Slashdot Mirror
Aussie Researchers Crack Transport Crypto, Get Free Rides
mask.of.sanity writes "Shoddy customised cryptography by a state rail outfit has been busted by a group of Australian researchers who were able to replicate cards to get free rides. The flaws in the decades-old custom cryptographic scheme were busted using a few hundred dollars' worth of equipment. The unnamed transport outfit will hold its breath until a scheduled upgrade to see the holes fixed."
Aussie crypto researchers transporting crack get a free ride.
Shoddy customised cryptography
Brought to you by the Department of Redundancy Department.
Governments give these contracts to retarded companies, simply because they offer to do it for a lower price than "proper" companies would.
Same exact thing happened in the Netherlands, Trans Link Systems got the contract for the "Public transit chip card", it was hacked in a week. An improved, "unhackable" version was also cracked when it was released.
The problem with these companies mostly is that they think security through obscurity actually works, which is pathetic.
Hopefully theft won't become widespread, both because it will have a negative impact on public transport systems AND it will have a huge negative impact on anonymity. I just checked out Victoria's MyKi system(which was not the one they cracked, but I imagine the one they cracked offers similar services) and they still have an option to buy anonymously.
However if theft becomes a huge problem I can quickly see that option going away in the name of deterring theft(note that I am not defending the practice, simply stating what will probably happen). After all you are much less likely to try to score a free ride if your name is attached to the ticket. I quite like being able to travel conveniently without being tracked(*puts tinfoil hat in murse*)
Monstar L
Can be found here.
Almost guaranteed that the rail systrem is the City Rail, the NSW rail system. Their ticketing system is a nightmare, and has been the subject of multiple botched upgrades over the last couple of decades, costing millions of dollars. The latest plan is to upgrade to London's "Oyster Card" technology (renamed Opal card), but I'll believe it once I see it. The current tickets are just a piece of cardboard/plastic with a magnetic strip. Trivial to read, and most likely (as has been found out) trivial to decode.
In fact, when you do the numbers, it would be cheapest for the NSW government to abolish ticketing all together. The money saved on the (absence of a) ticking system and the reduction in road use would exceed the current revenue from tickets.
"Nobody Seems To Notice" I guarantee to you that someone noticed and has been exploiting it for a while now. I know guys that have cracked the Chicago system for years now, wait... for over a decade now. Maybe Chicago has updated their ticket system, but I doubt it. Municipalities dont care if a system is cracked until it is widespread abused. If only 400 people in a city the size of Chicago are getting free rides, they dont even show up as an accounting anomoly. Imagine how many in NYC have figured out it's holes and are exploiting them.
People notice and people take advantage of it.
Do not look at laser with remaining good eye.
The transit system in question is 5-7 years old - or less depending on which one they refer to. The crypto is old, but the smartcard transit system isn't. Fail. How do I know? Because there are no older transit tag systems in Australia.