Denver crosswalks hacked to transmit vulgar anti-Trump messaging

Denver's Department of Transportation and Infrastructure confirmed two crosswalk locations were hacked along East Colfax Avenue, broadcasting vulgar anti-Trump messaging. Although fixed, it was the talk of the neighborhood over the weekend. 

"I was surprised," said Damian Meldgaard, who lives nearby. "I had to gather myself and think, 'Did I really hear that?' And, then, I was enamored. I loved it. It made my day. It was absolutely what I needed to hear."

Although the messages are too inappropriate to share, people in the community didn't seem to mind it. 

"I kind of wanted my own recording, just for my own personal sense of self satisfaction or satisfaction," Melgaard added.

As far as how it happened, DOTI says the crosswalk push-buttons were newly installed and still bagged with their factory setting. 

"That included a default password that we now have learned is easy to find online," a spokesperson told CBS Colorado. "These push-buttons weren't meant to be operational yet, but just recently got power." 

"This happens a lot," said Daniel Pittman, an expert in cybersecurity with Metropolitan State University of Denver. "When you look at construction working signs, the ones who put the messages on, I'm sure you've seen internet memes about people that have put their own messages on them and stuff like that. And it always comes down to weak credentials, default credentials, and they're publicly available."

Pittman says it wouldn't be difficult for a hacker to find the default credentials or the audio signals or any other electronic device such as Ring cameras and baby monitors. There are even websites that look for devices that have default credentials. 

"They find ring doorbells," Pittman said. "They find all of these things that have these default credentials that, maybe, unintentionally, were made accessible to the internet through this configuration, or whatever it is, databases, whole thing, and this is a constant problem we've known about for decades."

In the end, it only takes one try. 

"We have to always make sure all of our defenses are in place," Pittman added. We have everything locked down. We have to be perfect. But the bad guy only has to be right once."

DOTI says the passwords have since been changed and it doesn't expect a repeat situation at those locations.