Forgot your password?
typodupeerror
Australia Encryption Security Transportation IT

Aussie Researchers Crack Transport Crypto, Get Free Rides 88

Posted by timothy
from the dirty-socialists dept.
mask.of.sanity writes "Shoddy customised cryptography by a state rail outfit has been busted by a group of Australian researchers who were able to replicate cards to get free rides. The flaws in the decades-old custom cryptographic scheme were busted using a few hundred dollars' worth of equipment. The unnamed transport outfit will hold its breath until a scheduled upgrade to see the holes fixed."
This discussion has been archived. No new comments can be posted.

Aussie Researchers Crack Transport Crypto, Get Free Rides

Comments Filter:
  • by Ukab the Great (87152) on Monday October 22, 2012 @04:39AM (#41726617)

    Aussie crypto researchers transporting crack get a free ride.

  • by Ignacio (1465) on Monday October 22, 2012 @04:41AM (#41726621)

    Shoddy customised cryptography

    Brought to you by the Department of Redundancy Department.

    • by hattig (47930) on Monday October 22, 2012 @04:59AM (#41726675) Journal

      So shoddy that it worked fine for "decades". As one of the researchers said - it was designed before he was born.

      Even if a few people had previously worked out their way around it, they could hardly mass-market their cloned cards on the market, and thus the number of users was always going to be rather limited - and probably not worth replacing the current system to deal with.

      Now technology has got to the point where the average person could abuse the system, so I guess the system will get an upgrade soon.

      • by Craig Ringer (302899) on Monday October 22, 2012 @07:48AM (#41727147) Homepage Journal
        The transit system in question is 5-7 years old - or less depending on which one they refer to. The crypto is old, but the smartcard transit system isn't. Fail. How do I know? Because there are no older transit tag systems in Australia.
        • by jimicus (737525)

          Maybe they bought it in from an outside company that had been selling similar systems in other parts of the world for years?

        • Correction. After reading the presentation, it's clear that this is not a smartcard system, it's a magentic strip system. That means it isn't Western Australia's SmartRider, and WA's old MultiRider magnetic strip system has been retired for 5 years so it's not going to be MultiRider.
    • And the Natural Guard.
  • by Anonymous Coward on Monday October 22, 2012 @04:42AM (#41726631)

    Governments give these contracts to retarded companies, simply because they offer to do it for a lower price than "proper" companies would.

    Same exact thing happened in the Netherlands, Trans Link Systems got the contract for the "Public transit chip card", it was hacked in a week. An improved, "unhackable" version was also cracked when it was released.

    The problem with these companies mostly is that they think security through obscurity actually works, which is pathetic.

    • by Kergan (780543) on Monday October 22, 2012 @05:05AM (#41726693)

      The problem with these companies mostly is that they think they've come up with better cryptographic security than tried and tested solutions, which is pathetic.

      FTFY.

      • by Anonymous Coward

        You're giving them too much credit. Most of the people doing this stuff are so clueless that they don't even know what are the tried and tested solutions. They come up with terrible solutions because they understand neither the foundation libraries already available nor the basics of cryptographic security.

    • by Anonymous Coward

      What exactly is "Proper"? A company that can engineer a train so that its reliable and people don't die and is efficient is likely a company that will get the contract. They usually 'throw in' a ticketing system. Politicians and people (taxpayers) look at the whopping costs of implementing a train system, and see anything free as "it had better be". So they make a ticketing system, but its a freebie (I believe that your use of the word "proper" and freebie are diametrically opposed here). The rail sys

  • Killing anonymity (Score:5, Informative)

    by antifoidulus (807088) on Monday October 22, 2012 @04:46AM (#41726647) Homepage Journal
    Hopefully theft won't become widespread, both because it will have a negative impact on public transport systems AND it will have a huge negative impact on anonymity. I just checked out Victoria's MyKi system(which was not the one they cracked, but I imagine the one they cracked offers similar services) and they still have an option to buy anonymously.

    However if theft becomes a huge problem I can quickly see that option going away in the name of deterring theft(note that I am not defending the practice, simply stating what will probably happen). After all you are much less likely to try to score a free ride if your name is attached to the ticket. I quite like being able to travel conveniently without being tracked(*puts tinfoil hat in murse*)
    • by aaron552 (1621603)

      I just checked out Victoria's MyKi system(which was not the one they cracked, but I imagine the one they cracked offers similar services) and they still have an option to buy anonymously.

      No personally identifying information is stored on the Myki - just the balance and last 10 trips.

