Another EUSecWest NFC Trick: Ride the Subway For Free 135
itwbennett writes "At the EUSecWest security conference in Amsterdam, researchers showed how their 'UltraReset' Android app can read the data from a subway fare card, store that information, and reset the card to its original fare balance. The researchers said that the application takes advantage of a flaw found in particular NFC-based fare cards that are used in New Jersey and San Francisco, although systems in other cities, including Boston, Seattle, Salt Lake City, Chicago and Philadelphia, could also be vulnerable."
More like... (Score:2, Insightful)
Re:More like... (Score:5, Interesting)
Even if you did collect the log files, they may be useless. You would have to catch the same non-reloadable card bring used more than the maxumum number of times. To do that, you would probably have to analyse hundreds, if not thousands of
Re: (Score:3)
That was my thought. Putting the balance for anything on the card itself is a terrible idea, unless you have no choice because readers won't be (reliably) connected to the larger infrastructure.
I suppose later reconciling could catch someone doing this, but I have to imagine it'd be really hard to enforce effectively.
Not that hard, really (Score:3)
I suppose later reconciling could catch someone doing this, but I have to imagine it'd be really hard to enforce effectively.
Actually it's not that hard to catch those who use card with bogus amount
In a lot of cities, cctv cameras have been set up in mass transit system, in buses, trams and subway trains.
If the authority really wants to find out who are using bogus cards, they could compare the time stamp on the "embarking scan" with the time stamp on the CCTV to identify which person is using bogus cards.
Of course, catching the person only once is in itself not enough to convict the person. But, if the au
Re: (Score:1)
Re:Not that hard, really (Score:5, Funny)
"Here you are caught by security camera A231763 purchasing said ticket at a vending machine. And we know it is that ticket because as you can see a simple uncrop and we can see the serial number reflected in that window which is reflected in that water drop which is reflected on that man's hat."
Re: (Score:1)
And I'm sure they'll be willing to go through weeks or months worth of footage at every single kiosk at every single station just to be able to do that, only to find that your face was concealed or someone else bought the ticket.
Re: (Score:2)
Because the serial number of ticket wouldn't give them a near instant lookup of which machine sold it and at what time or anything.
And of course I was also being completely serious with the uncropping and all.
Re: (Score:2)
The printed serial number isn't part of the modifiable data.
Because it's an obvious reference.
Re: (Score:2)
They wouldn't need to do that for several reasons. One, the card's serial number will be logged so all they would have to do is parse the logs and find the time and machine is was purchased from. Then all they need to do is pull the relevant footage from the area near the time. Of course that is assuming they keep records of what cards go into what kiosks and how much was purchased on them for their accounting so a: the cards actually end up in a machine and b: the money put into the machine doesn't end up
Re: (Score:1)
jesus christ you americans watch to much tv
Re: (Score:2)
Re: (Score:2)
OOOh, GOOD one! (Score:2)
Nothing works as well at convincing the general public of the evil of BIG BROTHER then showcasing a scenario were a criminal defrauding not just the system but the general paying public (who are subsidizing the fair dodgers) with no hassle to them.
Please, next give me a tale of how the evils of drinking will cause me to life longer, score with women and advance my career!
Re: (Score:1)
That was my thought. Putting the balance for anything on the card itself is a terrible idea, unless you have no choice because readers won't be (reliably) connected to the larger infrastructure.
I suppose later reconciling could catch someone doing this, but I have to imagine it'd be really hard to enforce effectively.
And that's exactly the normal scenario that most of these cards work under. Buses usually don't have net access all the time, for example. It's all done in batch jobs at the end of the day.
Re: (Score:2)
Re: (Score:2)
How would anyone ever catch you? These systems probably don't have network access, otherwise they would just read a token and then authenticate against a server, so all you have is log files. You could detect the fraud after the fact (if you somehow collected the log files), but to actually catch someone red handed would be pretty difficult.
