Slashdot Mirror
Cracking Atlanta Subway's Poorly-Encrypted RFID Smart Cards Is a Breeze
McGruber writes "Seven metro Atlanta residents are facing theft, fraud, and racketeering charges for allegedly selling counterfeit MARTA Breeze cards. Breeze cards are stored-value smart cards that passengers use as part of an automated fare collection system which the Metropolitan Atlanta Rapid Transit Authority introduced to the general public in October 2006. Breeze cards are supplied by Cubic Transportation Systems, an American company that provides automated fare collection equipment and services to the mass transit industry. At the time of this slashdot submission, the Wikipedia page for the Breeze Card (last modified on 2 August 2013 at 14:52) says: 'The Breeze Card uses the MIFARE smart-card system from Dutch company NXP Semiconductors, a spin-off from Philips. The disposable, single-use, cards are using on the MIFARE Ultralight while the multiple-use plastic cards are the MIFARE Classic cards. There have been many concerns about the security of the system, mainly caused by the poor encryption method used for the cards.'"
Old MiFare stuff is toast, security wise. Any old fool can order some UID-writable tokens on eBay from China, grab a copy of libnfc and mfoc, then things get interesting pretty quickly.
I don't understand why these systems are set up like this, operationally it's not much different from EZ-Pass which works fine with an account based system, putting the value tracking on the cards is just asking for an upgrade treadmill even if it's well designed now, 10 years from now it will be easilly cracked. compare CPU vs GPU/FPGA/ASIC hashing advances
Snowden and Manning are heroes.
Like everything:
If you can buy the readers, and someone obviously sells the writers somewhere, you can clone them.
As soon as you then rely on these tokens to hold individual data themselves (with no reference to a central database), then they become valued targets for attack.
If you had these cards hold nothing more than a code number, and wired all the readers to talk home, then the system can't be "scammed" as such - people can have their cards cloned, of course, but you can spot it, you can trace them, arrest them at your convenience, and give the original account holder a new card in the meantime as soon as they report the fraud. But because everything has to talk to a central database, the cards are not so much "cash" as a stolen "credit card" - traceable, and stoppable.
Then, it doesn't matter if you do use something as common as MiFare (a school I used to work in used Mifare entry systems - they weren't expensive or hard to get hold of at all and I used to program my Oyster - London Tube travel - card to open the door for me in the morning if I'd forgotten my ID card). As soon as the readers are that commonplace, the writers will be available even if that means people are building their own and making fake "cards" the size of a Raspberry Pi with some RF circuitry to pretend to be a card. The next step is just a matter of shrinking the device.
MiFare is long-cracked. You can buy the cards for pence each and the readers (direct to USB, etc.) for a pittance. The next step up is no harder than going from magstripe readers and cards up to magstripe writers with the correct magstripe "level" to read/write the banking data on an old magstripe credit card.
Don't put "value" into a chip that can be cloned. Put the value into a central, monitored, system, and provide people only with a codenumber to access it. That codenumber can be cloned still, sure, but then you can watch out for it, notice it, blacklist it, catch people red-handed. And they can't go spending "free money" offline from your system.
This is my biggest bugbear with London's Oyster system. It's just a number for the most part, but they try to store "value" on the cards and let you buy newspapers with them. Now you have an offline, valued, unmonitored, commodity on an easy-to-clone chip.
.
Fare cards, gift cards, credit and debit cards used at Target, etc.,.etc,. etc...
When are we going to make our erzatz money secure?
So it's a breeze to crack Breeze card encryption? Yuk yuk yuk, you're hilarious.
What about any detail at all about this? What "weak" encryption do they use? How was it broken? What was the value of the fraud? Can these cards be used for anything else, or cashed out, or does this fraud require very extensive MARTA ridership?
Seven people have been charged with fairly serious crimes, but I can't see the value of the fraud being more than a few hundred or few thousand dollars. It's like counterfeiting $1 bills, what's the point?
It's very different to EZ-Pass. All EZ-Pass needs to do is identify you. You don't get your current balance, nor do you get denied access to the road/bridge if your EZ-Pass isn't in credit/isn't active/etc.
EZ-Pass works because they have a backup mechanism, being video/photographs of license plates so they know who to charge if they can't charge through EZ-Pass - obviously that doesn't work for public transport.
Like most of the other government run entities in Atlanta, Marta is run by inept management and awards bids to cronies and
relatives. I am not surprised the system was outdated and ineffective.
you don't have an 100% live data link with systems like this (lot's of metro systems have both bus and rail and there can be cell dead zones that have areas with no data link) and you don't really have a away to bill later if there is some kind of read error.
Your somewhat lengthy description misses the key point that these things have to be usable in places where there is no data connection to a centralized database (e.g. on a bus), and so, they MUST contain value which can be locally (with no reference to a central database) validated and decremented.
I suppose you could do what credit card companies do for small transactions ($50).. always allow, but record the transactions, and go back later to reconcile. If someone "overdrew" their account, you could go after them after the fact. But then, you need to have a "tie" between a specific card and a specific person, which raises all sorts of privacy issues.
You also need to be sensitive to the aspect of "acceptable losses". In some cases, it is cheaper to let some fraud happen than it is to implement a more complex, expensive, and failure prone system to grind those losses down to zero. This is something the credit card companies have to a finely researched science. This is the primary reason why chip&pin isn't being used in the US. The fraud losses aren't quite high enough to justify the cost of replacing all the cards and readers.
