Slashdot Mirror
Another EUSecWest NFC Trick: Ride the Subway For Free
itwbennett writes "At the EUSecWest security conference in Amsterdam, researchers showed how their 'UltraReset' Android app can read the data from a subway fare card, store that information, and reset the card to its original fare balance. The researchers said that the application takes advantage of a flaw found in particular NFC-based fare cards that are used in New Jersey and San Francisco, although systems in other cities, including Boston, Seattle, Salt Lake City, Chicago and Philadelphia, could also be vulnerable."
How would anyone ever catch you? These systems probably don't have network access, otherwise they would just read a token and then authenticate against a server, so all you have is log files. You could detect the fraud after the fact (if you somehow collected the log files), but to actually catch someone red handed would be pretty difficult.
.log files from different devices, unless the transactions are somehow manually collected and uploaded into a database. Even then, it would be an after-the-fact type thing.
Even if you did collect the log files, they may be useless. You would have to catch the same non-reloadable card bring used more than the maxumum number of times. To do that, you would probably have to analyse hundreds, if not thousands of
Copyright 2010. All rights reserved. This comment may not be copied in any way including, but not limited to caching.
I suppose the natural solution then would be to ban the app, possibly ban android phones with NFC capability, and/or threaten the security researchers with jail time. That's usually what legislators and law enforcement does... rather than, I don't know, fix the problem with the cards?
#fuckbeta #iamslashdot #dicemustdie
Back in the 80s they tried to introduce plain-clothes security officers on amsterdam trams to catch people who didn't pay for an honor-system ticket and got on anyway. The people of amsterdam had a referendum and votes that the officers had to wear unifroms, so that fare hoppers would have "a sporting chance" of running away when an inspector got on the tram.
That was my thought. Putting the balance for anything on the card itself is a terrible idea, unless you have no choice because readers won't be (reliably) connected to the larger infrastructure.
I suppose later reconciling could catch someone doing this, but I have to imagine it'd be really hard to enforce effectively.
That's not taking advantage of anything. The card's programmable, you programmed it. Congrats. That's like printing a transfer on your home printer. Same illegal it's always been.
So tell me again why these cards don't authenticate against a central reliable source? Oh yeah, we're replacing slips of paper, not brinks trucks with armed guards.
Right.
High-speed traffic is still controlled with painted lines, not concrete walls. Not everything is security-related.
No, not really. It happened before (2010) with the cards of those dim-witted nitwits of TransLinkSystems in the Netherlands.
A journalist hacked a TLS-card (although admittedly it was more at the level of a script-kiddy) and traveled for free, on camera etc, even showing how to do it.
Not quite sure what happened, but I believe the court dismissed the case because the value of the freedom of press and journalists being critical was more important than a company that isn't up-to-date (since 2007).
<sarcastic commercial tune>
TransLinkSystems, promising better since 2001
</sarcastic commercial tune>
Off-topic, but last week the same news-network (Powned) were voting in the elections for the new parliament wearing a burqa (and a hidden camera) and thus couldn't be properly identified. No problem for the multiculturalist doing the ID-ing, and the guy (yes a guy) voted with a fake ID of a woman and a voters-card of some other woman. Same here, probably it will be dismissed for the same reason. Good fun with those guy's.
rm -rf --no-preserve-root /
Why on earth would anyone store the balance on the card you give to customers? Isn't that kind of an open invitation to exploitation not to mention customer service headaches from people losing/damaging their cards?
Two of my imaginary friends reproduced once
http://fbi.gov/
- "Scientia non habet inimicum nisp ignorantem"
buses don't have a 100% live link
That is strange. When I called them up, they offered to bring me a copy and show me how to install it on my phone. They changed their minds when I told them I lived in Canada.
If I were God, wouldn't I protect my churches from acts of me?
Link to the Powned (yes it is called powned:) clip: http://youtu.be/3izaITMDAYg (in Dutch)
Transcript for the non-Dutch:
<anchor guy> Our Jojanneke showed us yesterday that even blonde women can crack the TLS-chipcard without a problem. The responsible company reacted frivolously because the hack would show up in their systems, and the authorities would be alerted. In other words, keep calm and carry on. But that was before they saw this news-item.
<Journalist 1> I can check in and out myself, simply by typing in the time that I want to be checked in, and upload it to the card. No signs in their back-office, this is undetectable.
<anchor guy> Yes indeed, now the TLS-card can be hacked even without TLS getting to know about it. The chance that the identity of the fraudulent traveller is to be unveiled is as good as nil. And that is what the responsible company is finally - although not enthusiastically - admitting.
<TLS spokes woman, Anita Hilhorst (to a journalist in a studio)>...At this moment our checks with detectors and inspectors do not show those transactions in our back-office,
<journalist in the studio> yeah, when I the conductor checks me, his machine just says that I am checked in.
<TLS spokes woman>...Yes...
<journalist in the studio> So then I dont have a problem and you are completely ignorant about it.
<TLS spokes woman>...then we cant see that ehhh ehhh in the transactions in our back-office
<journalist in the studio> So at that moment I am untraceable, and you cant do anything against me.
<TLS spokes woman> We aren't able to see that, no.
<anchor guy> And so definitively the TLS-card dies. Costing 3.000.000.000,- Euro, and nothing. The minister is summoned for a debate before parliament to explain what he will do about it. And here is some more ammo for the ladies and gentlemen of the opposition; the software needed is, since yesterday, downloadable from bittorrent sites. Cracking the TLS-card is now in reach for your grandmother of 82 years old.