      From the article it's pretty easy to guess that the cracked system was the ancient, magnetic-strip-on-paper-cards Metcard system. I highly doubt there's any tracking going on, that would require the people running the system to be competent

      • Re:Killing anonymity (Score:5, Interesting)

        by mcbridematt (544099) on Monday October 22, 2012 @05:12AM (#41726711) Homepage Journal

        More likely it is the Brisbane GoCard or Perth SmartRider - which use the horribly insecure MiFare Classic, which was compromised some years ago and there are 'off the shelf' exploits.

        The operator of the Brisbane system even tried to play down [brisbanetimes.com.au] the significance of the MiFare Classic exploit when it was known before launch.

        • Re:Killing anonymity (Score:5, Informative)

          by cloricus (691063) on Monday October 22, 2012 @05:55AM (#41726803)
          As per their Ruxcon presentation it was a previously un-compromised system that used magnetic stripes.
        • by Ronin441 (89631)

          Perth SmartRider does indeed use MiFare Classic, and the cards are indeed insecure. But there's some server-side smarts which will (eventually) notice a cloned card, and deactivate it. I expect it also (eventually) notices if you top up your card yourself for free.

          The idea is that although the system can be exploited at a small scale, it isn't worth the hassle. Provided their server-side stuff prevents exploits going commercial and becoming widespread, it's good enough.

    • Re: (Score:3, Informative)

      by tqft (619476)

      From August in Qld http://www.brisbanetimes.com.au/queensland/go-card-travel-records-point-finger-at-murder-accused-20120816-24b3v.html [brisbanetimes.com.au]
      "A Supreme Court jury heard that Ashley Michael McGoldrick's Go Card history showed ..."
      and from 2010
      http://www.brisbanetimes.com.au/queensland/police-watching-where-you-go-20100728-10vx2.html [brisbanetimes.com.au]
      "The revelation came after brisbanetimes.com.au exclusively revealed that police are using Go Card technology to not only pinpoint the movements of criminal suspects but also potential

    • by Anonymous Coward

      Hey Slashdotters, should we tell this person that if they're taking a train, they're already being recorded on ten different cameras being fed back to HQ where they pump the feeds into facial recognition software?

      Unless you walk around in a hoodie with a full facial skull mask such as those worn by motorcyclists, you haven't been traveling anonymously for a long time - cash or not.

      • by EnempE (709151)
        Not on that rail network they aren't. QR has been struggling to make ends meet for a while, the go card system was supposed to improve the situation by reducing ticketing costs and reducing staffing requirements at smaller platforms. They don't have the money to invest in facial recognition software. The left bag systems would probably be running on the live feeds but the cameras don't have the resolution to pick out faces and track them through the system, it would be a major upgrade. As the system sta
    • by Gothmolly (148874) on Monday October 22, 2012 @07:25AM (#41727045)

      You live in AUSTRALIA, and you're suddenly worried about privacy/anonymity?

  • by kasperd (592156) on Monday October 22, 2012 @04:53AM (#41726659) Homepage Journal
    The article contains absolutely no information about what the vulnerability was. Have anybody been able to find a link to the actual presentation?
    • by Anonymous Coward on Monday October 22, 2012 @05:07AM (#41726699)

      Almost guaranteed that the rail systrem is the City Rail [cityrail.info], the NSW rail system. Their ticketing system [wikipedia.org] is a nightmare, and has been the subject of multiple botched upgrades over the last couple of decades, costing millions of dollars. The latest plan is to upgrade to London's "Oyster Card" technology (renamed Opal card), but I'll believe it once I see it. The current tickets are just a piece of cardboard/plastic with a magnetic strip. Trivial to read, and most likely (as has been found out) trivial to decode.

      In fact, when you do the numbers, it would be cheapest for the NSW government to abolish ticketing all together. The money saved on the (absence of a) ticking system and the reduction in road use would exceed the current revenue from tickets.

      • by ewanm89 (1052822)

        Better not use the Oyster cards as they are MIFARE classic 1K and are well cracked already.

      • by Anonymous Coward

        I agree with the above poster that is most likely City Rail in NSW, by a process of elimination:
        - Only 5 cities in Australia have public transport rail networks.
        - Melbourne have recently introduced Myki - good case study on how not to do it [duckduckgo.com], so they are unlikely and the article states this
        - Brisbane use Oyster Card, unlikely but if it is then this is a much bigger story
        - Perth uses Smartrider [wikipedia.org], a smart card system.
        - Adelaide have used MetroTicket [wikipedia.org] which contains a magnetic strip developed by Crouzet-SA.

    • by kasperd (592156)
      Somebody else did post [slashdot.org] a link to the slides [dou.gl], though not in response to my question.
  • Presentation Slides (Score:5, Informative)

    by Catchwa (1017396) on Monday October 22, 2012 @05:05AM (#41726691) Homepage
    Can be found here [dou.gl].
    • by kasperd (592156) on Monday October 22, 2012 @07:12AM (#41727005) Homepage Journal
      Wow. The encryption described in those slides is like state of the art of the 16th century. Nowadays that scheme doesn't even qualify as cryptography. It's not custom cryptography, it's a joke.