There have been a number of studies over the years that show that "honor system" fare collection actually works pretty well, with random manual checks by transit police. Yes, there are people who cheat (but then, there are people who hop the turnstiles, too), but *most* people pay their fare. And you save all the costs of fare collection boxes, terminals, readers, etc.
Mind you, the companies who sell such boxes make the claim (not necessarily substantiated by data) that their costs are paid for in increased revenue, and are happy to whip up the political troops about "fraud waste and abuse".
Naturally if they're going to spend the money on a secure system it might as well fulfill that goal. But do these metro metering devices really need to be all that secure? I checked MARTA's fare schedule and their most expensive ticket is $5 round-trip. Doesn't seem like enough incentive for the average joe to cheat it, esp. when you consider how transit authorities use a few high-profile prosecutions to discourage people from even buying second-hand tickets let alone hacking their own. In my view the system only need be marginally more secure than the honor system.
Bit of a tangent, but this story got me thinking about this: http://shamonica.com/2012/05/wizard-spotting-wizards-on-the-bus/
If I am not going to use cash, I'd prefer to use a token that is cash-like:
* is transferable like cash
* can't be tied back to me
* isn't widely counterfeited, so I'm not subsidizing freeloaders
* is convenient to use
Except may be for the counterfeiting part, subway tokens and prepaid fair passes generally meet this requirement.
I don't have any inherent objection to something that operates like a prepaid debit card, as long as I can purchase it anonymously without any additional fees beyond the fair itself. Just don't be surprised if I buy a new card every few weeks instead of reloading the existing one.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
And this is why stored-value cards should have MAX_VALUE and EXPIRATION_DATE hard-coded into them.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Out of curiosity, how much revenue comes in from fares, and how much expense goes out in fare maintenance?
A lot of metro systems charge fares in addition to getting public support from taxes. Has anyone thought to tally the costs of the fare system compared to the income? Things like cost of the machines, maintenance of the machines, maintenance of the turnstiles, accounting, law enforcement &c... all these things add up.
Even if the fares bring in revenue, it's probably minor. Most of the cost goes into collecting the fares, so most of that value is wasted.
The economy would get a boost if that money were freed up to be spent by consumers, and doing so would help the people who need it the most (ie - poor people).
This whole thing seems like a fabricated problem - a system that forces people to spend money just for the sake of spending it. Then spend more money reimplementing the system when the original system is found to have flaws, then spend countless hours and resources in enforcement and prosecution.
Just get rid of it. Let the money go into the economy.
1.Why are these things so weak and easily broken
2.Why don't the companies that make them invest a bit more money in making them harder to break (instead of on lawyers to sue people who break them)
and 3.If the companies that make them wont fix them, why isn't someone else offering systems with stronger encryption?
As someone who reads without having to sound out every word for possible homophones, it's really frustrating when the wrong word is used.
MARTA - Moving Africans Rapidly Through Atlanta (or so the locals call the system).
It's probably wrong to, but I applaud the hackers. It's really only the poor folks in Atlanta that use the system (everyone else drives) and every little bit they can save helps.
It's is not, it isn't ain't, and it's it's, not its, if you mean it is.
If you don't, it's its. Then too, it's hers. It isn't her's.
It isn't our's either. It's ours, and likewise yours and theirs.
-Oxford University Press, Edpress News
See how easy that was?
Comment removed based on user account deletion
It's not to distribute cash.. It's to provide political cover to respond to TEA types... Gol durnit, I demand that the illegal alien riding the subway pay a fare and not suck off my 'murican taxes. I think highly of our soldiers (but haven't actually served) and we need to protect murica against freeloaders. Gol durned socialists and communists.. Keep your effen hands off my Medicare and Social Security.
MARTA receives 55% of its revenue from fares. (http://www.itsmarta.com/uploadedfiles/About_MARTA/Reports/AR-FY12-Full12-31FINAL.pdf, see second-to-last page)
21% of revenue comes from sales taxes; 15% comes from the US Federal government, and the rest comes from advertising, leasing or interest income, or debt. (MARTA receives no funding from the state of Georgia)
One problem specific to MARTA is the fact that many riders live outside the MARTA sales tax region (Fulton and Dekalb counties) and thus any money put "back into the economy" would not necessarily benefit the transit system. Riders from the broader region (Cobb, Clatyon, Gwinnett counties) pay nothing into the MARTA system except fares.
Storing value on a or other physical token that is clonable and/or manipulable basically means you can create 'value' out of nothing. This is government sanctioned. Created value isn't taxed, can be used a anonymously as cash, and can be used to transfer money (real or fake) without the governments knowledge. Granted, I don't see your local drug dealer accepting cloned MiFare cards... actually, chances are local organised crime already distributes them, so they are already part of the same economy, so if they can be sold, they could be accepted. But bitcoins are bad? I don't get it.
Love it, this is the style of card they want to change you to, instead of a magnet strip, too a RFID, which is crackable, and by near field. Aluminum foil anyone?
It does tell you your balance is low so I don't think it's entirely static
Did you expect these crackers to be proactive against hackers? I think not. They invest far more in being proactive against "blackers." I have been to Atlanta scores of times and it is a joke of a metropolis. Nothing of worth is going on down there and oh yeah, you better own a car.