Slashdot Mirror
With Lawsuit Settled, Hackers Working With MBTA
narramissic writes "The three MIT students who were sued earlier this year by the Massachusetts Bay Transit Authority for planning to show at Defcon how they had had reverse engineered the magnetic stripe tickets and smartcards said Monday that they are now working to make the Boston transit system more secure. 'I'm really glad to have it behind me. I think this is really what should have happened from the start,' said Zack Anderson, one of the students sued by the MBTA."
FTFA:
1. Prevent them from giving their talk
2. Judge threw out the gag order
3. Amicable???
The settlement ends the matter in an amicable way.
The article fails to really specify end results, but it sounds like some kind of job deal was worked out where the kids will help improve security.
Development notes at http://devscribbles.blogspot.com
Common sense finally prevailing? Has hell frozen over?
On one hand I'm surprised that the MBTA has decided to work with these guys to make their system more secure, on the other hand I wish this would happen more often instead of the mindless suing that government organizations and other companies seem so fond of.
Veni, Vidi, Velcro!
To have lost a suit?
Knowledge must be free or freedom is compromised. If that information is somehow 'embarrassing', to damned bad as its part of the price of freedom.
---- Booth was a patriot ----
YMMV, but they usually won't offer you a job unless (1) you don't cause trouble and (2) you politely let them know about it and (3, optional) you offer a workaround or a fix.
More likely, if you're caught hacking then you'll be confined to monitored house arrest and unpaid servitude as an FBI snitch-bitch. And that's after making the deal which will keep you out of prison.
Okay, so fundamentally, the MBTA's goal is to prevent the kids from making their knowledge public. The kids' goal is probably to make a name for themselves, and maybe do something cool by defeating the MBTA's security.
The judge threw out the gag ording, which I assume means the kids can legally make the knowledge public (even if they'll be sued later). By "hiring" the kids to make recommendations on their security, everyone saves a bunch of legal costs, the MBTA keeps the kids' from going public with the exploits, and the kids still get to make a name for themselves, and maybe make a few dollars. Everybody wins. That doesn't mean the MBTA actually cares about anything the kids have to say in their recommendations.
I haven't been able to find it in my brief perusal of the link... does anyone know offhand if the MIT students asked permission first, or if they just did it, planned the talk, and then got in trouble?
If the former, MBTA is messed up. If the latter, I would have to honestly say that the MIT students should have thought about what they were doing and asked before they decided to hack something and tell others how to do it.
If someone asked me if they could do a security audit on my house and I said sure, that'd be cool. If they broke in, were going to give a talk about it to some other dudes and THEN I found out about it, I'd be a bit upset, too. Would I want to fix my security, sure, but I'd be kinda mad they did it without asking. Just because you CAN break in doesn't mean you have a right to do it, it's still MY property, not yours...
The Transit Authority's SLAPP lawsuit has served its purpose: it prevented the students from speaking at Defcon. In the end there was no judgment sought, for no judgment was necessary in order that the Transit Authority's wishes be granted in full. The speakers were silenced without trial, and now we're told this should be interpreted as a kind of "happy ending".
It's not a happy ending. It's sad. Very sad.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
Interestingly, they really didn't meet any of the conditions you stated!
A couple of bits from the first link:
The passage in the Defcon show guide describing their talk begins, "Want free subway rides for life?" That line was removed from the description of the talk posted at the Defcon Web site.
Can't see that as not causing trouble (at least from the MBTA's perspective...)
The researchers refused to give the transit authority information about security flaws in its system ahead of the talk, the filings state.
Which is not particularly polite - and in fact definitely takes them out of any resonable definition of "White Hat"...
And while hacking around on a smartcard they bought shouldn't be illegal (as long as they don't actually use it for free rides), this bit:
They say they were able to access fiber switches connecting fare vending machines to the unlocked network
is the kind of thing that gets people under said house arrest...
To be honest, these guys were pretty lucky for the way this whole thing turned out. They freely admitted in their published talk that they illegally accessed a gov't network and planned on explaining how to get "free subway rides" to a room full of hackers without revealing how to the gov't organization about to get screwed over... at the very least they could have expected a protracted court case that made their life hell for the next couple years...
