Hackers Get Free Parking In San Francisco

Hugh Pickens writes "PC World reports that at the Black Hat security conference this week, security researchers say that it is pretty easy for a technically savvy hacker to make a fake payment card that gives them unlimited free parking on San Francisco's smart parking meter system. 'It wasn't technically complicated and the fact that I can do it in three days means that other people are probably already doing it and probably taking advantage of it,' says Joe Grand. 'It seems like the system wasn't analyzed at all.' To figure out how the payment system worked, Grand hooked up an oscilloscope to a parking meter and monitored what happened when he used a genuine payment card. Grand discovered the cards aren't digitally signed, and the only authentication between the meter and card is a password sent from the former to the latter. Examining the meters themselves could yield additional vulnerabilities that might allow someone to conduct other kinds of attacks, such as propagating a virus from meter to meter via the smart cards or a meter minder's PDA."

Comments

Parking Meter Botnet

[sopssa]

Examining the meters themselves could yield additional vulnerabilities that might allow someone to conduct other kinds of attacks, such as propagating a virus from meter to meter via the smart cards or a meter minder's PDA."

I, for one, welcome our new parking meter botnet overlords.

Re:Parking Meter Botnet

[jellomizer]

Yes I am upset by this.
If more then just a small handful of people start doing this then they will raise the price for parking for the people who do it legally.
They may have to go and fix the system causing us to pay for it in taxes, as well future systems will need to be more expensive as they need to deal with hackers breaking the system all the time.
The reason for meters besides revenue collection is to control the availability of parking spots. Metered parking helps keeps store front spots open for customers. As well keeps abandoned or broken cars sitting indefinitely in good parking spots.

Re:Parking Meter Botnet

[Shaltenn]

Maybe the fact that 90% of the time people don't have change on them? Society as a whole is becoming a lot more dependent on ATM cards, credit cards, etc as opposed to cash money. This means that people don't have coinage nor dollars, but instead a plastic card in their wallet. I have seen machines that take cards and coins and even dollar bills. This seems like the best idea. Any te

Re:Parking Meter Botnet

[xaxa]

what was wrong with coin operated meters? Why do they need computers?

Crimanal gangs target coin operated metres. For instance, "Cashless parking was trialled in Westminster [London] in October 2006 and in early 2007 the decision was taken to extend cashless parking city [of Westminster] wide. One of the primary drivers was the estimated £120,000 per week being lost to organised crime. Organised crime which led to murder on the streets of Westminster." (The murder was after one gang started taking the money from meters in another gang's "territory").

A metal detector under the parking space and a camera nearby, and the computer could automatically issue a ticket (or automatically bill for the correct duration). And tell drivers how many spaces are available.

Re:Parking Meter Botnet

[sortius_nod]

I remember doing an easier hack on the parking meters in Newcastle AU. Grab a used Telstra smart card phone card, shove it in, meter breaks, free parking for a few days for everyone.

It seems that the parking meter OS was unable to handle cards that didn't send the right data back, so went in to "out of order" mode.

I suppose they got wise on these kind of simple hacks and changed the smart card system.

Re:Parking Meter Botnet

[Aceticon]

Many cities around the world deploy parking meters in places where there is no lack of parking places as a form of revenue for the local authorities.

Also parking meters are usually deployed in such a way as to eliminate all other parking alternatives (if the purpose was to make parking spaces available for those who really need it, then only some of the places would need to be made "premium" with parking meters while most spaces would remain free)

To further enhance the income from parking, most parking meter systems are also designed in such a way (pay first) that users either have to overpay (pay more time than you use) or are hit with significant fines for going overtime.

This is why most people hate parking meters and other paid parking system in public spaces.

I for one welcome our new parking meter infecting virus overlords.

Re:Parking Meter Botnet

[Rasperin]

What are you talking about, it's very expensive to fix. First you have to pay for the code updates, that's going to be a million, take a year, and be delivered late. Then, you have to do a mass software update, that's going to be another 10 million. Then lastly, the most expensive part, a "hardware update" issuing new cards to be compliant with the new standard to match. I don't even want to dream how much that would cost.

*My numbers may be artificially inflated from working with IBM.

Re:Parking Meter Botnet

[blueskies]

They made that decision when they bought shitty meters.

The usual solution

[drgould]

The usual bureacratic solution in a case like this is to make it illegal to hook-up oscilloscopes to parking meters in San Francisco.

Re:The usual solution

[n1ckml007]

Sir is that an oscilloscope in your pocket... ?

Re:The usual solution

[kimvette]

Sir, do you have a concealed oscilloscope permit?

Re:The usual solution

[JustOK]

in a sinusoidal manner

Re:Portable Oscilloscope?

[rodrigoandrade]

Geez, at those prices, wouldn't it be cheaper to just pay for the damn parking card???

l0pht

[Anonymous Coward]

For reference, Joe Grand is one of the members of the l0pht hacker group that were announced to be making a comeback [url=http://news.slashdot.org/story/09/07/26/167251/Hacker-Group-L0pht-Making-a-Comeback?art_pos=1]here[/url]

Re:Free parking! Just uh.. oh crap.

[Canazza]

He was probably wearing a high-vis jacket and wearing heavy leather gloves. He'd have looked like an ordinary electrician. If anyone asks he was 'reparing' the meter.

Re:"other people are probably already doing it"

[Vellmont]

Would it have been better to have a system with a few hackers taking advantage and skipping some parking fees, versus a now-comprimised system

Stupid knowledge! You just ruin it for everyone. If only we'd be more ignorant and stick our heads in the sand there would be no problem.

Did you ever think that someone beyond curious hackers looking for a few free hours of parking might be interested in this? Like say.. criminals selling counterfeit parking cards at 1/3 the price?

Re:Free parking! Just uh.. oh crap.

[value_added]

He was probably wearing a high-vis jacket and wearing heavy leather gloves. He'd have looked like an ordinary electrician. If anyone asks he was 'reparing' the meter.

San Francisco may be different, but I'd imagine that in most cities, if someone was seen beating a parking meter with a baseball bat, people passing by would nod approvingly, or perhaps cheer.

10 spaces away

[surmak]

In Monopoly just remember what is 10 spaces away from free parking (actually, in either direction). Something tells me that those who try this "Free Parking" trick may well end up rolling a pair of fives on their next move.

Do not pass go, do not collect $200.

Re:Free parking! Just uh.. oh crap.

[langelgjm]

Indeed, that sort of social engineering is all about looking the part.

I once knew someone who was able to swipe an unused payphone in broad daylight at lunchtime on a busy strip with lots of outdoor seating. The trick? Navy blue pants, blue "repairman" style shirt, a tool bag, and looking like you are supposed to be doing what you are doing.

Finding a space.

[bezenek]

Having a hacked card is of no use if one cannot find a parking space. Most people who have attempted to park in SF know the time wasted finding a space is usually worth more than the cost of the parking.

Nevertheless, hacking the system is interesting.

-Todd

Drawing attention to the problem

[russotto]

So the hackers, having figured out how to rig the meters, set up their own meters at a few places in the city. With them they place large signs "Hacker Parking Only, Everyone Else $1,000,000". One day they notice a Porsche 959 pull up to the meter. A somewhat geeky looking man in his mid-50s gets out, looks at the sign, places a card in the meter, and it flips over to "2 hours paid". One of the hackers then walks up to the man and says "Hey, Bill Gates! I knew you started out as a hacker but I didn't know you still kept in the game!". And Gates says "What hack? I just paid the meter".