Slashdot Mirror
EFF To Appeal Court Order Vs. Subway Hack Demo
snydeq sends along InfoWorld coverage of the EFF's plans to appeal a US District Court order that kept three MIT students from presenting detailed flaws in the Massachusetts Bay Transportation Authority e-ticketing system at Defcon. And an anonymous reader points out that the MBTA, in addition to triggering the Streisand Effect, released in open court more information on vulnerabilities (PDF) than the students had any intention of presenting. See Exhibit 1 to this court filing.
How can any such order be justified in the light of the first amendment protection of free speech?
Give me Classic Slashdot or give me death!
It seems that the people who are bringing flaws to light are cast as the villains, while nobody even considers blaming or even questioning the people who selected a poorly-implemented system to run an entire city's public transit.
Isn't this the same hack which was described in detail in c't #8/2008? Mifare classic, uses Crypto1, a flawed pseudo random number generator and salts which only depend on the power on time, which is under the control of the attacker. Flaws were discovered by slicing the chip and inspecting the layers with a microscope.
I say, this is intolerable! You Slashdottian ragamuffins should remove the hyperlink to that MIT-hosted court document post haste, or I shall be forced to request that these truckless tubes be cleansed of it ... in court! (There, that will put a decisive end to their meddling.)
Why is it that every time I read about the EFF or Lesig I hear about how they are going down in flames in once case or another? Are we taking about the Washington generals here? Whats it going to take for them to actually win something for a change.
The two students at Georgia Tech that hacked the campus Blackboard swipe system (http://www.theregister.co.uk/2003/07/15/student_hackers_we_didnt_defeat/).The general idea was that it didn't matter how secure the encryption-system was, if the physical system was easy to get to. You don't have to figure out what information is being sent to the machine, all they had to do was 'capture' a 'yes-there-is-enough-money-on-the-card' response, then duplicate. Hey free snacks!!
You know what would rock, an infinite gift card to Wendy's.
http://www-tech.mit.edu/V128/N30/subway/
Direct link to the presentation PDF:
http://www-tech.mit.edu/V128/N30/subway/Defcon_Presentation.pdf
At least from what's in the linked PDF, the undergrads' work is not all that impressive. They look at both the CharlieTicket (magstripe) and the CharlieCard (RFID).
Hacking the CharlieTicket sounds fairly trivial. Magstripe cards are extremely easy to read and write to, and documentation on how to do this with homemade equipment is all over the Internet. The undergrads' work essentially consists of figuring out how the 6-bit checksum is being calculated (though it's not disclosed in the linked documents). This is probably the most difficult thing that they did.
Hacking the CharlieCard, which is a MiFare Classic, is more involved, but the undergrads used a previously known attack, simply duplicating it. (Some might call that the behavior of a "script kiddie"?) There's hardly anything novel about this.
"Anyone who [rips a CD] is probably engaging in copyright infringement." - David O. Carson
Which is from Cory Doctorow's "Little Bother", and which from the court documents in this case?
"Just flash the firmware on a ten-dollar Radio Shack reader/writer and you're done. What we do is go around and randomly swap the tags on people, overwriting their Fast Passes and FasTraks with other people's codes. That'll make everyone skew all weird and screwy, and make everyone look guilty. Then: total gridlock."
vs.:
"An attacker uses RFID equipment purchased online to sniff communications between a legitimate CharlieCard and a turnstile. He takes the data back home and executes one of several attacks that exploit the weak Crypto-1 cipher to recover a key. Armed with this key, a high-gain antenna, and RFID equipment, he walks down a crowded street in boston remotely copying the CharlieCards in people's pockets."
Please, check out 'Little Brother'. FREE for download at http://craphound.com/littlebrother/download/ , or available at fine bookstores everywhere.
The guy who put the report in Exhibit A, along with his email address, it could be added, really, REALLY underestimated the issue I think. Did he really think the public court records wouldn't get out?
Exhibit A will, I suspect, lead to many, MANY more compromises now then would have happened had they given their presentation.
What HE released had the specific vulnerabilities they found. He didn't want that data out, and then published it himself!
-- I'm the root of all that's evil, but you can call me cookie..
How can any such order be justified in the light of the first amendment protection of free speech?
