Slashdot Mirror
Cracking Atlanta Subway's Poorly-Encrypted RFID Smart Cards Is a Breeze
McGruber writes "Seven metro Atlanta residents are facing theft, fraud, and racketeering charges for allegedly selling counterfeit MARTA Breeze cards. Breeze cards are stored-value smart cards that passengers use as part of an automated fare collection system which the Metropolitan Atlanta Rapid Transit Authority introduced to the general public in October 2006. Breeze cards are supplied by Cubic Transportation Systems, an American company that provides automated fare collection equipment and services to the mass transit industry. At the time of this slashdot submission, the Wikipedia page for the Breeze Card (last modified on 2 August 2013 at 14:52) says: 'The Breeze Card uses the MIFARE smart-card system from Dutch company NXP Semiconductors, a spin-off from Philips. The disposable, single-use, cards are using on the MIFARE Ultralight while the multiple-use plastic cards are the MIFARE Classic cards. There have been many concerns about the security of the system, mainly caused by the poor encryption method used for the cards.'"
Old MiFare stuff is toast, security wise. Any old fool can order some UID-writable tokens on eBay from China, grab a copy of libnfc and mfoc, then things get interesting pretty quickly.
I don't understand why these systems are set up like this, operationally it's not much different from EZ-Pass which works fine with an account based system, putting the value tracking on the cards is just asking for an upgrade treadmill even if it's well designed now, 10 years from now it will be easilly cracked. compare CPU vs GPU/FPGA/ASIC hashing advances
Snowden and Manning are heroes.
Like everything:
If you can buy the readers, and someone obviously sells the writers somewhere, you can clone them.
As soon as you then rely on these tokens to hold individual data themselves (with no reference to a central database), then they become valued targets for attack.
If you had these cards hold nothing more than a code number, and wired all the readers to talk home, then the system can't be "scammed" as such - people can have their cards cloned, of course, but you can spot it, you can trace them, arrest them at your convenience, and give the original account holder a new card in the meantime as soon as they report the fraud. But because everything has to talk to a central database, the cards are not so much "cash" as a stolen "credit card" - traceable, and stoppable.
Then, it doesn't matter if you do use something as common as MiFare (a school I used to work in used Mifare entry systems - they weren't expensive or hard to get hold of at all and I used to program my Oyster - London Tube travel - card to open the door for me in the morning if I'd forgotten my ID card). As soon as the readers are that commonplace, the writers will be available even if that means people are building their own and making fake "cards" the size of a Raspberry Pi with some RF circuitry to pretend to be a card. The next step is just a matter of shrinking the device.
MiFare is long-cracked. You can buy the cards for pence each and the readers (direct to USB, etc.) for a pittance. The next step up is no harder than going from magstripe readers and cards up to magstripe writers with the correct magstripe "level" to read/write the banking data on an old magstripe credit card.
Don't put "value" into a chip that can be cloned. Put the value into a central, monitored, system, and provide people only with a codenumber to access it. That codenumber can be cloned still, sure, but then you can watch out for it, notice it, blacklist it, catch people red-handed. And they can't go spending "free money" offline from your system.
This is my biggest bugbear with London's Oyster system. It's just a number for the most part, but they try to store "value" on the cards and let you buy newspapers with them. Now you have an offline, valued, unmonitored, commodity on an easy-to-clone chip.
.
Fare cards, gift cards, credit and debit cards used at Target, etc.,.etc,. etc...
When are we going to make our erzatz money secure?
Like most of the other government run entities in Atlanta, Marta is run by inept management and awards bids to cronies and
relatives. I am not surprised the system was outdated and ineffective.
you don't have an 100% live data link with systems like this (lot's of metro systems have both bus and rail and there can be cell dead zones that have areas with no data link) and you don't really have a away to bill later if there is some kind of read error.
Naturally if they're going to spend the money on a secure system it might as well fulfill that goal. But do these metro metering devices really need to be all that secure? I checked MARTA's fare schedule and their most expensive ticket is $5 round-trip. Doesn't seem like enough incentive for the average joe to cheat it, esp. when you consider how transit authorities use a few high-profile prosecutions to discourage people from even buying second-hand tickets let alone hacking their own. In my view the system only need be marginally more secure than the honor system.
What about any detail at all about this? What "weak" encryption do they use? How was it broken? What was the value of the fraud? Can these cards be used for anything else, or cashed out, or does this fraud require very extensive MARTA ridership?
Seven people have been charged with fairly serious crimes, but I can't see the value of the fraud being more than a few hundred or few thousand dollars. It's like counterfeiting $1 bills, what's the point?
It appears that MARTA is just discovering the extend of the fraud, based upon the information in this article by the NBC affiliate in Atlanta: Atlanta Channel 11 TV News: 7 arrested for MARTA Breeze Card fraudl
Some detail:
MARTA says the thieves spent $1 to buy the Breeze card, then reprogrammed the data on it to turn it into a 30-day pass. They then sold it to riders for $40, a deep discount of the real price of $96. That meant the thieves got to pocket $39, and the buyers got a cheap ride.
and
MARTA police chief Wanda Dunham says the cards were sold at MARTA stations and on Craigslist. But it was a suspicious buyer who purchased one at an area mall that contacted police. "He knew that wasn't the right fare so he called us, asked us to check into it," said Dunham.