Even if you did collect the log files, they may be useless. You would have to catch the same non-reloadable card bring used more than the maxumum number of times. To do that, you would probably have to analyse hundreds, if not thousands of .log files from different devices, unless the transactions are somehow manually collected and uploaded into a database. Even then, it would be an after-the-fact type thing.
You would need a computer to do it. Oh the horror.
Re: (Score:2)
Re: (Score:2)
ask NSA for help, they would love to (if they arent collecting it already)
Re: (Score:2)
They are networked, allright. There's another reason why there's no action taken against the one-off offender: if the percentage of "pirates" is very very low (say, 1 in 10.000), it's simply not feasible to spend time and money to go after them. There's probably far more people who jump over the gates anyway.
Sneakernet (Score:2)
How about a sneakernet? Each card could contain space for the accounting data plus additional space for an encrypted version of a dozen of unrelated transactions. Now just get network to a few of the devices for collection.
As you travel around the system you are unknowingly carrying encrypted transaction data from the devices with no network connection t
Re: (Score:2)
One of the examples in the article is San Francisco's Muni, a proof-of-payment system that has fargates only at major stations. So if you run into a fare inspector who asks to see your card you're pretty much fucked.
Re: (Score:2)
Re: (Score:2)
The balance isn't what matters here, it's whether there's a valid ticket loaded onto the card.
Now, you could probably find a way to write that info to the card, but if you could do that, you wouldn't need this phone hack in the first place!
Re: (Score:2)
Re: (Score:3)
The terminals don't necessarily have live network access, but they do get updates periodically; for example, when the bus gets back to the bus barn, they plug it in to transfer data. Thus, if you add value to your card with a credit card online, within a few days, every terminal has been updated to know that they may need to increase the value stored on your card, if a different terminal hasn't already added that value. It would be trivially possible to make this a two-way conduit, if it isn't already - sav
Re: (Score:2, Interesting)
System abuse can be rampant. With the situation of The hard part would be figuring out who you are from the available records it is far easier to cancel the card and flag it as suspect. When the card is next used it doesn't work, triggers an alarm, and the card holder then gets to have a chat with an official about their card.
Most systems don't care about the negative balance reaping. Giving a percentage credit for auto and remote payments tends to fix this problem for the most part. Then they can isolate t
Re: (Score:2)
They decided to cheap out and not have every device network enabled. That was a business decision. I would hope that the possibility of ticke
Re: (Score:2)
I think in addition to the cost of making everything live all the time (not just the hardware, but also network access for tens of thousands of devices), it's also not possible to guarantee network access. There are places in the area where, due to mountains, even a cell signal is unreliable. Additionally, the system has to work without a network anyway, in case the wireless provider or server goes down, so it'd have to be a best-effort double-check that your card balance is correct. And if you do have netw
Re: (Score:2)
There will always be fraud wh
Random Checks (Score:1)
Random checks! Like many cities now (strangely, this doesn't include NYC), we're using a similar system. With these smart cards, came random checks, something we never had before with those magnetic paper tickets. Subway cops will randomly ask for your card so they can check on some kind of PDA and I'm pretty sure they can easily differentiate between something that looks like a credit card and a phone.
Re: (Score:3)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
If you are doing it systematically, you are probably travelling through the same place more than once. Each device could remember the most recent transaction number for recently seen cards. If it ever see a card with transaction number repeating or going backwards, it activates whatever alarm mechanism it has.
Card ID and transaction number could be
Re: (Score:2)
How would anyone ever catch you?
I don't know about this system, but use of NFC does not preclude ticket inspectors. The Dublin Luas for example has NFC cards for commuters. The card holds a cash value but the value is held centrally and the card is just some dumb RFID. There are special points at each station and you wave in before you board and you wave out when you disembark and the cost of the trip is deducted from your balance. There are no ticket barriers or gates so the system is enforced quite heavily by inspectors armed with porta
Re: (Score:2)
You just collect the logs, and when you see a particular card serial being used for replay attacks you put it in a blacklist file. Then the next time it is used an alarm goes off and the user gets treated like somebody who jumps over the gate.