      The slides do mention, that they have modified some details, probably as part of a responsible disclosure. But I suppose the sort of methods used and the strength of the encryption does correspond to the original version.

      But as so often before, people are using "encryption" when it isn't what they need. 90% of the time where people use encryption, what they really need is integrity, which is not achieved through encryption but rather through message-authentication-codes or digital signatures. Encryption without integrity is rarely a good idea. If the integrity of the data on these tickets had been protected, there would be no need for encryption in the first place. After all, the plaintext version of the data is probably even printed on the ticket.
  • by Anonymous Coward

    I worked out how to get a free train ride in adelaide, and I didn't even need any custom equipment.

    If the trains don't know the time, they stamp an error bit flag on the mag-stripe ticket. The gates that let you out, supposedly only if you have a ticket valid for that time, will let you past if you have an error bit. And there's no time limit.

  • Look, I know this is Slashdot where we dupe articles without reading them, and it's in the original article title, but given that TFA itself goes to some lengths to explain that the filthy h5xx0rz bought all their tickets (and I don't blame them, given Oz's propensity for criminalising everything that isn't mandatory), could we please, just once, actually have an accurate title or summary?

    If Slashdot has just become Google News for Nerds, I can pretty much get that myself with a custom search. Upgrade th

  • This was cracked a number of years ago apparently because it used a simple linear feedback shifter as a random number generator which meant the code were easy to guess. Or something along those lines , I can't fine the article at the moment

      LU said they'd be "improving security" and then we heard nothing more about it. Anyone know whats going on these days?

    • by Anonymous Coward

      DESFire cards are all you can get on Oyster now. MiFare classic was replaced a few years back. This is why it is now much slower to read/write and why the hotspot is smaller (DESFire requires more power).

  • by DrXym (126579) on Monday October 22, 2012 @07:17AM (#41727019)
    I really don't see this as a huge threat. Let's assume the worst case, that some people buy a mag stripe reader/writer and use software to program the tickets with bogus data. These tickets might fool automatic barriers but they won't fool a ticket inspector.

    I expect most transport systems have inspectors already to catch people jumping barriers or coasting in and out behind other people. So the faker is going to get caught eventually. If they're really unlucky the inspector will compare the printed data on the ticket to the data on the stripe using a portable reader and call the cops.

    Some transport systems don't even bother with barriers and rely exclusively teams of inspectors. e.g. Dublin's Luas tramline has no barriers so there is nothing to stop someone riding for nothing. To enforce the ticketing system it is not uncommon to see a team of 4 or 5 ticket inspectors board without notice and systematically sweep the train for either end. People with no tickets risk huge fines so you'd have to be pretty dumb to ride this way, fake ticket or not.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      On some trains the ticket inspectors will just sell the tickets at normal price if you don't have one, or escort you off the train if you don't want to pay. Of course some places don't even bother with barriers or inspectors for local trains, they have enough honest people buying tickets that it isn't seen as cost effective to have either just to stop a few kids from taking a free ride.

  • make a fence unnecessary.

    It defines the social border, the socially accepted line.

    Crossing this line involves a reaction from the society, which wants to defend its norms.

    If I were an Australian General Prosecutor I would suggest 2 -3 years of imprisonment to these group of young researches so that the next time they would think twice before forging public transportation tickets.
  • And how many thousands of dollars worth of skilled security researchers' time?

  • by Archon-X (264195) on Monday October 22, 2012 @09:10AM (#41727733)
    I've got a current project of trying to do some data analysis on RFID data dumps. I've made some progress, but have been getting stuck on trying to pull out the timestamp. 'Obvious' things, like days of the year, epoch stamps etc don't seem to appear. From research, there should be a defined start date / time, and an ending date / time - and the gap should be no more than 84 hours. The dump I have is from around Sept 2012. If anyone feels like helping out or can see something obvious...

    03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    aa 07 00 00 21 02 08 00 00 6e 07 06 07 00 66 83
    00 00 00 00 00 00 00 00 01 6e 07 06 08 37 00 00

    [NB: the 07 AA is understood, the 21 02 08 I am unsure about, and the rest with it the obvious data repetition / incrementation, i can't help but feel the timestamp is staring at me!]

  • So the public service paid for crypto and got it. Theses kids buy a card reader and card makers and probably use an open source crypt o program wala instant security searchers?

Prediction is very difficult, especially of the future. - Niels Bohr

Working...