Slashdot Mirror
Hacked Oyster Card System Crashes Again
Barence sends along PcPro coverage of the second crash of London's Oyster card billing system in two weeks. Transport for London was forced to open the gates and allow free travel for all. "There is currently a technical problem with Oyster readers at London Underground stations which is affecting Oyster pay as you go cards only," explains the TfL website. This follows the first crash two weeks ago, which left 65,000 Oyster cards permanently corrupted. Speculation is increasing that the crashes may be related to the hacking of the Oyster card system by Dutch researchers from Radboud University, though TfL denies any link. Plans to publish details of the hack were briefly halted when the makers of the chip used in the system sued the group, although a judge ruled earlier this week that the researchers could go ahead. During the court action, details briefly leaked on website Wikileaks.
According to The Guardian (http://www.guardian.co.uk/uk/2008/jul/25/london.transport) it's because Transys, who the Oyster system is contracted out to, are sending incorrect data.
I'll admit, when I got to the underground station this morning to hear about an "Oyster card problem" which meant that all the gates were open, my first thought was that someone had used the exploit to do unpleasant things to their network, but I think it's just wishful thinking.
If it carries on like this, I might stop paying for a travelcard, since it seems every couple of weeks everyone gets to travel for free anyway ;)
Normally I find the Oyster Card system simple and reliable. At least I travelled into work this morning for free at about 10 am :-)
Sig Appended to the end of comments you post. 120 chars.
...I'm not sure I can trust the news being provided in this case, but one thing is certain -- something smells fishy about this.
Can't you see, man? The Underground *wants* to be free!
What, was it taken down? By whom? What's up with that?
What?
details briefly leaked on website Wikileaks
What? "briefly" leaked? Does this mean Wikileaks removed those details? I thought that was against Wikileaks policy.
... bullshit.
This morning when I was exiting from the destination tube station (the system crashed while I was traveling) there was both one guy shouting and announcements through the information system telling us not to "touch out your card" (meaning, don't have it read by the reader).
If there is no risk of the cards being corrupted, why where they giving us those instructions?
Guide for IT Managers When Deciding Blame.
1. Hackers did it! If hackers couldn't have done it...
2. Disgruntled employees did it! If disgruntled employees couldn't have done it...
3. It's the vendor's fault! If the vendor couldn't have done it...
4. It's our fault.
Now... Reverse the list and that's what really happened.
http://news.bbc.co.uk/1/hi/technology/7516869.stm
Says in the last line
The Dutch group is one of three known to have cracked the Mifare Classic technology.
I haven't heard any other reports of other groups having confirmed to have cracked this system, so does anyone else know what the BBC are on about? But if they are right, then its pretty safe to say that people have been running about with cloned oyster cards for a while.
Unfortunately there don't seem to be any real details of how the copying is done, but I do wonder if the copying process is as simple as that if you can read a card you can clone it? If thats the case, if you need a new card (you will every 24 hours from what I've seen if you're using cloned cards), you just bump into someone on the way into a station with a reader about you person and clone theirs!
With there being two major fuck ups of the oyster system in 2 weeks, I am thinking that someone is really trying to make changes to the oyster system that it can't cope with...... and they would only try and really push the system if copying the cards is actually really easy, or they already have a problem with cloned cards that they're not talking about.
Car analogies break down.
Wikileaks posted the wrong paper, realized it, and took it down. The paper they had was published quite openly on the arxiv.org archives:
http://arxiv.org/abs/0803.2285
Read wikileaks own discussion of the event:
http://wikileaks.org/wiki/Talk:Censored_Milfaire_Classic_Oyster_Card_break_paper_2008
Don't mess with The Phone Company. Piss them off and you'll be using two tin cans and a piece of string.
between your card and our security.
Maybe somebody can convince Emma Clarke to provide us a nice cheeky voice-over for these sort of situations?
I will never live for sake of another man, nor ask another man to live for mine.
http://www.hackaday.com/2008/01/01/24c3-mifare-crypto1-rfid-completely-broken/
Unlike the crash two weeks ago that affected all Oyster readers and even corrupted the cards of people making top up payments, this seems to just have affected London Underground barriers this morning for pay as you go customers. "Oyster card readers on London Buses and on the Tram network have been unaffected."
You could always try the Spanish fly card
--- What?
Some set the reader from "Oyster" to "Clam." No word yet on whether or not other vendors will attempt to mussel into the market.
If brevity is the soul of wit, then how does one explain Twitter?
If the system is a bit broken (i.e. some people's cards wouldn't work in the gates) they tend to open all the gates in all the stations to avoid congestion (most people, if their card/ticket doesn't work, try again, then again, then turn round to move away and are faced with 1000 people wanting to go the other way. It slows things down a lot.).
The Oyster card system requires you touch your card at the start and end of your journey, or it defaults to charging the maximum fare (which is alot - now about £4.00 I think).
But there are cases outside the norm where this penalty is charged unjustly - like on the way to a special event when the tube's packed, or when you forget something and have to leave the station without travelling. The fare/penalty is charged automatically and you might not even notice, but of course to get it refunded you have to phone a helpline with all the usual crap to go through, so you end up being out of pocket.