I'm sure you could get a few replays out of a card safely, but that would be it.
Now, if you just went for a 50% discount by cloning a card once or twice, or cloning it a bunch of times and passing it around but ditching the clones after a few days, then chances are yo
Re: (Score:2)
Another note - replay attacks are preventable if you store some kind of index of card last-used dates or something similar on each terminal. That requires a sizable database, but you're talking probably less than 1GB to track every card used for a year or two. If a card had a last-update date before the date in the database then it has be replayed.
Re: (Score:3, Interesting)
A journalist hacked a TLS-card (although admittedly it was more at the level of a script-kiddy) and traveled for free, on camera etc, even showing how to do it.
Not quite sure what happened, but I believe the court dismissed the case because the value of the freedom of press and journalists being critical was more important than a company that isn't up-to-date (since 2007).
<sarcastic
Re: (Score:2)
Re: (Score:2)
Re:More like... (Score:5, Informative)
Transcript for the non-Dutch:
<anchor guy> Our Jojanneke showed us yesterday that even blonde women can crack the TLS-chipcard without a problem. The responsible company reacted frivolously because the hack would show up in their systems, and the authorities would be alerted. In other words, keep calm and carry on. But that was before they saw this news-item.
<Journalist 1> I can check in and out myself, simply by typing in the time that I want to be checked in, and upload it to the card. No signs in their back-office, this is undetectable.
<anchor guy> Yes indeed, now the TLS-card can be hacked even without TLS getting to know about it. The chance that the identity of the fraudulent traveller is to be unveiled is as good as nil. And that is what the responsible company is finally - although not enthusiastically - admitting.
<TLS spokes woman, Anita Hilhorst (to a journalist in a studio)>...At this moment our checks with detectors and inspectors do not show those transactions in our back-office,
<journalist in the studio> yeah, when I the conductor checks me, his machine just says that I am checked in.
<TLS spokes woman>...Yes...
<journalist in the studio> So then I dont have a problem and you are completely ignorant about it.
<TLS spokes woman>...then we cant see that ehhh ehhh in the transactions in our back-office
<journalist in the studio> So at that moment I am untraceable, and you cant do anything against me.
<TLS spokes woman> We aren't able to see that, no.
<anchor guy> And so definitively the TLS-card dies. Costing 3.000.000.000,- Euro, and nothing. The minister is summoned for a debate before parliament to explain what he will do about it. And here is some more ammo for the ladies and gentlemen of the opposition; the software needed is, since yesterday, downloadable from bittorrent sites. Cracking the TLS-card is now in reach for your grandmother of 82 years old.
<Jojanneke a.k.a. Pow-janneke> The cracking of the TLS-card is now made even simpler because the software is leaked to bittorrent sites, what does that mean?
<journalist> It means that anyone can download this, and since it is a very simple crack I am not surprised that it is put in the open.
<Jojanneke> This thing is also needed (hold up card reader), where to buy this? In a shop?
<journalist> Yes, it is about three tenner's, so anyone can go ahead with a TLS-card.
<Jojanneke> But can it be bought in a store?
<journalist> Yes, or on-line if they aren't sold out yet.
<Jojanneke> And we dont have to check in at the station, we can do this at home?
<journalist> yes, that is quite simple to do (shows program how-to) and because you do this at home, you are invisible to the back-office. The conductor just checks whether the card has been checked in or not, and that data is transmitted to the system at the end of the day, but by then you already left the train.
<Jojanneke> In other words, it is so simple even my grandmother can do this?
<journalist> Even your grandmother can do this easily
<anchor guy> Well and if this isnt bad enough, the hackers will present a new version tomorrow that will make it even more easy with new features like making mony with that card!
<Jojanneke> Hackers are busy to speed up the process to keep it within 15 seconds, what does this mean if the succeed in that?
<journalist> Well then it is so fast and easy that it becomes feasible to start a 'business' with that.
<Jojanneke> So they can recharge a lot of cards in a short while.
<journalist> Yes, you give me a tenner, and I put a hundred euro's worth of credit on it. And I have warned about this in the past that this might happen.
