Sources and notes

By Eldad Matityahu · Published October 13, 2026

Source notes reproduced from the book, dated October 12, 2026.

OPENING AND CHAPTER 2

1. NIST National Vulnerability Database, CVE-2024-38944, published July 22, 2024. Unauthenticated remote access to a traffic controller's web interface. nvd.nist.gov Read source

2. TechSpot, "Traffic light vulnerability could let hackers cause massive gridlocks, study finds," July 19, 2024. Around 30 exposed controllers found; the maker said the affected controllers had not been produced for almost 10 years and asked customers to reach out for guidance. techspot.com Read source

3. Exploit Database, entry 52151, April 9, 2025. Public write-up of the attack, including changing light sequences and forcing four-way flash. exploit-db.com Read source

4. Ghena, Beyer, Hillaker, Pevarnek and Halderman, "Green Lights Forever: Analyzing the Security of Traffic Infrastructure," USENIX Workshop on Offensive Technologies, 2014. Road agency with just under 100 signals; unencrypted radios; default credentials; remote light control demonstrated with the agency's cooperation; safety unit blocks conflicting greens but can be tripped remotely and needs a manual reset. usenix.org Read source

CHAPTER 1

5. Same paper as note 4, section 2, for the parts of a traffic cabinet: controller, switch, radio, camera, detection and malfunction management unit. Read source

CHAPTER 3

6. The Register, report on the charges, January 10, 2007. Charges, the supervisor login, and the four intersections. theregister.com

7. Planetizen, summarizing the Los Angeles Times, November 6, 2008. Guilty pleas to a felony count; four days to restore the system. planetizen.com Read source

CHAPTER 7

8. Observed story: a NetOps IQ pilot at a live water site, simulated attack. Details confirmed by NetOps IQ's CTO. Customer details withheld.

CHAPTERS 5, 7 AND 8 (Findavi CAPABILITIES)

9. NetOps IQ, Findavi platform page: on-site appliance, AI on the box, supported actions, Observe, Approve and Autonomous modes, separate security and service checks. Settings restore and the cabinet sensor confirmed by NetOps IQ's CTO, October 2026. netopsiq.com Read source

Photography in the PDF

Illustrative photographs. They do not show the reported attacks, Main and 5th, or a Findavi customer deployment. No endorsement is implied.

Blue Ox Studio / Pexels

Kuan-yu Huang / Pexels

Paul Lichtblau / Pexels

Jack Gittoes / Pexels

Yura Forrat / Pexels

Kateryna Hnidash / Pexels

Source notes · Read the PDF · Book contents

Request an assessment