California's Wireless Road Tolls Easily Hackable 354
An anonymous reader writes "Nate Lawson, a researcher at RootLabs, has found a way to clone the wireless transponders used by the Bay Area FasTrak road toll system. This means you can copy the ID of another driver onto your own device and, as a result, travel for free while others foot the bill. Lawson also raises the interesting point of using the FasTrak system to create false alibis, by overwriting one's own ID onto another driver's device before committing a crime. Luckily, Lawson wasn't sued before he could reveal his research, unlike those pesky MIT students."
sounds familiar (Score:5, Informative)
Alibis? (Score:4, Informative)
You've got it the wrong way around - people won't use this to create alibis before committing a crime, they'll use it to establish evidence of the target being in a certain area at a certain time even though he swears he was elsewhere
At any rate, certain requirements have to be met before something can be introduced as evidence. I'm assuming most things (like this) would, by default, not constitute evidence anyway. Email (at least in this country) needs to be provided along with an audit trail before it's accepted as evidence
Article Text (Score:5, Informative)
Between the splash screen redirects and the ads, this article is nearly unreadable. Here's the text for those who don't want to put up with the crap.
----
Drivers using the automated FasTrak toll system on roads and bridges in California's Bay Area could be vulnerable to fraud, according to a computer security firm in Oakland, CA.
Despite previous reassurances about the security of the system, Nate Lawson of Root Labs claims that the unique identity numbers used to identify the FasTrak wireless transponders carried in cars can be copied or overwritten with relative ease.
This means that fraudsters could clone transponders, says Lawson, by copying the ID of another driver onto their device. As a result, they could travel for free while others unwittingly foot the bill. "It's trivial to clone a device," Lawson says. "In fact, I have several clones with my own ID already."
Lawson says that this also raises the possibility of using the FasTrak system to create false alibis, by overwriting one's own ID onto another driver's device before committing a crime. The toll system's logs would appear to show the perpetrator driving at another location when the crime was being committed, he says.
So far, the security flaws have only been verified in the FasTrak system, but other toll systems, like E-Z Pass and I-Pass, need to be looked at too, argues Lawson. "Every modern system requires a public security review to be sure there aren't different but related problems," he says. Indeed, in recent weeks, researchers announced flaws in another wireless identification system: the Mifare Classic chip, which is used by commuters on transport systems in many cities, including Boston and London. However, last week, the Massachusetts Bay Transportation Authority (MBTA) filed a lawsuit to prevent students at MIT from presenting an analysis of Boston's subway system.
The Bay Area Metropolitan Transport Commission (MTC), which oversees the FasTrak toll system, maintains that it is secure but says it is looking into Lawson's claims. "MTC is in contact with vendors who manufacture FasTrak lane equipment and devices to identify potential risks and corrective actions," says MTC spokesman Randy Rentschler. "We are also improving system monitoring in order to detect potentially fraudulent activity."
In the past, authorities have insisted that the FasTrak system uses encryption to secure data and that no personal details are stored on the device--just two unique, randomly assigned ID numbers. One of these is used to register the device when a customer purchases it, while the other acts as a unique identifier to let radio receivers at tolls detect cars as they pass by.
But when Lawson opened up a transponder, he found that there was no security protecting these IDs. The device uses two antennas, one to detect a request signal from the toll reader and another to transmit its ID so that it can be read, he says.
By copying the IDs of the readers, it was possible to activate the transponder to transmit its ID. This trick doesn't have to be carried out on the highway, Lawson notes, but could be achieved by walking through a parking lot and discreetly interrogating transponders.
What's more, despite previous claims that the devices are read only, Lawson found that IDs are actually stored on rewritable flash memory. "FasTrak is probably not aware of this, which is why I tried to get in touch with them," he says. It is possible to send messages to the device to overwrite someone's ID, either wiping it or replacing it with another ID, says Lawson.
"Access to a tag number does not provide the ability to access any other information," says MTC's Rentschler. "We also believe that significant effort would need to be invested in cloning tags." He adds, "If any fraudulent toll activity is detected on a customer's account, the existing toll-enforcement system can be used to identify and track down the perpetrator."
Lawson says that using each stolen ID just once would make it difficult to track
Re:Cameras at every toll booth (Score:1, Informative)
In toronto we have an electronic toll as well. Cameras and such and completely unmanned.
We have a law against dirty license plates. You may save on cash from using the highway, but some police officer will eventually hit you with a ticket (they do stop people with dirty plates) and your insurance rates will go up.
Tolled roads are very abnormal in Canada, but this one works reasonably well.
