FBI Nabs Chicago Transit Authority Radio Hacker

Wh15per writes "The Chicago FBI Joint Terrorism Task Force arrested an individual for misusing Chicago Transit Authority radio systems. Marcel Carter, 20, is charged with violating a US code that forbids interference with transportation operators. A federal complaint alleges he began using a radio to transmit on CTA frequencies in June 2008, often interjecting comments during communications between the agency's control center and train operators. The CTA claims Carter's radio communications were never followed, and passengers were never in danger."

Comments

Re:Why is public transport still living in stone a

[maxume]

A simple answer is that it isn't much of a problem (how many deadly incidents have there been in the last decade?) and there are thousands of radios.

Re:Why is public transport still living in stone a

[vlm]

For about a month, we had a moron that was transmitting on ATC frequencies

My point here is that I do not see a reason why public transportation systems still rely on decades-old, non-encrypted technology.

How would adding encryption to your transmissions fix the RF problem of a doofus transmitting on top of the valid transmissions? The cure for a DOS attack is not making the protocol more complicated thus even easier to overload.

Also, inevitably, what happens when the JFK airport IT department loses or screws up the key, and all communication is lost? Seems that AM is much more failsafe.

Re:Refreshing Change

[Jim Hall]

Oh, and can we reserve use of the term "hacker" for someone with at least a modicum of technical skills? This guy isn't even a cracker. All he did was talk on a stolen radio.

Mr Barn, I'd like to introduce you to Mr Horse. Oh, sorry - he seems to have run away already.

Gone are the days when "hacker" meant free-spirited computer programmer of the 1960's. Also long gone are the days when it meant home computer hobbyist. These days, assume "hacker" means simply breaks into stuff, or more generally "does something wrong using technology."

Use an exploit to "own" a server? Hacker. Break into your school's computer system and change a grade? Hacker. Impersonate the transit authority hub station using a radio? Hacker.

Re:Could be easily worse

[natehoy]

If CTA instituted a "read-back" policy like what is used in Aviation, they'd have very close to 100% security from invalid instructions at almost no cost.

If "Hackboy" tried to introduce an invalid instruction, even if he was on board the train or at the station so only one side could hear him, the transmission would be identified quickly. Even if Hackboy knew the lingo.

Example:
Hackboy: "Train 123 this is Control, the blockage ahead of you has been cleared, you are cleared to resume full speed."
Train: "Control this is Train 123, Iacknowledge blockage has been cleared, resuming full speed now" (starts to speed up)
Control: "Train 123 NEGATIVE. Train 123 this is Control. Blockage has NOT been cleared. Do not resume speed."
Train: (pulls back speed) "Control, this is Train 123, I have lowered speed, but you said just a second ago that the blockage has been cleared."
Control: "Train 123 this is control. No, I said no such thing. Continue slowly. Do not resume speed until you hear from me and have acknowledged."


Now the Controller and Train know they have a troublemaker in their midst, and the troublemaker has had no real opportunity to cause mischief. With AM, even if the troublemaker had tried to acknowledge and drown out the Controller's negative response, what the train operator would have received is a garbled mess probably containing the yelled word "NEGATIVE" or "DO NOT" somewhere, and he would have likely pulled back on the accelerator and requested clarification.