6 ms·

Incredibly cool. How could they possibly think they could just put the stored value on the card itself, unencrypted? I always assumed the card was just a token

Incredibly cool. How could they possibly think they could just put the stored value on the card itself, unencrypted? I always assumed the card was just a token that refreshed some database on their end, instead of stupidly storing it in hex right there on the card stripe.

pius 18y ago
Smartcard security is notoriously bad in the vast majority of deployed systems. The people designing these high human traffic systems are usually much more concerned about other factors (low latency at the turnstile, minimal number of network connections to wire, card reliability, etc.) than they are about security.
- jrockway 18y ago
  Sometimes I wonder why they even bother collecting fares. Fares rarely cover the cost, so paying money to develop an expensive fare collection system that's easily hackable doesn't make much sense. Oh well, at least the politicians can give their contractor buddies my money!
  - stcredzero 18y ago
    There needs to be good standards program for security audits. There is a serious problem, because security is not well understood. It's very easy to sell the government and private organizations a shoddy set of goods. What about institutionalizing white hat hacking, somehow? I could imagine a system where two competing tiger teams ensure good results. Basically, pay bonuses for actually breaking the security measures. If only one team succeeds in breaking in, then they get both team's bonus.
  - krschultz 18y ago
    Well not sure about what part of the world you are in, but here in Manhattan the MTA subway system pays for itself. Only about 4-5% of their operating budget comes from taxes, with the remainder coming from fares. A serious vulnerability would crush their budget. I can just imagine going into some back room to buy a $1,000 metro card for $5. However I can't imagine many people really bothering, an unlimited card is only $81 a month. When rent is $2500 a one bedroom apartment in brooklyn, and lunch is $15 every day, $81 for all of your transportation really isn't a big deal. Excellent hack though.
    - andr 18y ago
      MBTA, the system they hacked, is notoriously inefficient. Apart from fares, they get 20% of state sales tax, or 1 cent of every dollar you spend in the state, even if you don't live in a place that has a train station. The new (electronic) fare system was introduced about 18 months ago and was accompanied by a fare raise from 1.25 to 2.00/1.75, and one of the major reasons quoted was the cost of the new system.
    - thomasmallen 18y ago
      You guys are so lucky. Here in DC, we have the second-highest ridership in the country, and somehow these nincompoops can't get the system to pay for itself. Never mind that we don't have month passes like in most normal cities, and that somebody who regularly rides the Metro will easily spend in excess of $200, even $300 per month. Thanks for hiking fares again, guys! And the number of cars, stations, and miles of track almost certainly pale in comparison to those in New York. Hell, I pay $140/month to take the Orange line two stops west and a flat-fee bus to its second stop on the route. And people wonder why we have such awful traffic: Driving is often cheaper!
    - GavinB 18y ago
      ". . . lunch is $15 every day . . ." Get some bread and make a sandwich, already!
      - gaius 18y ago
        Haha, half the apartments in Manhattan barely even have kitchens!
- angstrom 18y ago
  Agreed. The cost of implementing such an open system is negligible compared to the cost of securing it. You can harden a system as much as you want, but the business case for doing so is nil until it becomes a problem. At 0.000000003 of rides are being stolen it doesn't make sense. While the security tzars are focused on the electronic hackers just having fun the majority of losses are probably coming from kids who jump the turn styles or go through 2 at a time.
  - stcredzero 18y ago
    Doesn't this apply more to the vendor and less to the customer? The vendor can sell a system and skimp on the added cost of security. If they are good at managing the account and spinning the situation, when security issues do come up, they have a chance to sell the customer an entirely new system. The customer is probably better off with a spec for proper security in the first place, so they can avoid the cost of refitting or replacing the entire system.
pmorici 18y ago
If you are referring to "they" the MBTA I doubt they knew how it worked and the only party who probably did understand ie: the company selling them the system was just interested in keeping costs down.
brent 18y ago
Exactly. The fact that I assumed this was the case was enough to prevent me checking. I assume this to be the case with most hacker types. So, is this security through stupidity?
vecter 18y ago
I think maintaining consistent state over all turnstiles at all stations is too complicated. It requires a large infrastructure overhead. Putting the stored value on the card is much simpler and doesn't require nearly as much overhead b/c it allows each turnstile to be an independent unit that reads and writes the card.
- Retric 18y ago
  I don't think the data changes all that fast assume 5billion cards at 10bytes a user it's ~500MB per station. Assuming 2million transactions an hour your talking about ~40megabytes of data an hour DSL would be fast enough. Now each station would keep a local copy the Database and transmit to the 30 or so other stations as long as they send data before you can reach the next station it should work just fine. Granted 10 years ago storing value on each card would have been more useful but the turn styles should easily be able to handle the full database.
  - vecter 18y ago
    I'm not saying it's not doable, I'm just saying it's more complicated (and probably much more expensive) than the alternative. It also makes individual turnstile failures more difficult to handle. Suppose the network died on one of the turnstiles. Then you'd have to have build a caching system that it resorts to in case of network failures to prevent giving people free rides, and a way to merge state with the rest of the network once it rejoined. Of course you can do it, but I hope you're starting to see how complexity could grow faster than one might expect. I imagine that there are better ways to solve the problem at hand (security) that don't involve adding thousands of lines of code, miles of fiber, and hundreds of thousands of dollars.