<anchor guy> If by chance you are slightly handy with computers, TransLinkSystems is looking for a fraud-manager that can monitor the security measures of the cards, stress-resistance is a pre.
Sorry for any mistakes made, but you'll get the message right?
Re: (Score:2)
Our Jojanneke showed us yesterday that even blonde women can crack the TLS-chipcard
But they shouldn't worry their pretty little heads about it, because they can get a big strong man to do it for them.
Re: (Score:2)
If you do such a stunt, always carry another paid-for ticket with you. By doing so many of the possible charges like riding without a ticket can not be applied.
Even Fraud might be off the table because the fraud would normally be that you made the machine believe that you have a valid ticket. But in that case you have a valid ticket, so likely no Fraud (depends on the country and their laws).
Vienna (Score:1)
Their system is immune to this.
They simply stamp a piece of paper with a time, and about 5-10% of the cars have fare checkers. The fine is enough that it's not worth cheating (though I've done it when a youth and out of cash, but wanting to get home. I assume a crying American child that doesn't speak German traveling alone is not worth processing).
Re: (Score:2)
Re: (Score:2)
You can pay the fine for every day they manage to catch you. Makes it slightly less attractive if they can catch you twice in a month.
Easy answer (Score:5, Insightful)
I suppose the natural solution then would be to ban the app, possibly ban android phones with NFC capability, and/or threaten the security researchers with jail time. That's usually what legislators and law enforcement does... rather than, I don't know, fix the problem with the cards?
Re: (Score:1)
Jesus.
fucking.
CHRIST.
Prove it.
You made this naked assertion. Prove it.
Re: (Score:1)
You made this naked assertion. Prove it.
Jesus couldn't -- that's why the Jews are still waiting. I'm not sure what this has to do with NFC vulnerabilities though...
Long ago... (Score:5, Informative)
Back in the 80s they tried to introduce plain-clothes security officers on amsterdam trams to catch people who didn't pay for an honor-system ticket and got on anyway. The people of amsterdam had a referendum and votes that the officers had to wear unifroms, so that fare hoppers would have "a sporting chance" of running away when an inspector got on the tram.
Re: (Score:2)
Here in Minnesota MetroTransit officers come on the train regularly to check everyone's ticket/card to make sure they have a valid fare.
Several times I observed people jump off the train once they saw the officers and they didn't even chase after them; instead, they continued to check and scan everyone else who actually had paid.
I love paying the whopping $1.25 + tax dollars to fund this lovely operation only to be hassled by cops only to watch the douchebags run away free.
Re: (Score:3)
what "take advantage"? (Score:5, Insightful)
That's not taking advantage of anything. The card's programmable, you programmed it. Congrats. That's like printing a transfer on your home printer. Same illegal it's always been.
So tell me again why these cards don't authenticate against a central reliable source? Oh yeah, we're replacing slips of paper, not brinks trucks with armed guards.
Right.
High-speed traffic is still controlled with painted lines, not concrete walls. Not everything is security-related.
Re: (Score:2)
But it's not exactly new tech to query a central server for each transaction wirelessly. They don't even need a cell agreement, they can have a node at each station - people only get on at the designated stops, after all.
We're replacing slips of paper, sure, but shouldn't they be replaced with something better than slips of paper, rather than something that costs more than paper and has much greater chance for fraud?
Re: (Score:1)
I don't live in the affected regions but unless they are retarded, the same card is also used on buses. Having a network connected node on each and every bus stop would be quite expensive.
But having a reliable connection to a central system is not the only problem, it also need to have very low latency. Validaton must be instant. Flash the card while keep walking, don't stop moving unless there's a beep/red light/the gate doesn't open/etc. Even a second delay of "Authenticating..." for each traveller would
Re: (Score:3)
It doesn't have to be instant. It just needs to be able to invalidate cards. Card stores amount of money it has, which the reader then sends back to the system for verification. If said cards numbers don't match, card gets banned. Message gets sent to every scanner to ring a klaxon and take a photo if said card gets swiped. I'm sure it's not too difficult to store card id numbers on all the readers.
