald Trump as “actually really sweet and tender and loving,” while on a nearby street his faked voice whined about being “so alone.”

Government emails and text messages obtained by WIRED through public records requests show how the cities of Menlo Park, Redwood City, Palo Alto, and later Seattle and Denver scrambled to respond to the crosswalk button tampering. The communications, along with interviews with security experts and former employees of the button manufacturer, highlight how governments and the company had overlooked vulnerabilities in a widespread technology.

In Redwood City, then-city manager Melissa Diaz quizzed staff about who should be blamed for the incident. “We need to understand who should be accountable for the security of these systems and what we can do to hold either staff or the external responsible party accountable,” she wrote in an email to colleagues in the days after the hack.

Nick Mathiowdis, Redwood City’s current manager, tells WIRED that staff have been addressing the issue based on “lessons learned and evolving best practices,” but declines to share details to avoid encouraging further hacks.

Edward Fok, a veteran Federal Highway Administration cybersecurity official who briefly investigated the hacking before retiring as DOGE swept through the government, says cities need to do a better job ensuring that cybersecurity clauses are baked into contracts with suppliers and installers of technology, especially as AI tools and powerful sensors are increasingly integrated into transportation infrastructure.

Redwood City, for example, had contractually required its button installation and maintenance vendor to “use reasonable diligence and best judgment” at the time of the hack but had not specified anything about passwords or digital security.

In an unsigned statement to WIRED, the highway administration said that it previously issued a technical advisory outlining “security measures to make sure ideological idiots are not jeopardizing Americans' safety when utilizing our crosswalks."

The police investigation into the hacked buttons in Silicon Valley has run cold. Authorities couldn’t figure out who was behind the scheme because the buttons don’t track who uploads audio, and surveillance footage from the area wasn’t helpful, according to Redwood City police lieutenant Jeff Clements.

WIRED has made this article free for all to read because it is primarily based on reporting from Freedom of Information Act requests. Please consider subscribing to support our journalism.

Please consider subscribing to support our journalism

Greenville, Texas-based Polara Enterprises has been a leading supplier of crosswalk push buttons for decades. Some have the ability for cities to upload custom audioclips via Bluetooth to give pedestrians, including those who are blind or visually impaired, extra cues like the street and direction they are crossing.

Official online manuals and videos aimed at the thousands of technicians maintaining the buttons across the country describe how Bluetooth-enabled Polara models ship with a default password of “1234” and are configurable through a publicly available app. About eight months before last year’s button hacking spree, a physical security vlogger who goes by the name Deviant Ollam posted a You Tube video pointing out how easy it would be to tamper with the buttons. “I'm not encouraging anyone to try completely guessable passwords and upload their own content because, remember, that would be bad. That would probably be a crime or something. Talk to your lawyers,” he said in the video.

Ollam tells WIRED he hasn’t heard from the police or Polara. He credits the culprit for preserving the functionality of the buttons—it remained generally clear when it was safe to cross—though cities had to disable some of them until they could be resecured. “I personally consider this to be an ideal prank,” Ollam says. “They do not harm anyone. But they do capture people's attention and get the public talking about an important facet of society.”

Josh Little Sun, the chief technology officer of Synapse ITS, the company that now owns Polara, says the button hacks were the result of not the default passwords but instead installers using simple passwords that were shared too widely and not changed often enough.

Four former Synapse tech employees who spoke with WIRED say the company invests in making its products reliable but hasn’t prioritized security as much as it could. The buttons enjoy little competition and strong sales, so Synapse has dedicated only a small team to the product. “There isn’t a sufficient number of engineers. They have tight deadlines,” a former Synapse engineer claims. “And bosses don’t have far-sightedness to see all the possible problems that may occur in the future.”

Synapse’s Little Sun disputes the former employees’ characterization, saying that the company has expanded engineering investment in Polara products in recent years and that security is an ongoing focus. Since the hack, Synapse now requires stronger passwords and introduced additional verification steps for account changes and audio uploads. Unique default passwords or an additional PIN to further lock down buttons are under consideration.

“The security of these critical community assets is essential,” Litte Sun says of the buttons. “Synapse ITS remains firmly committed to the ongoing advancement of secure, accessible infrastructure that supports the safety and independence of all users.”

A few days after the tampering in Silicon Valley, Seattle became the next victim. The recording there spoofed Amazon founder Jeff Bezos. “Please, please don’t tax the rich,” it said. “Otherwise all the other billionaires will move to Florida too. Wouldn’t it be terrible if all the rich people left Seattle—or got Luigi’d—and then the normal people could afford to live here again?"

Abel Pacheco, Seattle’s transit operations division director, tells WIRED the city responded by giving each of its buttons a unique password. It also established a list with Polara of city employees authorized to get help, aiming to make it more difficult for someone to impersonate a city official to gain information about the buttons.

Fok, the former highway administration official, says he had hoped to issue a nationwide alert warning local agencies about vulnerabilities associated with the Polara buttons but didn’t get to it before retiring. While the incident made global headlines, some cities apparently didn’t hear about it.

Last month, someone tampered with newly installed buttons in Denver to play anti-Trump messages. The city’s Department of Transportation and Infrastructure said the default password had still been in place because the buttons were not meant to be operational yet. A staffer told the department’s executive director in a text message obtained by WIRED, “In the future we will immediately change the factory default password to our own or will make sure that they are not powered up until we are ready to go.”

In your inbox: WIRED's most ambitious, future-defining stories

Big Interview: Chris Hayes makes a living from attention

Livestream replay: Watch our experts discuss Big Tech and the military

Key Takeaways

The Dumbest Hack of the Year Exposed a Very Real Problem
In the wee hours of the night last April, someone stopped at roughly 20 street intersections across Silicon Valley and launched an unprecedented cyberattack that would eventually spread to multiple states, embarrassing local officials and prompting them to question their security practices
Instead of the normal recordings telling people to either wait or cross the street, pedestrians heard the spoofed voices of billionaire tech CEOs
Government emails and text messages obtained by WIRED through public records requests show how the cities of Menlo Park, Redwood City, Palo Alto, and later Seattle and Denver scrambled to respond to the crosswalk button tampering
In Redwood City, then-city manager Melissa Diaz quizzed staff about who should be blamed for the incident