Many organizations, both governmental and corporate, have a tendency to react to employees (or consultants) finding security problems by harrassing, firing, and/or suing them. We already know that the MBTA has management that takes this approach. So the kids should be carefully documenting everything they do, with an eye towards defending themselves from or countersuing the MBTA for the MBTA's actions against them if they do their job well.
Something I've been noticing in particular is that when I read management characterizations of security "hacking", it almost always sounds like a description of what I do routinely as part of all software debugging. In the eyes of management, the media, and the courts, all software developers are "hackers", and they mean this term as a criminal indictment. We are all suspect, especially when we give them bad news about what their systems are already doing.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
I know this goes against the Slashdot perception of how these "kids" were sweet, innocent little virgins who did no wrong, but:
Then, they used the modified MiFare cards in gates- they had photos showing them using the cards in gates. That's THEFT and FRAUD, people. You can't walk into a bank, cash a fake check for $500, and then publish a paper and say "the banking system is insecure!", and be shocked and amazed when you're charged with forgery and uttering.
Please help metamoderate.
The problem is there was a implementation of a system with some potential exposures that nobody was exploiting. Quite possibly, no exploitation was because of a lack of knowledge rather than any impractacality of the exploit.
Sure, everything could be made more secure. Did you know that there are only about 100 unique car key "encodings"? This means that if you have a Ford the chances are excellent that your key will open the door of some other Ford in an airport parking lot. Or a mall. Why isn't this a huge problem - it sure sounds like it is a huge exposure, doesn't it. Well, partly it isn't exploited because nobody knows about it, or almost nobody.
Security by obscurity works and it is cheap to implement. Actually closing all those holes can be extremely expensive and in the physical world it probably doesn't work any better.
So how do you avoid spending millions of dollars for needless security? Well, first off you can strongly discourage security probing. Next, you can defend your obscurity because it is cheaper than fixing the holes someone discovered.
Which is better in the public interest: having a truely "secure" transit card system or preventing the disclosure of information that will certainly lead to exploits? It almost doesn't matter how much fixing the security might cost as long as it is $1 more than keeping the holes secret and defending against probing.
Do we really want public institutions spending large amounts of money to make things "secure" when exploiting holes in public infrsstructure is illegal anyway?
Paying these folks anything, even fifty cents, just encourages more people to follow in their footsteps.
Considering all you need to do to "hack" MBTA's system is to use last year's card for that month, I hope the awesome brainpower of MIT can improve the situation somewhat.
I use Windows... like a two dollar wh.. why don't I just go ahead and not finish that sentence.
You're reading verbatim the brief where the MTBA lies their butt off. The students were not only fully in the right, but 110% - they offered all relevant information, were not planning to provide any illegal or directly damaging info in their talk, etc etc. The MBTA wasn't willing to listen, fix their problems, or even admit they had one - the bureaucrats running it were more interesting in covering things up, which is how this whole fuss got started.
Interestingly, they really didn't meet any of the conditions you stated!
A couple of bits from the first link:
The passage in the Defcon show guide describing their talk begins, "Want free subway rides for life?" That line was removed from the description of the talk posted at the Defcon Web site.
Can't see that as not causing trouble (at least from the MBTA's perspective...)
The researchers refused to give the transit authority information about security flaws in its system ahead of the talk, the filings state.
Which is not particularly polite - and in fact definitely takes them out of any resonable definition of "White Hat"...
And while hacking around on a smartcard they bought shouldn't be illegal (as long as they don't actually use it for free rides), this bit:
[snip]
From another FA
The students said they tried to contact the MBTA around July 20 through their professor Ron Rivest, who teaches in MIT's Department of Electrical Engineering and Computer Science, but did not actually connect with the agency until around July 30.
It's been a crazy week for Anderson, who looked haggard -- he said it took him 18 hours to travel by air to Defcon and he had not slept since Thursday.
And another:
Mahoney [the MBTA attorney] praised a security analysis the students had prepared for the agency, saying the information in it convinced them of the vulnerability.
Looks like you're wrong, or one of TFAs is wrong anyway.
$ make available
So California's Prop 8 was wisdom?
Non impediti ratione cogitationus.