There's more than one way to solve this problem.
Re: (Score:2)
You don't even need the klaxon and camera. Just record the transaction like normal and deduct the balance from the account when the transactions are sent to the central server. Then keep a record of negative balance accounts and sync the list on each bus/train when they return to the station.
In case someone goes negative balance and tops off the same day, sign the balance with the time each time it's updated, and accept cards with positive balances whose update time is fresher than the expiry list sync ti
Re:what "take advantage"? (Score:4, Informative)
Well, don't speak for the system being described in TFA, but I do know that my city (Ottawa, Canada) has been trying to replace the old bus pass/ticket/transfer system with an electronic system called Presto.
With the Presto system, in theory, it communicates your card ID to a central server, debits the card, and records the last time you used it so that you can swipe it every time you get on, and it will be smart about whether it charges you (assuming you're not on a monthly pass). You can also buy extra money through an online portal, and you can set it up to automatically renew. That's how it's supposed to work, in theory.
In practice, it's been delayed by a year due to "unforseen behaviour". Specifically, it occasionally double charges somebody when the wireless communication is spotty, sometimes it doesn't register the charge at all, and I've seen the readers on buses popping up error windows instead of the actual reader screen more often than not... presumably this error is also caused by lack of communication with the central server, if the text of the error message is anything to go by. I've also seen them pop up the Windows CE equivalent of a BSOD a couple of times, and at this point, even though they were supposed to be in full use/production by June of this year, they're turned off.
Now, for a subway system, there's no excuse to be relying on wireless communications for the point of sale. The gates don't move, and you're running a wire to it for power anyway. But for something that does move, like, say, a bus or trolley car, they do have to rely on some kind of wireless network, and that may or may not be reliable depending on how the network is set up. They may have decided that going with something like cellular data was too expensive for the system, and have set it up to sync the logs by wifi when they get back to the shop. In a situation like that, it may make sense to have some writeable data on the card to sync with, like a floating balance.
That being said, not having each card uniquely identifiable/trackable to catch this kind of thing is just silly... if you *are* going to have to leave some writeable data on the card, put a unique identifier in a non-programmable part of the memory, and have an automated system update the central database with your running balance at the end of the day... when the last value read by the card reader doesn't match what it should be in the database, blacklist the card have each unit pull the current blacklist as they leave the terminal for the day's route. It's not as if it would take a lot of data storage to keep a list of blacklisted serial numbers, and flash storage is cheap enough to include in every console.
Re: (Score:3)
Oyster Cards [tfl.gov.uk]
This is what they use in London. They work on trains and buses, and work reliably and efficiently. They seem to work in exactly the way you suggest, as not 100% bulletproof security but only good enough.
I think the balance is stored on the card, but all transactions are sent through to a central authority, which would certainly be able to detect any fraud and disable cards found to be behaving suspiciously. Or, more likely, have the ubiquitous CCTC cameras in London identify those using fraudu
Re:what "take advantage"? (Score:5, Insightful)
No, we shouldn't. There likely isn't enough fraud to warrant such measures. Besides, the system that you describe has huge maintenance costs. You can't have these things stop working during rush hour. And between the central server itself, network nodes everywhere, and wireless lag, there's expense, personnel, and it'll slow things down too. And in the end, you'll have a huge network, with so many nodes that it can be hacked directly anyway. Then you'll want to secure that.
On top of everything though, crime isn't the responsibility of the transportation department. If people are commiting fraud, that's what police are for. Transportation doesn't want to pay for it, and I don't blame them. I wouldn't pay for it either.
Re: (Score:3)
From what I can gather, here in LA, the fare reader just stores the information (the tap scans) and either at the end of the day, or end of the week, these logs are transferred and credited against the accounts that scanned through. I know when I put $20 on my card, it can be a week or more before I see the "balance" change even though I use it near daily. It seems fair enough for me and if someone scans through a low/zero fare card, sure, they might "get away with it" for a few rides, but they'll eventua
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
same cards are used on the bus (Score:2)
same cards are used on the bus and the bus is not wired to network.