As they investigated, the agency's Revenue Department noticed in November, a large number of cards were sold at its Chamblee and Lenox stations for only a dollar. Police started reviewing surveillance video to create a list of suspects.
MARTA won't say how many counterfeit cards the group sold, but says during the arrests it confiscated 400 fraudulent cards. Had the thieves sold them, their $400 initial investment, would have earned them $16,000.
MARTA says it's never had something like this happen before, but security expert Gregory Evans says MARTA needs to act fast, if wants to keep it from happening again. He says the hackers likely got away with their scheme using a simple card writer that costs just a few hundred dollars. "The crazy part, the scary part about this? MARTA would have never known if some had not gone back and told them what was happening. That's it," said Evans. Evans says the data on the card could be encrypted and an alert built into their software system. "If I go to use this card somewhere and all the sudden there's $100 on this card, their system should have caught that and said hold up," Evans said.
Bit of a tangent, but this story got me thinking about this: http://shamonica.com/2012/05/wizard-spotting-wizards-on-the-bus/
If I am not going to use cash, I'd prefer to use a token that is cash-like:
* is transferable like cash
* can't be tied back to me
* isn't widely counterfeited, so I'm not subsidizing freeloaders
* is convenient to use
Except may be for the counterfeiting part, subway tokens and prepaid fair passes generally meet this requirement.
I don't have any inherent objection to something that operates like a prepaid debit card, as long as I can purchase it anonymously without any additional fees beyond the fair itself. Just don't be surprised if I buy a new card every few weeks instead of reloading the existing one.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
always allow, but record the transactions, and go back later to reconcile.
In other words, treat it like we used to treat credit cards back before instant verification.
Anyone else remember signing a multi-part credit card form and having the clerk run it through the "ker-chunker"?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
And this is why stored-value cards should have MAX_VALUE and EXPIRATION_DATE hard-coded into them.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
There have been a number of studies over the years that show that "honor system" fare collection actually works pretty well, with random manual checks by transit police. Yes, there are people who cheat (but then, there are people who hop the turnstiles, too), but *most* people pay their fare.
It's actually called "proof of payment". You buy a ticket or a pass in the station, and have it available for inspection. if you don't have the ticket, they fine you.
I assure you there's nothing "honor" about it. You're required to have a ticket, and pay a penalty if you don't have one.
Seven people have been charged with fairly serious crimes, but I can't see the value of the fraud being more than a few hundred or few thousand dollars. It's like counterfeiting $1 bills, what's the point?
I spent $3,000 on Metrolink tickets last year in Los Angeles. I know many people who pay more. there is serious money in mass transit.
"honor system"
Don't live in ATL do you?
A bullet may have your name on it, but artillery is addressed to " Whom It May concern"
Out of curiosity, how much revenue comes in from fares, and how much expense goes out in fare maintenance?
A lot of metro systems charge fares in addition to getting public support from taxes. Has anyone thought to tally the costs of the fare system compared to the income? Things like cost of the machines, maintenance of the machines, maintenance of the turnstiles, accounting, law enforcement &c... all these things add up.
Even if the fares bring in revenue, it's probably minor. Most of the cost goes into collecting the fares, so most of that value is wasted.
The economy would get a boost if that money were freed up to be spent by consumers, and doing so would help the people who need it the most (ie - poor people).
This whole thing seems like a fabricated problem - a system that forces people to spend money just for the sake of spending it. Then spend more money reimplementing the system when the original system is found to have flaws, then spend countless hours and resources in enforcement and prosecution.
Just get rid of it. Let the money go into the economy.
1.Why are these things so weak and easily broken
2.Why don't the companies that make them invest a bit more money in making them harder to break (instead of on lawyers to sue people who break them)
and 3.If the companies that make them wont fix them, why isn't someone else offering systems with stronger encryption?
MARTA - Moving Africans Rapidly Through Atlanta (or so the locals call the system).
It's probably wrong to, but I applaud the hackers. It's really only the poor folks in Atlanta that use the system (everyone else drives) and every little bit they can save helps.
Comment removed based on user account deletion
Storing value on a or other physical token that is clonable and/or manipulable basically means you can create 'value' out of nothing. This is government sanctioned. Created value isn't taxed, can be used a anonymously as cash, and can be used to transfer money (real or fake) without the governments knowledge. Granted, I don't see your local drug dealer accepting cloned MiFare cards... actually, chances are local organised crime already distributes them, so they are already part of the same economy, so if they can be sold, they could be accepted. But bitcoins are bad? I don't get it.
Did you expect these crackers to be proactive against hackers? I think not. They invest far more in being proactive against "blackers." I have been to Atlanta scores of times and it is a joke of a metropolis. Nothing of worth is going on down there and oh yeah, you better own a car.