Because all speech isn't protected. The First Ammendment isn't a blanket guarantee to say or do anything. There are limits on speech, and always have been, from the time the Constitution was ratified to today.
You can argue on technical grounds that "security by obscurity" is a stupid idea, but I think the EFF lost here for a reason... we've always balanced speech that can have a direct impact on public safety against the relative risks of that speech. You can't email classified blueprints of an AEGIS radar system to Vladimir Putin, for instance, or a list of undercover NYPD officers to some guy named Sal in Sicily, and then claim free speech protection. If you don't want to get in legal trouble, you go to court and get such things made de-classified or stripped of confidential status first, then you can reveal whatever you like. The students first step should have been getting a court order to strip protection from the MBTA information, because MBTA actually has some legal precedent on their side here.
The students may even be in the right here, but they were pleading their case in a way that almost assured their defeat in court. And in this case, EFF was thinking like hackers, not lawyers.
Life is hard, and the world is cruel
Given the number of security idiocies committed publicly by the Boston authorities, I hope somebody is checking the water supplies in city buildings for some additive that induces mass stupidity.
Shouldn't the 'project manager' guy be like curling up in a shame-ball under his desk instead of pestering these kids?
Watch, the appeals court won't overrule it - they'll decline to decide the matter because now it's moot.
"Hi, I'm the public. Do I have a right to know about these flaws?"
"No"
The court issued a 'temporary restraining order', which is legal-jargon for "don't do anything until we can get a decent hearing". It does not mean that the court has accepted the MBTA's position or even jurisdiction over the case. It is merely a tool* to ensure that neither party can unilaterally change the status-quo just because the courts do not operate 24/7 and are sort of slow (making sure everyone has a chance to speak generally doesn't allow for fast decision making). Rarely does a TRO last more than a week until a preliminary hearing can be held.
IMO, therefore, even if the MBTA has no case whatsoever (almost certainly true) they are entitled to a TRO for a few days until the court can read (and almost certainly deny) their application for a permanent injunction. I don't see any major damage from having a presentation delayed for all of 72 hours either (note, if we were talking permanent injunction, it would be totally bogus -- that's a different matter entirely).
* Yes, I'm aware the information was already published on the internet and that it cannot effectively be "recalled". That is not the point -- the MBTA, as any other litigant, has the right to have a court hear their case -- even if they really don't have one.
I'm surprised they didn't mention the fact that anyone can "hack" their way into the MBTA subways by simply sticking their arm between the doors and activating the "exit" side censors.
There have been a number of presentations lately that have been silenced by private companies before a conference, either by injunction or under the table (I'm thinking of Apple here). How long before we see conference talks being titled as clearly as most software patents? "Some Group Discusses Some Weakness In Some Company's Software" Tuesday at Defcon. If this gets out of hand, I wouldn't be too surprised if we start seeing some subtle obfuscation of what the true nature of some talks are about.
Method of processing duck feet
I just hope the courts don't take away that excellent Five Dollar Foot Long deal.
The Transit Authority's position seems to boil down to this quote from their expert:
"In these circumstances, without solid assurance that the MIT Undergrads' activities do not pose an immediate threat to the Fare Media System's integrity and security, the required course in my opinion is to conclude that the activities do pose an immediate threat, and to act, as the MBTA is, to mitigate that threat through direct Court intervention."
The Transit Authority's position seems to be this: We think that we're secure, but we are not absolutely sure that we're secure. These people say that we are not secure. We asked them to tell us how we're not secure. They wouldn't tell us. We don't know if they're for real or not, so we need a judge to make them stop because they might be for real.
If I've got it right, this is pretty far out. The transit authority cannot even establish a factual predicate sufficient to show that the presenters have knowledge that would or could damage the transit authority. This would seem to present a really big causal gap in their case.
The trial judge must have had a brain-lapse. This case is about hard-core censorship. The presenters can only defend themselves if they come out with their information before the censor (i.e., the tribunal). This shouldn't have to be their burden. The plaintiffs should have to prove that the presenters have something really bad and dangerous.
The temporary injunction in this case is offensive in this case because it appears to be based only on this set of facts: Four dudes are going to talk in some unknown way about Transit Authority security.
