4 ms·

Operation Charlie: Hacking the MBTA CharlieCard from 2008 to Present

83 points by Amorymeltzer 4y ago

endisneigh 4y ago
This is an excellent article but anyone who uses the mbta knows it is overkill. If you want a free ride you can simply follow someone who paid or put your arm over the gate triggering it to open.
- jimmywetnips 4y ago
  just enter a station that doesn't even check tickets like lechmere
  - sva_ 4y ago
    That's funny, I just took the T for the first time yesterday as I arrived in Boston, and was curious why such a large number of people would get on at a certain stop.
    - prottog 4y ago
      Was it Lechmere? That may be because for the longest time (until the recent Green Line Extension project), Lechmere was the terminus for the Green Line, and so it became a part of a lot of people's commutes.
  - kbos87 4y ago
    You are right that they technically don’t check tickets but every now and then the MBTA police show up at a station and actually ask for proof of fare validation. I’ve seen people who are shocked when they are being yelled at and handed a significant fine.
- blamazon 4y ago
  When I used to catch the orange line from Mass Ave every day, one could just ask the friendly MBTA helpers there to open a gate for you. Ostensibly a service intended for hands full, handicap, etc, but they knowingly used it to let people on for free all the time as a sort of 'direct action'. No idea if that spirit remains at that station, that would have been 10 years ago now.
2OEH8eoCRo0 4y ago
Somebody should tell Charlie so he can finally get off of the train.
- Gabriel_Martin 4y ago
  Sadly, his fate is still unlearn’d
YPPH 4y ago
Some people did this in Western Australia in 2016 (using a SmartRider, which is also Mifare Classic based). They gained $18 worth of free travel. The backend system flagged the modified card. Both were charged and convicted of hacking and fraud. https://www.watoday.com.au/national/western-australia/perth-it-students-convicted-of-hacking-transperth-smartrider-for-18-free-travel-20160503-golcru.html https://www.watoday.com.au/national/western-australia/perth-...
- googlryas 4y ago
  I don’t really see why this should be punished more harshly than stealing $18 worth of goods from a store.
  - dsfyu404ed 4y ago
    There's an implied "how dare you try and pull a fast one on the almighty state" multiplier for crimes like this. You see similar treatment in many similarly petty crimes. In my state it's a felony to spray paint state highway and transit infrastructure. Tagging adjacent commercial rail infrastructure is just vandalism.
kibwen 4y ago
As someone who's willing to pay more taxes in order to make public transit in Boston free for everyone, I consider this a feature, not a bug. (FFS, make the buses free at least, 80% of bus rides connect to the T anyway, and getting rid of fares on buses makes their schedules more reliable since you no longer need to block on people rifling through their pockets and slowly feeding wrinkled dollars into the machine.)
- deleted 4y ago
  [deleted]
- jacobmartin 4y ago
  I've noticed that the further you get away from downtown, the more likely the bus driver is just going to tell you not to bother with it and wave you back if you reach for some dollar bills. But like you said, it'd be nice if it was just official policy for all bus rides rather than an ad hoc lottery based on the driver.
  - dsfyu404ed 4y ago
    Pretty much everything in MA is like that. The jackboot of beacon hill is on the end of a short leg. Give-a-fucks about anything and everything expend rapidly the further from it you get (both physically and economically).
    - thehappypm 4y ago
      You have it backwards — the further from Boston you get, the more the communities are mooching off the GBA money tree.
      - dsfyu404ed 4y ago
        That money comes with strings attached and that's the whole point. You could always stop paying and just let all that stuff that gets done with state money get done by the towns instead but you'd lose the ability to dictate terms and we all know that's a non-starter. Micromanaging a bunch of people who don't care about you or your values isn't cheap. You can either pay in dollars or in blood. The wealthy suburbanites and urbanites who want to see the brown folk in Fall River or the hicks west of Worcester march to the official state tune don't really have the stomach for an endless supply of "the tragic turn of events all began when State Trooper McFakeTimeCard pulled over Mr. Lopez, 36 of Springfield for an expired inspection sticker..." type news stories so it's no surprise that the "US in Iraq" approach gets chosen over the "Russians in Syria" approach. <shrug>
sva_ 4y ago
> a) Bypasses any ride counter checks, as I would never actually have to ride the T with a cloned card, I would simply check my balance at the fare machine and then leverage their system design to request a new card. I don't really see how it would bypass the counter check, as I would think the device reading out balances also reads out the counters.
oger 4y ago
Over here in Germany we had a 9 Euro per month all you can eat ticket four local public transport during Covid. This now indefinitely extended at 49 Euro per month.
- deleted 4y ago
  [deleted]
danbr 4y ago
Based on the outcome of the 2008 hack, some of vulnerabilities (value stored on card, not remote server) still remain today. AFC 2.0 has been delayed for many years, this new MIFARE attack vector will remain for a while longer as well.
ArcticLandfall 4y ago
Can someone ELI5 why MBTA has to trust the balance stored on the card in the first place? It seems like this whole issue would go away if they just kept the balance on the server and flagged cards that did not corroborate.
- blessedwhiskers 4y ago
  This is common in truth-on-card transit systems, many of which were conceived before internet connectivity at terminals was a thing. Often the cards needed to work on busses, etc. that didn’t have internet connectivity and couldn’t validate the balances. Even still there isn’t necessarily reliable internet in tunnels, etc. Newer variants of similar cards are regarded as more secure, such as MiFare’s DESFire line which is used in the SF Bay Area (Clipper).