<Jojanneke a.k.a. Pow-janneke> The cracking of the TLS-card is now made even simpler because the software is leaked to bittorrent sites, what does that mean?
<journalist> It means that anyone can download this, and since it is a very simple crack I am not surprised that it is put in the open.
<Jojanneke> This thing is also needed (hold up card reader), where to buy this? In a shop?
<journalist> Yes, it is about three tenner's, so anyone can go ahead with a TLS-card.
<Jojanneke> But can it be bought in a store?
<journalist> Yes, or on-line if they aren't sold out yet.
<Jojanneke> And we dont have to check in at the station, we can do this at home?
<journalist> yes, that is quite simple to do (shows program how-to) and because you do this at home, you are invisible to the back-office. The conductor just checks whether the card has been checked in or not, and that data is transmitted to the system at the end of the day, but by then you already left the train.
<Jojanneke> In other words, it is so simple even my grandmother can do this?
<journalist> Even your grandmother can do this easily
<anchor guy> Well and if this isnt bad enough, the hackers will present a new version tomorrow that will make it even more easy with new features like making mony with that card!
<Jojanneke> Hackers are busy to speed up the process to keep it within 15 seconds, what does this mean if the succeed in that?
<journalist> Well then it is so fast and easy that it becomes feasible to start a 'business' with that.
<Jojanneke> So they can recharge a lot of cards in a short while.
<journalist> Yes, you give me a tenner, and I put a hundred euro's worth of credit on it. And I have warned about this in the past that this might happen.
<anchor guy> If by chance you are slightly handy with computers, TransLinkSystems is looking for a fraud-manager that can monitor the security measures of the cards, stress-resistance is a pre.
Sorry for any mistakes made, but you'll get the message right?
rm -rf --no-preserve-root /
No, not in English, but here is the vid: http://www.youtube.com/watch?v=lvbZ3nsFf0M
rm -rf --no-preserve-root /
I suppose later reconciling could catch someone doing this, but I have to imagine it'd be really hard to enforce effectively.
Actually it's not that hard to catch those who use card with bogus amount
In a lot of cities, cctv cameras have been set up in mass transit system, in buses, trams and subway trains.
If the authority really wants to find out who are using bogus cards, they could compare the time stamp on the "embarking scan" with the time stamp on the CCTV to identify which person is using bogus cards.
Of course, catching the person only once is in itself not enough to convict the person. But, if the authority is able to proof that the same person has been using bogus card to get multiple free-rides mass transit system, they should have no difficulty to haul in that individual to the court.
Do not forget that we are living in the age of BIG BROTHER.
Muchas Gracias, Señor Edward Snowden !
Nice try, there's no chance this would work in Philadelphia -- they're still using tokens. (And magstripe for monthly/weekly passes, but definitely no NFC.)
The terminals don't necessarily have live network access, but they do get updates periodically; for example, when the bus gets back to the bus barn, they plug it in to transfer data. Thus, if you add value to your card with a credit card online, within a few days, every terminal has been updated to know that they may need to increase the value stored on your card, if a different terminal hasn't already added that value. It would be trivially possible to make this a two-way conduit, if it isn't already - save the data from the card to the terminal (eg current balance, or whether a fare was deducted), and correlate all the data. For example, if the balance ever goes up, make sure that they added value somewhere (either online or at a terminal or retail store). The hard part would be figuring out who you are from the available records (CCTV, usage records, etc.), especially if you pay cash.
That said, they probably won't care as long as only a few people are doing it. There have been much easier ways to game the system; for example, in the SF area, you could buy a card with $2 value, then use it for a ride that costs more than $2; the card allows a balance down to -$10, so you can get up to $12 from your $2 investment. Throw away the card with the negative value, buy a new one for your next trip, and repeat. Recently, they attempted to fix this by charging $3 for the card (in addition to any value you put on it), unless you also tie it to your credit card for automatic refills. I have no idea if this actually really fixes the problem or not - but they claim that such abuse was never rampant to begin with.
I believe that you use the NFC chip on the phone to program the card. The story speaks of efuses that aren't being used, so that would support that the phone programs the card.
Copyright 2010. All rights reserved. This comment may not be copied in any way including, but not limited to caching.
System abuse can be rampant. With the situation of The hard part would be figuring out who you are from the available records it is far easier to cancel the card and flag it as suspect. When the card is next used it doesn't work, triggers an alarm, and the card holder then gets to have a chat with an official about their card.
Most systems don't care about the negative balance reaping. Giving a percentage credit for auto and remote payments tends to fix this problem for the most part. Then they can isolate the individual cases where it is costing them money, your $2 for a $12 ride is a good example, and determine if it is worthwhile cracking down on those.
There is a new trick in Canberra. When you swipe your action bus prepaid card the machine makes a buzzing sound. Some kids have figured out that they can walk on the bus, hold a fried card to the reader making sure they obstruct line of sight of the driver, play the BEEP sound on their phone, and get on the bus for free. No need to swipe off.
The system here initially allowed for 'change of mind', so what happens is that you swipe on and if you swipe off in less than 5 minutes it negates the charge. So, people were swiping on at the front and swiping off at the back door meter. Alternatively, the first person swipes on, hands their card to the next person, who swipes off 30 seconds later. Ahh, youth these days. So charming.