If I develop a method sufficient to allow me unilateral control of the entire US nuclear missile arsenal (or the Transit Authority's bank accounts), I would surely hope that some federal judge would slap a prior restraint on me to keep me from blabbing it to the world.
If the presentation is delayed long enough that it cannot be held during a security conference, the damage could be quite major.
If I've got it right, this is pretty far out. The transit authority cannot even establish a factual predicate sufficient to show that the presenters have knowledge that would or could damage the transit authority. This would seem to present a really big causal gap in their case.
"We're going to give a presentation on how to crack the MBTA passes" seems like a pretty good factual predicate.
Not a chance. In the latter case, the Transit Authority won't be able to afford a lawyer. In the former case, the judge can be easily convinced that the security of his hometown against nuclear missiles depends on ruling in your favor.
data processing device performing logical, arithmetic, or storage functions,
Note the "OR". The magstripe card is storage. The -card- does logical, arithmetic, AND storage functions- it's an intelligent device.
Furthermore, they openly admit to trespassing both physically (at stations, offices, AND networks they knew were private.)
Frankly, I'm astounded they're not sitting in a jail cell right now. Chances are that right now the MBTA are going through CCTV footage looking for them trespassing, and once they've found some- they'll be arrested.
It's one thing to play with the cards (and ride the coat-tails of other researchers who published all of this 8 months ago). It's another to wander into offices and plug into internal networks you know you don't belong to (in fact, the very definition of trespassing in some states is "you're somewhere you know you don't belong.")
Please help metamoderate.
I just want to say that having read Exhibit 1, I applaud the authors for writing a very succinct and readable account of the vulnerabilities of the MBTA system. It seem implausible to me that anyone (even the pointy hair types) could read that assessment and not fully comprehend the situation at hand. It makes me wonder who Zack Anderson, Russell Ryan and Alessandro Chiesa work for. I'm sure Google will tell me.
the goal of the transit authority is only to tie this up in court till the conference is over. at that point, presenting the research at the conference will be a moot point.
For doing the same thing trying to fix commuter train ticket vulnerabilities?
"Terrorism is a real threat to the US and the "western" world."
Not really. If looked at rationally, terrorism on 9/11 was tiny irritant to life in the united states.
Think it through.
"What if this is used by some terrorist organization to mount an attack?"
If you had bothered to, y'know *READ THE F*CKING PRESENTATION* you'd realize the security at stake was the security of the card system. At best, this lets someone ride for free.
How the #$#@ do you think a terrorist would exploit this? You mean, the terrorist were going to use the subway to mount an attack, but they ran out of money to pay the #@$@ing fare, so they decided that walking was too $#@$#ing hard? But now, they can @#$@#ing clone $10 farcards with only $1,000 worth of equipment, so now the f@#$ing terrorist have f#$#@ing won??????? I mean, everybody is allowed to say something @#$#@ing stupid every now and then but you are abusing the @#$%ing privilege.
What's next? A serious talk on how if you have more than 5 ounces of fluid you can blow up the plane due to some new law of physics and chemistry? Or better yet, tell us that now that you remove your @#$#@ing shoes that you now feel safe.
Not everybody is a genius who posts on here, but hardly anybody is that dumb. And you just put yourself into elite f#@$ing terroritory.
I once saw a documentary about the amount of black box and white box testing which goes on with automated gambling machines in the state of Nevada. This is seriously methodical stuff, and the test plans are pretty much the same for any device.
It amazes me that these ticket systems, Ohio voting machines, etc. all do not follow that model.
It's almost as amazing that the state of Massachusetts contracts this out -- apparently without good specs for test requirements. Is the only point in outsourcing to get lower quality? Instead of farming the job to some random company with no track record, they should have given it to MIT in the FIRST PLACE. MIT has been working on secure open evoting systems since WAY before 2000... I'm sure they could handle this, and it would create local jobs to boot*.
*(An open system is nice that it's free, but we're not quite there where state agencies can support themselves. Look at Red Hat's successful model packaging and selling support. A free and open ticketing system could still drive a healthy development community around MIT, and cities all around would still want extensions and new features added. )
Basically, it doesn't even matter whether the threat is real or imagined. Personally, I think 3000 people in 7 years (and counting) is peanuts. When that's what you're scared about, you shouldn't drive anymore or have an operation. The chances to die in a car accident or on the OP table are significantly higher.
