3 ms·

Years and years ago the RFID cards that Cubic Transportation Systems uses in my city were vulnerable to a similar kind of attack involving the disposable RFID t

Years and years ago the RFID cards that Cubic Transportation Systems uses in my city were vulnerable to a similar kind of attack involving the disposable RFID tickets issued to users who bought a single fare instead of using the persistent cards. IIRC, it ended up being fixed by setting the write protect bit on the chips in the tickets, which supposedly had not been set. This would have worked because the tickets were one-time use and not disposable. Similarly, it has been demonstrated that the iClass DY cards they use in many universities for student cards (access, food billing) are easily cloned. It seems like most of the RFID card systems in widespread use tend to be vulnerable to various attacks. Part of this is because these systems are complicated and often run by large organizations for which improvement would involve replacement of entire fleets of cards and card readers, and would have to be a large project in coordination with the vendor. Perhaps the security vulnerabilities aren't actually so bad after all though; in this case, provided the attack does not become widely distributed, the percentage of users who take advantage of it is probably small, and the loss proportionally small. In the real world, the impact of scary sounding security vulnerabilities is slightly softened by the scale at which attacks occur and the value of the protected assets.

LorenPechtel 3y ago
Yeah, so long as it's not splashed across the news the loss due to hacking is probably less than the cost of defending against it. In pretty much any system the cost of driving malicious behavior to zero is higher than the cost of accepting that there will be some malicious behavior.
jstarfish 3y ago
I used to work in an arcade that migrated from coins to mag-stripe cards. Since it's scummy to be left with 0.4 points on a series of cards when games cost 1.1-5.9 points per play, the POS system facilitated a transfer of points across cards. The workflow for it was predictable-- hit transfer, insert and remove source card, insert and remove target card, confirm transfer. I never saw the code, but surmise the logic was implemented as: inserting the first card calculated what the end balance should be post-deduction (n=c1_points; c1_points=0). Inserting the second card calculated what the end balance of that card should be post-transfer (c2_points=c2_points+n). Hitting confirm executed the transaction and updated the point balance on both cards. Now, what happens when you insert the same card for the first and second pass? An enterprising employee thought to ask, and ran a lucrative side business selling cloned cards with thousands of dollars of points for $100 a pop. (IIRC, he got caught when one of his customers had a problem with their card and asked a legit employee for help. The high balance invited scrutiny.)

LorenPechtel 3y ago

Yeah, so long as it's not splashed across the news the loss due to hacking is probably less than the cost of defending against it. In pretty much any system the cost of driving malicious behavior to zero is higher than the cost of accepting that there will be some malicious behavior.

jstarfish 3y ago

I used to work in an arcade that migrated from coins to mag-stripe cards. Since it's scummy to be left with 0.4 points on a series of cards when games cost 1.1-5.9 points per play, the POS system facilitated a transfer of points across cards. The workflow for it was predictable-- hit transfer, insert and remove source card, insert and remove target card, confirm transfer. I never saw the code, but surmise the logic was implemented as: inserting the first card calculated what the end balance should be post-deduction (n=c1_points; c1_points=0). Inserting the second card calculated what the end balance of that card should be post-transfer (c2_points=c2_points+n). Hitting confirm executed the transaction and updated the point balance on both cards. Now, what happens when you insert the same card for the first and second pass? An enterprising employee thought to ask, and ran a lucrative side business selling cloned cards with thousands of dollars of points for $100 a pop. (IIRC, he got caught when one of his customers had a problem with their card and asked a legit employee for help. The high balance invited scrutiny.)