4 ms·

Teens Hacked Boston Subway for Infinite Free Rides–and This Time Nobody Got Sued

42 points by kjhughes 3y ago

liminalsunset 3y ago
Years and years ago the RFID cards that Cubic Transportation Systems uses in my city were vulnerable to a similar kind of attack involving the disposable RFID tickets issued to users who bought a single fare instead of using the persistent cards. IIRC, it ended up being fixed by setting the write protect bit on the chips in the tickets, which supposedly had not been set. This would have worked because the tickets were one-time use and not disposable. Similarly, it has been demonstrated that the iClass DY cards they use in many universities for student cards (access, food billing) are easily cloned. It seems like most of the RFID card systems in widespread use tend to be vulnerable to various attacks. Part of this is because these systems are complicated and often run by large organizations for which improvement would involve replacement of entire fleets of cards and card readers, and would have to be a large project in coordination with the vendor. Perhaps the security vulnerabilities aren't actually so bad after all though; in this case, provided the attack does not become widely distributed, the percentage of users who take advantage of it is probably small, and the loss proportionally small. In the real world, the impact of scary sounding security vulnerabilities is slightly softened by the scale at which attacks occur and the value of the protected assets.
- LorenPechtel 3y ago
  Yeah, so long as it's not splashed across the news the loss due to hacking is probably less than the cost of defending against it. In pretty much any system the cost of driving malicious behavior to zero is higher than the cost of accepting that there will be some malicious behavior.
- jstarfish 3y ago
  I used to work in an arcade that migrated from coins to mag-stripe cards. Since it's scummy to be left with 0.4 points on a series of cards when games cost 1.1-5.9 points per play, the POS system facilitated a transfer of points across cards. The workflow for it was predictable-- hit transfer, insert and remove source card, insert and remove target card, confirm transfer. I never saw the code, but surmise the logic was implemented as: inserting the first card calculated what the end balance should be post-deduction (n=c1_points; c1_points=0). Inserting the second card calculated what the end balance of that card should be post-transfer (c2_points=c2_points+n). Hitting confirm executed the transaction and updated the point balance on both cards. Now, what happens when you insert the same card for the first and second pass? An enterprising employee thought to ask, and ran a lucrative side business selling cloned cards with thousands of dollars of points for $100 a pop. (IIRC, he got caught when one of his customers had a problem with their card and asked a legit employee for help. The high balance invited scrutiny.)
mindslight 3y ago
> the MBTA hasn’t actually fixed the vulnerabilities they discovered and instead appears to be waiting for an entirely new subway card system that it plans to roll out in 2025 ... This vulnerability will not exist once the new fare collection system goes live, due to the fact that it will be an account-based system versus today’s card-based system. Seemingly another poorly-designed system ripe for surveillance, with little public outcry. In 2025 it'll be "so easy to check your balance online". In 2030 they'll be selling everything they know about you (including everywhere you go) to the consumer surveillance industry, just as cell companies and DMVs do today. The US desperately needs a port of the GDPR.

42 points by kjhughes 3y ago

Years and years ago the RFID cards that Cubic Transportation Systems uses in my city were vulnerable to a similar kind of attack involving the disposable RFID tickets issued to users who bought a single fare instead of using the persistent cards. IIRC, it ended up being fixed by setting the write protect bit on the chips in the tickets, which supposedly had not been set. This would have worked because the tickets were one-time use and not disposable. Similarly, it has been demonstrated that the iClass DY cards they use in many universities for student cards (access, food billing) are easily cloned. It seems like most of the RFID card systems in widespread use tend to be vulnerable to various attacks. Part of this is because these systems are complicated and often run by large organizations for which improvement would involve replacement of entire fleets of cards and card readers, and would have to be a large project in coordination with the vendor. Perhaps the security vulnerabilities aren't actually so bad after all though; in this case, provided the attack does not become widely distributed, the percentage of users who take advantage of it is probably small, and the loss proportionally small. In the real world, the impact of scary sounding security vulnerabilities is slightly softened by the scale at which attacks occur and the value of the protected assets.

LorenPechtel 3y ago
Yeah, so long as it's not splashed across the news the loss due to hacking is probably less than the cost of defending against it. In pretty much any system the cost of driving malicious behavior to zero is higher than the cost of accepting that there will be some malicious behavior.
jstarfish 3y ago
I used to work in an arcade that migrated from coins to mag-stripe cards. Since it's scummy to be left with 0.4 points on a series of cards when games cost 1.1-5.9 points per play, the POS system facilitated a transfer of points across cards. The workflow for it was predictable-- hit transfer, insert and remove source card, insert and remove target card, confirm transfer. I never saw the code, but surmise the logic was implemented as: inserting the first card calculated what the end balance should be post-deduction (n=c1_points; c1_points=0). Inserting the second card calculated what the end balance of that card should be post-transfer (c2_points=c2_points+n). Hitting confirm executed the transaction and updated the point balance on both cards. Now, what happens when you insert the same card for the first and second pass? An enterprising employee thought to ask, and ran a lucrative side business selling cloned cards with thousands of dollars of points for $100 a pop. (IIRC, he got caught when one of his customers had a problem with their card and asked a legit employee for help. The high balance invited scrutiny.)

mindslight 3y ago

> the MBTA hasn’t actually fixed the vulnerabilities they discovered and instead appears to be waiting for an entirely new subway card system that it plans to roll out in 2025 ... This vulnerability will not exist once the new fare collection system goes live, due to the fact that it will be an account-based system versus today’s card-based system. Seemingly another poorly-designed system ripe for surveillance, with little public outcry. In 2025 it'll be "so easy to check your balance online". In 2030 they'll be selling everything they know about you (including everywhere you go) to the consumer surveillance industry, just as cell companies and DMVs do today. The US desperately needs a port of the GDPR.