If it is real, it would even increase the mark of shame on our politicians and media. If it's fake, they're just causing a hype to push their agenda. If it's real, they're crying wolf and abuse the "terrism" hype so far until nobody takes it serious anymore.
It's basically like it was in my school. We had fire drills every month or so. Net result? People didn't even bothing going out anymore when the alarm rang. It was known to be fake, so why bother listening to it?
When you overdo drills or abuse a warning system, people will stop taking them serious. It will just be another drill or another hype when you ring the alarm. And that could backfire badly should the threat be real one day again.
I predict a disaster should another terrorist strike happen one day. We'll then get to hear that some "threat level indicator" was at some nice, warm color anyway and "we warned you", but we won't hear that that indicator was about the same nice, warm color for years and we've been blitzed with fake warnings almost at a daily base. Warnings cease to create an elevated level of caution when they happen too often, especially if those warnings are abused to push completely unrelated agendas, just because "terrists" are a comfortable reason to abolish civil rights.
People aren't dumb. They see through it, and they will (and as you can see, do) ridicule those "warnings". It's way harder, though, to actually discriminate a real threat from one of those agenda-pushing fakes when you get told the same old lies over and over. Should a real threat be discovered and actually published, the first reaction most people have won't be "how can I avoid it?" but rather "what are they trying to do to my rights this time?"
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
IMO, therefore, even if the MBTA has no case whatsoever (almost certainly true) they are entitled to a TRO for a few days until the court can read (and almost certainly deny) their application for a permanent injunction. I don't see any major damage from having a presentation delayed for all of 72 hours either (note, if we were talking permanent injunction, it would be totally bogus -- that's a different matter entirely).
The damage is, of course, that DEFCON will be over by then. The students were robbed of their speech and presentation. So yes, the MBTA has unilaterally changed the status-quo -- there won't be a DEFCON speech about their vulnerabilities by virtue of the TRO.
Of course, the information will now get much more widespread circulation, but the undergrads in this matter will never get to present their findings at this DEFCON.
Correct, and the (more public) stance both court and plaintiff are taking now (post-TRO) would seem to indicate that both f*cked up in spades, and are actually beginning to appreciate that -- plaintiff by not thinking things through and actually talking to someone who could understand and explain the technical aspects of things, and the court for believing the plaintiff.
As pointed out, the purpose of a TRO is (was) to *temporarily* freeze the situation until the court can be briefed fully, and make a more reasoned decision.
But we're running on Internet time now, and Plaintiff did what defendant couldn't have done, which was to disseminate even more information to a wider forum, and generate orders of magnitude more interest in this information than defendant could have done on their own...
The other thing plaintiffs did in this action -- going for a TRO takes cojones, and a good reputation with the court. As plaintiff, you're going to the court asking them to act preemptively -- to restrain someone who has not yet acted. If the court doesn't believe you, they'll say, "Nah, if you're damaged, you can bring suit." Here, plaintiffs not only didn't understand the situation, but in their filings, they did orders of magnitude more damage to themselves than the action they got the court to enjoin.
Courts and judges tend to have long memories -- and in this case, they'll most likely remember that these guys were bozos, and evaluate their arguments accordingly.
Subway systems know in detail how much fraud occurs, from rider statistics and revenues.
And why bother deploy a cryptographically secure system? Tokens were far easier to forge than magnetic stripes or RFID tags.
The only ignorance and incompetence here is on the part of the MIT students and people like you who simply don't understand economics and cost/benefit tradeoffs.
The clone hack has been around since at less late '70s. Yes the 70's!!! It was done to BART cards using a cassette tape recorder. Since the card carried all information - like today - you copy it once and return the value every few days. With a commute being the cost daily, the machine just keep over typing. BART stationed people to look at the cards as the popped out of ticket machine (they popped straight up) looking for heavy over printing.
The value hack is again simple. If you ever read credit cards normally, the logic and layout is simple. Designed for the 4bit world of Zon Jr. All that information is out there. The only hard part is mapping unknown track layouts. A couple identical value cards running the same stops - would show datetimes and other "changing" information.