83 points by Amorymeltzer 4y ago

This is an excellent article but anyone who uses the mbta knows it is overkill. If you want a free ride you can simply follow someone who paid or put your arm over the gate triggering it to open.

jimmywetnips 4y ago
just enter a station that doesn't even check tickets like lechmere
- sva_ 4y ago
  That's funny, I just took the T for the first time yesterday as I arrived in Boston, and was curious why such a large number of people would get on at a certain stop.
  - prottog 4y ago
    Was it Lechmere? That may be because for the longest time (until the recent Green Line Extension project), Lechmere was the terminus for the Green Line, and so it became a part of a lot of people's commutes.
- kbos87 4y ago
  You are right that they technically don’t check tickets but every now and then the MBTA police show up at a station and actually ask for proof of fare validation. I’ve seen people who are shocked when they are being yelled at and handed a significant fine.
blamazon 4y ago
When I used to catch the orange line from Mass Ave every day, one could just ask the friendly MBTA helpers there to open a gate for you. Ostensibly a service intended for hands full, handicap, etc, but they knowingly used it to let people on for free all the time as a sort of 'direct action'. No idea if that spirit remains at that station, that would have been 10 years ago now.

2OEH8eoCRo0 4y ago

Somebody should tell Charlie so he can finally get off of the train.

Gabriel_Martin 4y ago
Sadly, his fate is still unlearn’d

YPPH 4y ago

Some people did this in Western Australia in 2016 (using a SmartRider, which is also Mifare Classic based). They gained $18 worth of free travel. The backend system flagged the modified card. Both were charged and convicted of hacking and fraud. https://www.watoday.com.au/national/western-australia/perth-it-students-convicted-of-hacking-transperth-smartrider-for-18-free-travel-20160503-golcru.html https://www.watoday.com.au/national/western-australia/perth-...

googlryas 4y ago
I don’t really see why this should be punished more harshly than stealing $18 worth of goods from a store.
- dsfyu404ed 4y ago
  There's an implied "how dare you try and pull a fast one on the almighty state" multiplier for crimes like this. You see similar treatment in many similarly petty crimes. In my state it's a felony to spray paint state highway and transit infrastructure. Tagging adjacent commercial rail infrastructure is just vandalism.

kibwen 4y ago

As someone who's willing to pay more taxes in order to make public transit in Boston free for everyone, I consider this a feature, not a bug. (FFS, make the buses free at least, 80% of bus rides connect to the T anyway, and getting rid of fares on buses makes their schedules more reliable since you no longer need to block on people rifling through their pockets and slowly feeding wrinkled dollars into the machine.)

deleted 4y ago
[deleted]
jacobmartin 4y ago
I've noticed that the further you get away from downtown, the more likely the bus driver is just going to tell you not to bother with it and wave you back if you reach for some dollar bills. But like you said, it'd be nice if it was just official policy for all bus rides rather than an ad hoc lottery based on the driver.
- dsfyu404ed 4y ago
  Pretty much everything in MA is like that. The jackboot of beacon hill is on the end of a short leg. Give-a-fucks about anything and everything expend rapidly the further from it you get (both physically and economically).
  - thehappypm 4y ago
    You have it backwards — the further from Boston you get, the more the communities are mooching off the GBA money tree.
    - dsfyu404ed 4y ago
      That money comes with strings attached and that's the whole point. You could always stop paying and just let all that stuff that gets done with state money get done by the towns instead but you'd lose the ability to dictate terms and we all know that's a non-starter. Micromanaging a bunch of people who don't care about you or your values isn't cheap. You can either pay in dollars or in blood. The wealthy suburbanites and urbanites who want to see the brown folk in Fall River or the hicks west of Worcester march to the official state tune don't really have the stomach for an endless supply of "the tragic turn of events all began when State Trooper McFakeTimeCard pulled over Mr. Lopez, 36 of Springfield for an expired inspection sticker..." type news stories so it's no surprise that the "US in Iraq" approach gets chosen over the "Russians in Syria" approach. <shrug>

sva_ 4y ago

> a) Bypasses any ride counter checks, as I would never actually have to ride the T with a cloned card, I would simply check my balance at the fare machine and then leverage their system design to request a new card. I don't really see how it would bypass the counter check, as I would think the device reading out balances also reads out the counters.

oger 4y ago

Over here in Germany we had a 9 Euro per month all you can eat ticket four local public transport during Covid. This now indefinitely extended at 49 Euro per month.

deleted 4y ago
[deleted]

danbr 4y ago

Based on the outcome of the 2008 hack, some of vulnerabilities (value stored on card, not remote server) still remain today. AFC 2.0 has been delayed for many years, this new MIFARE attack vector will remain for a while longer as well.

ArcticLandfall 4y ago

Can someone ELI5 why MBTA has to trust the balance stored on the card in the first place? It seems like this whole issue would go away if they just kept the balance on the server and flagged cards that did not corroborate.

blessedwhiskers 4y ago
This is common in truth-on-card transit systems, many of which were conceived before internet connectivity at terminals was a thing. Often the cards needed to work on busses, etc. that didn’t have internet connectivity and couldn’t validate the balances. Even still there isn’t necessarily reliable internet in tunnels, etc. Newer variants of similar cards are regarded as more secure, such as MiFare’s DESFire line which is used in the SF Bay Area (Clipper).