Silicon Valley Crosswalk Buttons Hacked in Unprecedented Cyberattack In April, an unknown attacker targeted roughly 20 street intersections across Silicon Valley, exploiting weak default passwords on wireless crosswalk buttons to replace standard pedestrian alerts with spoofed recordings of tech CEOs. At a Menlo Park intersection, a fake Mark Zuckerberg warned of AI’s inevitable dominance, while another clip mocked democracy. Nearby, an altered Elon Musk voice made bizarre claims about former President Donald Trump and personal loneliness. The hack, which later spread to Seattle and Denver, exposed glaring security oversights in municipal infrastructure. Emails obtained by WIRED reveal city officials in Menlo Park, Redwood City, and Palo Alto scrambling to respond, with Redwood City’s then-manager demanding accountability for the lapse. The city’s vendor contract lacked explicit cybersecurity requirements, despite the buttons’ Bluetooth-enabled customization features. Polara Enterprises, a major supplier of these buttons, ships models with a default password of “1234” and provides public documentation for their configuration app. Months before the attack, a security researcher had demonstrated the vulnerability in a YouTube video, though authorities have yet to identify the perpetrator. Surveillance footage and the buttons’ lack of user tracking left the investigation at a dead end. The incident prompted federal scrutiny, with a retired Federal Highway Administration official emphasizing the need for stronger cybersecurity clauses in municipal contracts. The agency had previously issued advisories on securing crosswalk systems, but enforcement remains inconsistent. The hack underscores the risks of overlooked vulnerabilities in critical urban infrastructure.