To make this harder to crack would be two encryptions both with check sums, one over checksum is data to other. Even using 2 16bit independent CRCs, so the changing data changes all bits. Also if any one tries to change data, one of the two will catch the error, then writes back a bad data in the track fully re-encrypt, so the mapping process will cost. Will stop it completely - but really slows it down.
I love Mag Track but you have learn from the past!
Mr. Henderson, While I have no direct connection to you or to Mr. Anderson, I was disappointed to see the brief you filed before the court on August 9. As a systems and network administrator, I would have felt that Mr. Anderson had done me a great service by attaching his "Fare Collection Vulnerability Assessment Report," which the MBTA has included as "Exhibit A." As I'm sure you are now aware, this report is now available to the public, as it was submitted as part of a public civil proceeding. Mr. Anderson's presentation was also public, and was given to attendees in advance of the conference at which he intended to speak. At least until Saturday, it was also hosted by public servers at MIT. A bit of research would likely have led you to the report -- in fact, it is still public, and is now mirrored across the internet. Unfortunately for the MBTA, "Exhibit A," which your organization willfully made public, contains far more detailed and damaging information than Mr. Anderson's original presentation. Instead of trying to prevent this information from leaking out, it seems it would have made more sense to work with Mr. Anderson and his colleagues, or other qualified individuals, to address the vulnerabilities in your system. By seeking prior restraint, the MBTA has suggested that it is uninterested in taking any other corrective action -- at least, if such action is in progress, it is not mentioned in the documents presented to the court. What is also surprising to me is that you disparage Mr. Anderson's research as unoriginal, while at the same time the MBTA is requesting that this information be censored. If Mr. Anderson's research is unoriginal (and I agree with you on this point), how would the release of this report be damaging to the MBTA? How can prior restraint be justified for material that has already been released? Despite my objection to your position in this case, I am indebted to you, and to the MBTA, because by seeking prior restraint in this case, you've taught tens of thousands of people around the world a bit more about how your systems work, and you've demonstrated that prior restraint is quite unrealistic in the internet age. Chances are that relatively few people would have learned about the security flaws of the MBTA system if Mr. Anderson were permitted to give his presentation. As a result of the MBTA's legal challenge, many have taken notice, and have examined the information on vulnerabilities you intended to suppress, as well as the (more sensitive) information the MBTA has now brought to light. I don't expect a reply to this message, as I'm sure you're already quite busy with this matter, but if I were in your position, I would thank Mr. Anderson and his fellow students for a thorough security audit, which they did at no cost to you or to your employer. Of course, if you'd like to respond, you're welcome to do so -- I'd be curious to learn more about your position on this issue. Regards and best wishes! Disclaimer: I have no interest in exploiting the vulnerabilities in the MBTA's systems, and don't live in Massachusetts or anywhere near Boston. I have never ridden public transportation in Boston and at this time have no intention of doing so. Also, I am not a lawyer, and am not affiliated with any party in this case.
Facts have a liberal bias.
... is the DMCA - the Digital Millenium Copyright Act. This law turned traditional notions of constitutional rights on their head. The law protects shoddy security (like the MBTA's) by criminalizing the act of talking about it. Its like the Emperor's New Clothes, but in this version, the Emperor has the little boy killed and he keeps on marching, naked and stupid.
So, I actually have a little bit of sympathy for whichever public servant's ass is on the line right now, worrying he's going to get fired over this flap. Whatever idiots actually implemented the existing Charlie Card system we're stuck with right now might be long gone by now, along with the consultants that actually put this system in place.
However, as a Boston resident, it's pretty obvious the MBTA has been brought down recently by especially bad mismanagement. We switched 2 years or so ago from plain tokens (one token == one subway ride) to an overly complicated mix of magstripe cards (CharlieTickets) and RFID cards (CharlieCards).
There was a news story a while back in one of the little free Boston newspapers telling the cost of implementing this new system.. I think it was well into the hundreds of millions of dollars. Enough to pay the existing salaries of the MBTA staff for several years.
To top it off, the new cards are really just a drag on everyone's time. Anyone who's had to wait 2 minutes in line while getting on a bus for some fool to fumble around trying to load up value onto one of the stored-value CharlieCards knows what I'm talking about.