The system is absolute and doesn't allow leeway for people's imperfect/unexpected behaviour. A few breakdowns on TFL's side are only fair therefore, as they help even the financial balance a bit.
It crashed because some schmuck needed a free ride on the subway and instead of using his psychic paper to get past the check point the idiot used his sonic screwdriver to bypass the system and crashed the servers. Don't blame the hackers, blame the police call box traveling schmuck who needed to be on the other side of London so he could save the world, again.
Tsukasa: All I really want, is to be left alone...
During the court action, details briefly leaked on website Wikileaks.
Details don't just "briefly leak" on the Internet.
The higher the technology, the sharper that two-edged sword.
Never tried having oyster 'cards' before....
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Card hacks like this are a total waste of everyone's time including the researchers!
I don't know the specifics of the Oyster system, but I promise you the card is very, very dumb. So dumb the possibility of 65,000 cards being corrupted in one time is not the card's fault.
How can I possibly know that? Well, if the submitter knew anything about value transfer cards, he would know that cards that store value require microseconds to transfer the value. Those microseconds translate into the rider having to -stop and wait- in order to transfer value. Which all mass transit riders know would be an absolute mess. So, the card carries, at most, a disguised unique ID with all the value transfer happening on some backend.
Now, the backend voiding 65,000 cards is easily possible. It's gross mismanagement on the part of the person publicly communicating the issue that they are describing the cards as broken.
Finally, how much does one stand to make cracking a transit system at the subway level? Not much at all. Steal a few rides? Let's say you want to mass-produce your hack, where are you going to get the cards for that? Those are two simple issues. There are many others....
This leads me to believe there are political forces at work regarding a new service/IT contract for the system if the story gets more attention than a summary on slashdot.
Check into Chevron paypass crack. This is actually do-able by someone well-grounded in rf electronics. To give you an idea of how bad that system is, you send the receiver odd keys (FFFFFFFFFF) to discover facts about the weak encryption. Which is *exactly* why every self-respecting American geek should avoid paypass and the contactless Visa/Mastercards like the Black Plague.
This Oyster card seems like a bad rip off of Hong Kong's Octopus card system. Why didn't they just use that anyway? NIH syndrome?
Is it because you don't want to wait four months for a bus?
... on windows, no less
Yeah, 4UKP is quite a bit of money, but I think it is at the price point where people are likely to go "fuck it", when the prospects of getting it back involve calling an 0845 (non-free) number and dealing with a call centre staffed by beaurocrats.
Even if your journey was only a quid (is there a journey that cheap in London? Around here I think the cheapest bus ride is over a quid these days), you're then ringing up for a 3 pound refund. The telephone call will be cheap, but will still have a cost directly proportional to the length of the call. The minimum wage in London is 7.20UKP per hour (I think, but it is more than the national minimum wage), and obviously there are lots of people earning more than that.... even for those on the lowest pay, ringing up for a refund might not even be worth their time depending on the size of the refund, what their bosses are like about spending time on the phone when at work, and the opening hours of the call centre!
Car analogies break down.
The solution to this problem is quite simple, just leave the gates to the subway permanently opened. Pay for public transportation through CO2 taxes on the most polluting cars and airplane travel. At least, dear London, make it a two week trial, to make all public transportation free. Then measure the CO2 level decreases that would generate for the whole city. You will probably see that a simple freeing up of public transportation reduces transport-related CO2 levels by as much as 30% at one time. You want to reduce CO2 emissions? This is the way to do it. This is the story of how hackers saved the environment.
How do you briefly leak something onto Wikileaks? Once something gets there it's pretty much there to stay, as several recent plaintiffs have found out.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Even if your journey was only a quid (is there a journey that cheap in London? Around here I think the cheapest bus ride is over a quid these days)
A bus ride on Oyster is 90p, regardless of how many stops you stay on for. Quite a cheap, although usually unpleasant, experience :D
But there are cases outside the norm where this penalty is charged unjustly ... when you ... leave the station without travelling.
When this happened to me
to get it refunded you have to phone a helpline with all the usual crap to go through, so you end up being out of pocket.
I just spoke to a member of staff and he went to the machine and refunded it on the spot, no questions asked.
Admittedly, though, staffing levels / hours are not exactly stellar.
I commend your request for facts and very civil tone in questioning my proposals.
Asynchronous" is an online payment. Consider the tranactions "buffered" such that by the time you reach the next access control point, the last transaction has cleared.
I'd easily call it a 10th of a second 'pause' as you swipe - be generous, call it a 20th - that's still 50 microseconds, isnt that enough to transfer a single currency value?
No. The chip inside the card is *very* low-power low-bandwidth chip with no encryption capabilities on its own.
To do a true offline payment, one has to do quite a bit of encryption/decryption functions on-card. Contactless is neither powerful enough or cheap enough to make it viable.
Another tip of the hat to you for sticking to the issue and challenging my side of the story. I wish more people would behave as you do.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html