Re: (Score:2)
Actually some buses are. They have a GPS receiver and some kind of wireless uplink (probably cellular), so that riders can view a (near) real-time map on their phone/tablet/laptop/etc. and see when their ride is going to arrive. It's quite handy.
Re: (Score:2)
Re: (Score:2)
In Hong Kong you can use the Octopus for most convenience and grocery stores as well. Room for serious abuse there. Yikes.
Re: (Score:2)
Balance on the card? (Score:5, Insightful)
buses don't have a 100% live link (Score:4, Informative)
buses don't have a 100% live link
Re: (Score:2)
Re: (Score:3)
Expense. Taxis have live links because they're profit-generating. A trip in a taxi is charged per mile and at a major premium. Bus fare is deficit-minimizing and offers the opportunity to to travel very long distances for very little cost.
Subways and light rail, though, can be different. Some charge per boarding while others charge per the distance between boarding and exiting.
Also, consider what would happen if cellular service was unavailable. You'd have to create a charge-caching system and then do bulk
Re: (Score:3)
Honestly, I think a better solution is to have unique ticket identifiers (that don't follow sequences of course), carry the current balance on the card, but update the balance when the bus is near a paying station or in the parking lot (during shift change). At some point, you can actually invalidate the cards that seem fraudulent due to updates with similar values.
Re: (Score:1)
In the San Fransisco Bay Area they do!
Re: (Score:1)
Hell, some buses even provide a wifi access point (served though Clear's 4G network)
Re: (Score:2)
Re: (Score:2)
Considering hundreds of thousands of cars make it through an iPASS system in Illinois... the delay wouldn't be so bad.
Let's put it this way, iPass reads the transponder, checks the balance, and then flashes a light notifying you of the result in less than a second. The speed limit through those lanes are normally 15 mph but can get as high as 35 and they still read perfectly. The open road tolling doesn't notify you via light but there are plenty of stations still out there that have the light.
The system
Re: (Score:2)
Ipass is fixed in place and pre reads the transponder. Also you need to try harder it works at 70+
Re: (Score:2)
Re: (Score:2)
So store it on the card, and record it on the buses computer. Download the bus whenever it returns to the depot. Update the balance nightly from on a database. Flag cards that come back with a discrepancy at recharge time. If a card has a negative balance (i.e. tampered or spoofed), blacklist it. download the blacklist to the bus regularly.
Wait, I should patent that. Method and apparatus for a tamper resistant NFC fare card system.
Re: (Score:1)
You'd be surprised that some city buses do have live links. (well limits of cellular data of course) GPS reporting of location to home base and other data.
I don't see why transactions couldn't be live, and in the case of a data link down (big tree/building) just cache the transaction and upload results when link is back up.
It would be smart that there be enough storage to cache the entire day, so if the antenna gets broken off the bus can still run.
The flaw would be that when there is no data there is no w
Re:Balance on the card? (Score:5, Interesting)
Why on earth would anyone store the balance on the card you give to customers? Isn't that kind of an open invitation to exploitation not to mention customer service headaches from people losing/damaging their cards?
There are lots of reasons that you might want to store the balance on the card. Increased reliability in the face of network outages, improved performance by eliminating the need for a network round trip and a database query, the ability to deploy in environments without network access at all, the ability to cross incompatible system boundaries... and many more.
Further, if you do it right, there's no reason not to store the balance on the card. Smart card chips like those used in these fare cards are designed to provide a fairly high degree of security. They can perform cryptographic operations to authenticate the commands they're given, and they can make decisions about whether or not they're going to honor the commands based on authentication and on the content of the request and its context (to the degree that they're aware of context).
