A couple of Italian engineers have worked out how the RDS (Radio Data System) alert system works on car radios, and have developed a short-range radio system to transmit fake traffic alerts within a one mile radius.
What's interesting about this hack is that the pair claim to have built their system using cheap, off-the-shelf hardware.
Showing off their system at the CanSecWest security event last month, one of the engineers, Andrea Barisani, chief security engineer with Inverse Path, an IT security firm, said that the system can create false alerts for queues, bad weather, full car parks, overcrowded service areas, accidents and roadworks.
"Traffic information displayed on satellite navigation systems is trusted by drivers. Normal people do not think that you can do nasty things," he said.
According to Canadian newswire reports, Barisani and hardware hacker Daniele Bianco discovered that the system used by many navigation systems, and not just RDS-enabled car radios, uses no encryption.
The data is sent using the Traffic Message Channel (TMC) of the RDS, with each traffic incident sent as an unsigned TMC message that consists of an event code, location code and time details.
The system is used throughout Europe, including the UK, as well as North America and Australia.
Interestingly, the Italian pair say they have discovered a little-used set of TMC/RDS codes for use in emergencies, including air raids, bomb alerts, air crashes and terrorist incidents...