Re:Cameras at every toll booth (Score:5, Informative)
Yep - that was my first thoughts too. Driving with an unreadable license plate, though, is grounds to get you pulled over anyway.
In case you didn't know, most toll booth places have:
Cameras front-mounted to take a picture of YOU or passengers...
Cameras in the back to take a picture of your plate...
Occasional cops sitting at the side of the road that are ready to pull you over.
It's academically interesting (and it should be) but not useful for the criminal. You can always simply drive through a checkpoint without an ez-pass, and most likely nothing will happen [nbc4.com] for a long time. Is it worth it? Nope.
As former toll systems programmer... (Score:5, Informative)
Re:Cameras at every toll booth (Score:1, Informative)
Re:Article Text (Score:3, Informative)
Re:cameras / scanners (Score:3, Informative)
Any obvious physical means to obscure the license plate would be self-defeating.
Just get some polarizing film and put it over your license plate. Unless the cameras are head-on (which generally they're not) they're going to get a black rectangle where the license plate should be.
A 'clear' film would be much less likely to attract law enforcement attention than some kind of physical change.
I believe this kind of thing is illegal but then again if you're going to be using a cloned transmitter I don't see that breaking another law would cause you to lose any sleep.
Re:sounds familiar (Score:1, Informative)
Mod parent up.
The book linked is definitely relevant and the post has nothing to do with trolling.
I smell moderator abuse.
Re:Cameras at every toll booth (Score:4, Informative)
I'm guessing that you've never been to Illinois. "Welcome to Illinois! Pay toll."
The only toll roads in the whole state are north of I-80. Of course, you guys up there think Illinois' southern border is I-80 anyway.
Uncyclopedia has a good article about our great state. [uncyclopedia.org]
Re:Cameras at every toll booth (Score:3, Informative)
funny, i drive from des moines iowa to raleigh north carloina several times a year, passing through illinois, indiana and ohio, and never once payed a toll.
all interstate driving too.
seems like you went the wrong way to me.
Re:Cameras at every toll booth (Score:4, Informative)
Not only reasonable, sometimes it's the law. Any place where there is a lot of snow will typically have a few people pulled over for not clearing the snow from their bumpers to reveal their plate(s).
Re:Cameras at every toll booth (Score:2, Informative)
I'm also in Toronto and there are no demerit points attached to a dirty plate or a "407 proof" reflective plate cover so their toll cameras can't get see your plate. --at least I didn't lose any points when I was pulled for each of these reasons - in fact I didn't get a ticket for the dirty plate, I just had to clean it off right then and there. The reflective cover cost me a $103.75 fine though. (still a hell of a lot cheaper than paying the 407)
For those of you who are interested: http://www.407etr.com/ [407etr.com] this is an express toll highway that goes over the top of the Greater Toronto Area.
Our provincial government built it and then decided that they didn't want to manage it any longer so they sold it off to a private company for pennies compared to what it cost to build.
My favourite part is that if the 407 decides that you owe them money (whether they're right or wrong) then you must pay that bill before you're allowed to renew your license plate with the Province. Yes, you read that right. A private company, with just one small clerical error, can prevent me from renewing my car's plate.
Re:Cameras at every toll booth (Score:3, Informative)
FasTrak is also used access the Express Lanes on Highway 91 [91expresslanes.com], a 10 mile stretch between Riverside & Orange counties. There are no toll booths, but apparently they have Cameras [91expresslanes.com] to track down violators.
Average highway speed on that road is easily 75mph+ on highway 91, so I bet the cameras are higher-speed then the regular cameras used on the Bay Bridge toll booth.
Re:Cameras at every toll booth (Score:3, Informative)
I suppose a photo of the license plat alone would not be sufficient, but that's not how most places do it.
I once got a ticket from an automated red light camera in San Jose.
The picture, unfortunately, clearly showed not just my license plate, but my face.
Re:Cameras at every toll booth (Score:3, Informative)
On the other side...
I spent 5 months last year in Illinois (business trip that was extended too many times, but as a contractor either do it or go home and stop getting $$$).
There is a real need for cash lanes because of the out of towners, and rental car users.
Driving rental cars you have either:
1. No i-pass and must stop at ever toll booth and throw quarters
2. is a more expensive car with an i-pass, but then avis decides to charge you administrative fees if you use the i-pass (which results in me throwing quarters at every toll booth).
As for toll roads in general, I think they're more hassle than they're worth. Who normally walks around with $20 in quarters anyway? I did after a week in Illinois.