Slashdot Mirror
Aussie Researchers Crack Transport Crypto, Get Free Rides
mask.of.sanity writes "Shoddy customised cryptography by a state rail outfit has been busted by a group of Australian researchers who were able to replicate cards to get free rides. The flaws in the decades-old custom cryptographic scheme were busted using a few hundred dollars' worth of equipment. The unnamed transport outfit will hold its breath until a scheduled upgrade to see the holes fixed."
Aussie crypto researchers transporting crack get a free ride.
Shoddy customised cryptography
Brought to you by the Department of Redundancy Department.
Governments give these contracts to retarded companies, simply because they offer to do it for a lower price than "proper" companies would.
Same exact thing happened in the Netherlands, Trans Link Systems got the contract for the "Public transit chip card", it was hacked in a week. An improved, "unhackable" version was also cracked when it was released.
The problem with these companies mostly is that they think security through obscurity actually works, which is pathetic.
Hopefully theft won't become widespread, both because it will have a negative impact on public transport systems AND it will have a huge negative impact on anonymity. I just checked out Victoria's MyKi system(which was not the one they cracked, but I imagine the one they cracked offers similar services) and they still have an option to buy anonymously.
However if theft becomes a huge problem I can quickly see that option going away in the name of deterring theft(note that I am not defending the practice, simply stating what will probably happen). After all you are much less likely to try to score a free ride if your name is attached to the ticket. I quite like being able to travel conveniently without being tracked(*puts tinfoil hat in murse*)
Monstar L
The article contains absolutely no information about what the vulnerability was. Have anybody been able to find a link to the actual presentation?
Do you care about the security of your wireless mouse?
http://www.thinkpenguin.com/
Freedom friendly hardware. Much of it is not as suseptable to these attacks although there are so many places to hide...
The real risk is the most common components. What chipset is used in nearly every system? These are the ones I would target.
Can be found here.
I worked out how to get a free train ride in adelaide, and I didn't even need any custom equipment.
If the trains don't know the time, they stamp an error bit flag on the mag-stripe ticket. The gates that let you out, supposedly only if you have a ticket valid for that time, will let you past if you have an error bit. And there's no time limit.
"Nobody Seems To Notice" I guarantee to you that someone noticed and has been exploiting it for a while now. I know guys that have cracked the Chicago system for years now, wait... for over a decade now. Maybe Chicago has updated their ticket system, but I doubt it. Municipalities dont care if a system is cracked until it is widespread abused. If only 400 people in a city the size of Chicago are getting free rides, they dont even show up as an accounting anomoly. Imagine how many in NYC have figured out it's holes and are exploiting them.
People notice and people take advantage of it.
Do not look at laser with remaining good eye.
This was cracked a number of years ago apparently because it used a simple linear feedback shifter as a random number generator which meant the code were easy to guess. Or something along those lines , I can't fine the article at the moment
LU said they'd be "improving security" and then we heard nothing more about it. Anyone know whats going on these days?
"If public transport were run by government off taxes"
Except they're not. No major PT system in the world is run completely off taxes and is free to the end user. They all collect fares in some fashion. And if you think about it , why should people in one part of a country pay via taxes for people in some city hundreds of miles away to ride for free?
I expect most transport systems have inspectors already to catch people jumping barriers or coasting in and out behind other people. So the faker is going to get caught eventually. If they're really unlucky the inspector will compare the printed data on the ticket to the data on the stripe using a portable reader and call the cops.
Some transport systems don't even bother with barriers and rely exclusively teams of inspectors. e.g. Dublin's Luas tramline has no barriers so there is nothing to stop someone riding for nothing. To enforce the ticketing system it is not uncommon to see a team of 4 or 5 ticket inspectors board without notice and systematically sweep the train for either end. People with no tickets risk huge fines so you'd have to be pretty dumb to ride this way, fake ticket or not.
make a fence unnecessary.
It defines the social border, the socially accepted line.
Crossing this line involves a reaction from the society, which wants to defend its norms.
If I were an Australian General Prosecutor I would suggest 2 -3 years of imprisonment to these group of young researches so that the next time they would think twice before forging public transportation tickets.
The transit system in question is 5-7 years old - or less depending on which one they refer to. The crypto is old, but the smartcard transit system isn't. Fail. How do I know? Because there are no older transit tag systems in Australia.
And how many thousands of dollars worth of skilled security researchers' time?
There is no music - home taping killed it.
"Except there's no rason they can't be."
Sure, if the government has unlimited funds. Most don't. Usually there are more important things to spend money on.
"Are public transport systems only for other people? No."
Huh?
[NB: the 07 AA is understood, the 21 02 08 I am unsure about, and the rest with it the obvious data repetition / incrementation, i can't help but feel the timestamp is staring at me!]
I agree with the above poster that is most likely City Rail in NSW, by a process of elimination:
- Only 5 cities in Australia have public transport rail networks.
- Melbourne have recently introduced Myki - good case study on how not to do it, so they are unlikely and the article states this
- Brisbane use Oyster Card, unlikely but if it is then this is a much bigger story
- Perth uses Smartrider, a smart card system.
- Adelaide have used MetroTicket which contains a magnetic strip developed by Crouzet-SA. A smartcard system is in the process of being rolled out
The RailCorp is being split in two article has some pretty cutting statements about the inefficiency of government run enterprises and entitlement mentality. Solving this will not be simple, and as other posters have commented the problem is the organisation. I'd advise potential vendors to think of a price and triple it. There is a reason some government organisations are charged a premium and yet the vendor still makes a loss.
Posting this as an Anonymous Coward, because I have a bit of experience working as a vendor to RailCorp NSW. Let's just say they are a "challenging" client.
So the public service paid for crypto and got it. Theses kids buy a card reader and card makers and probably use an open source crypt o program wala instant security searchers?
Jack of all trades,master of none
So if you had a shop next to the train station with only a few hundred dollars of equipment they could sell discounted train tickets, right?
The problem with this sort of thing is there is no real need for a great deal of authentication on transit systems. If you are going to go to the trouble to forge tickets, you are probably no real threat the system's revenue because of the huge investment required. Once you become a real threat, you are going to get caught and the jail time will not be pretty. Most countries will add onto the charges of simply riding without paying a fair because this was done a lot and is "willful".
So, is being able to make forged tickets worth 10-15 years in prison? Who cares if they used a low-bidder for the authentication. It is good enough for 99.9999% of the population and is producing revenue. Would any sane individual decide that millions, tens of millions or even hundreds of millions of the local currency should be spent to "secure" the system? Sounds like complete idiocy to me.
Sure, the system is insecure, but so is every other system on the face of the planet. I'm sure using a forged ticket is already a crime, but all they have to do is make selling forged tickets a serious crime and the problem is a non-problem.
I see the problem; zeroes. You data is littered with zeroes.
I swear to God...I swear to God! That is NOT how you treat your human!
Don't be a smartass, you know exactly what I mean. And do explain why people who don't use a service should pay just as much for it as people who do in this socialist nirvana you've dreamt up?
With a Mifare 1k card to store just timestamps, I guess they had space to burn ;)
Correction. After reading the presentation, it's clear that this is not a smartcard system, it's a magentic strip system. That means it isn't Western Australia's SmartRider, and WA's old MultiRider magnetic strip system has been retired for 5 years so it's not going to be MultiRider.