I also have a sneaking suspicion that a "feature" of this horrendously expensive, overly complicated system was not only that it would save money through nebulous efficiency improvements (the Charlie Card machines are broken half the time for some reason...) but that it would allow them to make more money by more effectively manipulating the currency. You see, previously, when they would hike up the subway rates, they couldn't stop people from buying $100 of tokens at the old rates just before the rate switch. Now, they can jack up the rates and everyone's forced to pay the new rate.
So anyway, a little long-winded.. but I can see exactly why the MBTA officials are so worried about this. In addition to being stuck with this crazily complicated, expensive system that's run horrendously overbudget (in addition to the MBTA itself being $100M+ in the red every year somehow, despite having a government-funded monopoly and all sorts of advertising revenue flowing in..), they are now faced with the possibility of college students in Boston buying hacked Charlie Cards and not paying any fare. They're probably scared shitless of this. For the people that said they should just fix their system... I honestly doubt they could, even if they wanted to. We're talking about a system that cost several hundred million $ to put in place, with very little thought about security put in at the beginning. And these are government officials, using god-knows-who for contracting out the maintenance of this system. Working for an agency that's severely in the red, year after year. They don't have a snowball's chance in hell of fixing the system the right way, so they're abusing the courts to keep from being ridiculed in public and fired over the whole fiasco.
http://cltracker.net -- powerful craigslist multi-city search
Bottom line of page 5 : "planed" instead of "planned".
Oh, sorry, a basic spelling checker wouldn't have caught that. He'd need one that can distinguish contexts between "carpentry" and "legalese".
Unfortunately, since this works machine doesn't have Firefox's spelling checker (in any language!), I'm bound to have shot myself in the foot.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
Desensitizing people to alarms isn't a bad thing, provided there is a sane limit to the desensitization (when it's done to the extent that people don't even flinch at the alarm, it has gone too far).
For instance, let's take a fire alarm: if nobody has heard it before (i.e. they'd never gone through a fire drill at all), there could easily be mass panic and injuries/death due to hysteria; if people were aware of what to do in a fire drill (while not being completely desensitized), the relative calmness of the evacuation avoids hysteria, possibly even after those people realize it isn't a drill.
The moral of the story: using drugs in proper dose to limit pain is a good thing; taking enough drugs to make an elephant drowsy could cause you to be completely unaware of the alien ripping through your ribcage.
Sanity is like a condom: rather have it and not need it, than need it and not have it.
That you have to practice to take away the element of panic is a given. Here's actually where the analogy breaks, since that's exactly what does not happen, and is also appearantly not wanted. People don't stop panicking in the face of "terr'rism". The whole thing reeks of "we gotta do something. Dunno what, but something!", which is usually not really productive. And behold, it ain't.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Tm
Support TBI Research: http://www.raisinhope.org
I don't see any major damage from having a presentation delayed for all of 72 hours either
Excepting, as pointed out in another reply, that this caused a presentation at a conference to be "Restrained" past the end of the conference, thus causing great damage to both the conference itself (one less presentation, bunch of pissed-off people that came to see said presentation) and the presenters (missed opportunity for a large live audience to present to). Since DefCon lists the presentations ahead of time, the MBTA should have had plenty of time to issue their TRO, get the facts straight, and get on with life such that the presentation could go on. Instead they waited and filed the TRO just prior, in a successful attempt to quash the presentation. Looking back through pages, the wifi warcarting article was posted to Slashdot on the 5th, along with mention of the subway hack presentation, so given normal slashdot posting times, it must have been on the DefCon site since at least late July. And checking further, confirmation: "An MBTA vendor tipped off the authority on July 30 that the talk was scheduled"
The TRO was not filed until the 8th. They knew a permanent injunction would not hold up, so they waited until the last minute to request the temporary one. They had plenty of time, 9+ days, to work with the courts and the presenters and they didnt....
Tm
Support TBI Research: http://www.raisinhope.org
I was wondering why the talk was changed at the last minute. It was put on by a guy and it was mainly about the list of events about the discovery of the flawed cards. They are well aware of the flawed cards but are going to deploy them anyways.