But building smart card systems is hard, and making them secure adds another layer of complexity and frustration when things just don't work because the damned card keeps rejecting your -- you believe -- properly authenticated and formatted commands. It's normal for the early stages of development to disable security for ease of development and testing... and it's unfortunately pretty common for security to be left off, or at least not thoroughly validated, for deployment. And it mostly works, because contactless smart card readers are relatively rare -- they're not expensive, mind you, haven't been for many years, but they have been uncommon. Except now there's one embedded in every one of an increasing number of high-end smartphone models.
This isn't a fundamental architectural flaw, it's either a detailed design flaw or (very likely) a straight up implementation error. Most likely caused by simple laziness and incompetence (granted that finding competent people in this area of technology isn't trivial, and self-education is a multi-year process).
Re: (Score:2)
Smart card chips like those used in these fare cards are designed to provide a fairly high degree of security.
I think that's an optimistic statement..
"The security of MIFARE Classic [wikipedia.org] is terrible. This is not an exaggeration; it's kindergarten cryptography. Anyone with any security experience would be embarrassed to put his name to the design."
That's a quote in response to the use of Mifare Classic in the Transport for London Oyster card ; they've since upgraded to the MIFARE DESFire mode. When I was last involved in the smartcard industry you could break one in a few hours with a Pentium 4, even if you implemented it properly. These days the Classic has been broken comprehensively. Apparently the DESFire is broken too.
The paper states these cards are MIFARE Ultralight [wikipedia.org]. Unless they are the "C" model (and it
Re: (Score:2)
You basically just confirmed my argument, except that the implementation error lay in the choice of chip technology. Yes, old MIFARE sucked (and everyone always knew it, even when it wasn't old), but there are lots of other options, many of them very inexpensive, and for reusable cards the price doesn't really have to be that low anyway -- so what if the card costs 75 cents, or even a dollar or two? Raise fare prices by a tiny amount, then offer small discounts for loading reusable cards, and make the con
Re: (Score:2)
At least around here (can't say about SF or other cities, but I'm assuming it's similar), they're being incredibly slow with merely installing subterranean antennas so that cellphones can get a signal in the subway. Replacing all the card scanners (and all the cards!) currently in use with wireless or wired ones would be non-trivial for an efficient organization, so I'm assuming it's just about impossible for the average transportation authority.
However, that doesn't mean nothing can be done about it. Just
Re: (Score:2)
Perhaps, but you can program them to store a serial number AND a rewritable fare value. And be a "treat it like cash" thing - lose it, you lost its value.
What you have is a central database of ID numbers and their values. When a faregate reads the card, it tries to contact the server. If it succe
Not in Philadelphia (Score:3)
Yeah, that's great, but... (Score:1)
The subway system designers aren't quite that stupid.
1. Every card has a non-alterable (for practical purposes) serial number.
2. The systems almost certainly log entrances/exits/charge transactions.
I don't know the details of every system world-wide, but even in here in Japan where the train pass cards are heavily encrypted and basically haven't been broken, they still perform audits.
The card is fast because all activity takes place on the card (not a remote database), but the results are still tracked and
Re: (Score:2)
These cards are MIFARE Ultralights ; they are a simple, 64-byte memory container. You don't need ANY crypto ability ; you read the data off, you write the data on.
Log processing occurs overnight in these systems. Even if the card has a read-only identifier, they're designed to be cheap, so you just discard it after one days use.
The technical aspects of these are not really what makes it notable enough for an information security conference. What makes it notable is that the transport authorities concerned a
Philadelphia is safe (Score:2)
...well, as safe as Philadelphia gets, anyhow.
Philadelphia's SEPTA passes are all flat-rate. A weekly transpass costs $22.00, and lets you take unlimited subway rides, as well as unlimited rides on all busses within city limits. So, there is no amount to reset.
This is the Oyster Card Hack from 2008... (Score:2)
http://www.pcpro.co.uk/news/207966/oyster-hackers-roam-london-for-free [pcpro.co.uk]
Re:Where can I.. (Score:4, Funny)
http://fbi.gov/ [fbi.gov]
Re: (Score:3)
That is strange. When I called them up, they offered to bring me a copy and show me how to install it on my phone. They changed their minds when I told them I lived in Canada.