Slashdot Mirror
Cracking Atlanta Subway's Poorly-Encrypted RFID Smart Cards Is a Breeze
McGruber writes "Seven metro Atlanta residents are facing theft, fraud, and racketeering charges for allegedly selling counterfeit MARTA Breeze cards. Breeze cards are stored-value smart cards that passengers use as part of an automated fare collection system which the Metropolitan Atlanta Rapid Transit Authority introduced to the general public in October 2006. Breeze cards are supplied by Cubic Transportation Systems, an American company that provides automated fare collection equipment and services to the mass transit industry. At the time of this slashdot submission, the Wikipedia page for the Breeze Card (last modified on 2 August 2013 at 14:52) says: 'The Breeze Card uses the MIFARE smart-card system from Dutch company NXP Semiconductors, a spin-off from Philips. The disposable, single-use, cards are using on the MIFARE Ultralight while the multiple-use plastic cards are the MIFARE Classic cards. There have been many concerns about the security of the system, mainly caused by the poor encryption method used for the cards.'"
Old MiFare stuff is toast, security wise. Any old fool can order some UID-writable tokens on eBay from China, grab a copy of libnfc and mfoc, then things get interesting pretty quickly.
I don't understand why these systems are set up like this, operationally it's not much different from EZ-Pass which works fine with an account based system, putting the value tracking on the cards is just asking for an upgrade treadmill even if it's well designed now, 10 years from now it will be easilly cracked. compare CPU vs GPU/FPGA/ASIC hashing advances
Snowden and Manning are heroes.
Like everything:
If you can buy the readers, and someone obviously sells the writers somewhere, you can clone them.
As soon as you then rely on these tokens to hold individual data themselves (with no reference to a central database), then they become valued targets for attack.
If you had these cards hold nothing more than a code number, and wired all the readers to talk home, then the system can't be "scammed" as such - people can have their cards cloned, of course, but you can spot it, you can trace them, arrest them at your convenience, and give the original account holder a new card in the meantime as soon as they report the fraud. But because everything has to talk to a central database, the cards are not so much "cash" as a stolen "credit card" - traceable, and stoppable.
Then, it doesn't matter if you do use something as common as MiFare (a school I used to work in used Mifare entry systems - they weren't expensive or hard to get hold of at all and I used to program my Oyster - London Tube travel - card to open the door for me in the morning if I'd forgotten my ID card). As soon as the readers are that commonplace, the writers will be available even if that means people are building their own and making fake "cards" the size of a Raspberry Pi with some RF circuitry to pretend to be a card. The next step is just a matter of shrinking the device.
MiFare is long-cracked. You can buy the cards for pence each and the readers (direct to USB, etc.) for a pittance. The next step up is no harder than going from magstripe readers and cards up to magstripe writers with the correct magstripe "level" to read/write the banking data on an old magstripe credit card.
Don't put "value" into a chip that can be cloned. Put the value into a central, monitored, system, and provide people only with a codenumber to access it. That codenumber can be cloned still, sure, but then you can watch out for it, notice it, blacklist it, catch people red-handed. And they can't go spending "free money" offline from your system.
This is my biggest bugbear with London's Oyster system. It's just a number for the most part, but they try to store "value" on the cards and let you buy newspapers with them. Now you have an offline, valued, unmonitored, commodity on an easy-to-clone chip.
.
Fare cards, gift cards, credit and debit cards used at Target, etc.,.etc,. etc...
When are we going to make our erzatz money secure?
Naturally if they're going to spend the money on a secure system it might as well fulfill that goal. But do these metro metering devices really need to be all that secure? I checked MARTA's fare schedule and their most expensive ticket is $5 round-trip. Doesn't seem like enough incentive for the average joe to cheat it, esp. when you consider how transit authorities use a few high-profile prosecutions to discourage people from even buying second-hand tickets let alone hacking their own. In my view the system only need be marginally more secure than the honor system.
What about any detail at all about this? What "weak" encryption do they use? How was it broken? What was the value of the fraud? Can these cards be used for anything else, or cashed out, or does this fraud require very extensive MARTA ridership?
Seven people have been charged with fairly serious crimes, but I can't see the value of the fraud being more than a few hundred or few thousand dollars. It's like counterfeiting $1 bills, what's the point?
It appears that MARTA is just discovering the extend of the fraud, based upon the information in this article by the NBC affiliate in Atlanta: Atlanta Channel 11 TV News: 7 arrested for MARTA Breeze Card fraudl
Some detail:
MARTA says the thieves spent $1 to buy the Breeze card, then reprogrammed the data on it to turn it into a 30-day pass. They then sold it to riders for $40, a deep discount of the real price of $96. That meant the thieves got to pocket $39, and the buyers got a cheap ride.
and
MARTA police chief Wanda Dunham says the cards were sold at MARTA stations and on Craigslist. But it was a suspicious buyer who purchased one at an area mall that contacted police. "He knew that wasn't the right fare so he called us, asked us to check into it," said Dunham.
As they investigated, the agency's Revenue Department noticed in November, a large number of cards were sold at its Chamblee and Lenox stations for only a dollar. Police started reviewing surveillance video to create a list of suspects.
MARTA won't say how many counterfeit cards the group sold, but says during the arrests it confiscated 400 fraudulent cards. Had the thieves sold them, their $400 initial investment, would have earned them $16,000.
MARTA says it's never had something like this happen before, but security expert Gregory Evans says MARTA needs to act fast, if wants to keep it from happening again. He says the hackers likely got away with their scheme using a simple card writer that costs just a few hundred dollars. "The crazy part, the scary part about this? MARTA would have never known if some had not gone back and told them what was happening. That's it," said Evans. Evans says the data on the card could be encrypted and an alert built into their software system. "If I go to use this card somewhere and all the sudden there's $100 on this card, their system should have caught that and said hold up," Evans said.
always allow, but record the transactions, and go back later to reconcile.
In other words, treat it like we used to treat credit cards back before instant verification.
Anyone else remember signing a multi-part credit card form and having the clerk run it through the "ker-chunker"?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Seven people have been charged with fairly serious crimes, but I can't see the value of the fraud being more than a few hundred or few thousand dollars. It's like counterfeiting $1 bills, what's the point?
I spent $3,000 on Metrolink tickets last year in Los Angeles. I know many people who pay more. there is serious money in mass transit.
Out of curiosity, how much revenue comes in from fares, and how much expense goes out in fare maintenance?
A lot of metro systems charge fares in addition to getting public support from taxes. Has anyone thought to tally the costs of the fare system compared to the income? Things like cost of the machines, maintenance of the machines, maintenance of the turnstiles, accounting, law enforcement &c... all these things add up.
Even if the fares bring in revenue, it's probably minor. Most of the cost goes into collecting the fares, so most of that value is wasted.
The economy would get a boost if that money were freed up to be spent by consumers, and doing so would help the people who need it the most (ie - poor people).
This whole thing seems like a fabricated problem - a system that forces people to spend money just for the sake of spending it. Then spend more money reimplementing the system when the original system is found to have flaws, then spend countless hours and resources in enforcement and prosecution.
Just get rid of it. Let the money go into the economy.
MARTA - Moving Africans Rapidly Through Atlanta (or so the locals call the system).
It's probably wrong to, but I applaud the hackers. It's really only the poor folks in Atlanta that use the system (everyone else drives) and every little bit they can save helps.