pius 18y ago

Smartcard security is notoriously bad in the vast majority of deployed systems. The people designing these high human traffic systems are usually much more concerned about other factors (low latency at the turnstile, minimal number of network connections to wire, card reliability, etc.) than they are about security.

jrockway 18y ago
Sometimes I wonder why they even bother collecting fares. Fares rarely cover the cost, so paying money to develop an expensive fare collection system that's easily hackable doesn't make much sense. Oh well, at least the politicians can give their contractor buddies my money!
- stcredzero 18y ago
  There needs to be good standards program for security audits. There is a serious problem, because security is not well understood. It's very easy to sell the government and private organizations a shoddy set of goods. What about institutionalizing white hat hacking, somehow? I could imagine a system where two competing tiger teams ensure good results. Basically, pay bonuses for actually breaking the security measures. If only one team succeeds in breaking in, then they get both team's bonus.
- krschultz 18y ago
  Well not sure about what part of the world you are in, but here in Manhattan the MTA subway system pays for itself. Only about 4-5% of their operating budget comes from taxes, with the remainder coming from fares. A serious vulnerability would crush their budget. I can just imagine going into some back room to buy a $1,000 metro card for $5. However I can't imagine many people really bothering, an unlimited card is only $81 a month. When rent is $2500 a one bedroom apartment in brooklyn, and lunch is $15 every day, $81 for all of your transportation really isn't a big deal. Excellent hack though.
  - andr 18y ago
    MBTA, the system they hacked, is notoriously inefficient. Apart from fares, they get 20% of state sales tax, or 1 cent of every dollar you spend in the state, even if you don't live in a place that has a train station. The new (electronic) fare system was introduced about 18 months ago and was accompanied by a fare raise from 1.25 to 2.00/1.75, and one of the major reasons quoted was the cost of the new system.
  - thomasmallen 18y ago
    You guys are so lucky. Here in DC, we have the second-highest ridership in the country, and somehow these nincompoops can't get the system to pay for itself. Never mind that we don't have month passes like in most normal cities, and that somebody who regularly rides the Metro will easily spend in excess of $200, even $300 per month. Thanks for hiking fares again, guys! And the number of cars, stations, and miles of track almost certainly pale in comparison to those in New York. Hell, I pay $140/month to take the Orange line two stops west and a flat-fee bus to its second stop on the route. And people wonder why we have such awful traffic: Driving is often cheaper!
  - GavinB 18y ago
    ". . . lunch is $15 every day . . ." Get some bread and make a sandwich, already!
    - gaius 18y ago
      Haha, half the apartments in Manhattan barely even have kitchens!
angstrom 18y ago
Agreed. The cost of implementing such an open system is negligible compared to the cost of securing it. You can harden a system as much as you want, but the business case for doing so is nil until it becomes a problem. At 0.000000003 of rides are being stolen it doesn't make sense. While the security tzars are focused on the electronic hackers just having fun the majority of losses are probably coming from kids who jump the turn styles or go through 2 at a time.
- stcredzero 18y ago
  Doesn't this apply more to the vendor and less to the customer? The vendor can sell a system and skimp on the added cost of security. If they are good at managing the account and spinning the situation, when security issues do come up, they have a chance to sell the customer an entirely new system. The customer is probably better off with a spec for proper security in the first place, so they can avoid the cost of refitting or replacing the entire system.

pmorici 18y ago

If you are referring to "they" the MBTA I doubt they knew how it worked and the only party who probably did understand ie: the company selling them the system was just interested in keeping costs down.

brent 18y ago

Exactly. The fact that I assumed this was the case was enough to prevent me checking. I assume this to be the case with most hacker types. So, is this security through stupidity?

vecter 18y ago

I think maintaining consistent state over all turnstiles at all stations is too complicated. It requires a large infrastructure overhead. Putting the stored value on the card is much simpler and doesn't require nearly as much overhead b/c it allows each turnstile to be an independent unit that reads and writes the card.

Retric 18y ago
I don't think the data changes all that fast assume 5billion cards at 10bytes a user it's ~500MB per station. Assuming 2million transactions an hour your talking about ~40megabytes of data an hour DSL would be fast enough. Now each station would keep a local copy the Database and transmit to the 30 or so other stations as long as they send data before you can reach the next station it should work just fine. Granted 10 years ago storing value on each card would have been more useful but the turn styles should easily be able to handle the full database.
- vecter 18y ago
  I'm not saying it's not doable, I'm just saying it's more complicated (and probably much more expensive) than the alternative. It also makes individual turnstile failures more difficult to handle. Suppose the network died on one of the turnstiles. Then you'd have to have build a caching system that it resorts to in case of network failures to prevent giving people free rides, and a way to merge state with the rest of the network once it rejoined. Of course you can do it, but I hope you're starting to see how complexity could grow faster than one might expect. I imagine that there are better ways to solve the problem at hand (security) that don't involve adding thousands of lines of code, miles of fiber, and hundreds of thousands of dollars.