Hacking subway passes

[Martin]

Here are the slides of a presentation at DEFCON about hacking various public transportation system access cards, gaining physical access to facilities etc.

http://www-tech.mit.edu/V128/N30/subway/Defcon_Presentation.pdf


The gist of it:
-the amount of money is stored on the magnetic stripe, allowing you to change it easily and put as much money as you wish on the card.
- they figured out how to break the RFID cards
- they came up with warcarting: http://web.mit.edu/zacka/www/warcart.html

 

[Baked]

Judge zips MIT students' lips on mass transit fare exploits

 

[manlymatt83]

:thumbsdown:

 

[ric1287]

would be cool except for the loads and loads of cameras that would catch you

 

[TallBill]

Originally posted by: ric1287
would be cool except for the loads and loads of cameras that would catch you

Catch you adding money to your card at home?

 

[jpeyton]

Hack the planet!

 

[IEC]

Originally posted by: jpeyton
Hack AnandTech

/LoKe

 

[ric1287]

Originally posted by: TallBill

Originally posted by: ric1287
would be cool except for the loads and loads of cameras that would catch you

Catch you adding money to your card at home?

when they track down the hacked cards (which they will) all they have to do is go back to the tapes of when that card was last used.

 

[Chrono]

So I went to defcon, and I have to admit that it was not my thing at all. Luckily I was sent by my work and didn't have to pay for the convention.

 

[Eeezee]

Originally posted by: ric1287

Originally posted by: TallBill

Originally posted by: ric1287
would be cool except for the loads and loads of cameras that would catch you

Catch you adding money to your card at home?

when they track down the hacked cards (which they will) all they have to do is go back to the tapes of when that card was last used.

First, how will they know that it's hacked? It sounds like you're just modifying the magnetic strip. Most subway cards don't have a smart chip or anything like that, so there's essentially no way to detect hacked cards.

Furthermore, the cost of tracking down the hacked cards is far greater than the fares lost. Not only do they need to go through tons of video footage, but they also requires a method of prosecution, which requires even more funds.

No, the best thing they can do is preventative; either keep this information from becoming popular (which it never will be, since most people who want free fares aren't willing to figure out how to hack their cards) or change the cards and add security features.

 

[PottedMeat]

Originally posted by: Martin
Here are the slides of a presentation at DEFCON about hacking various public transportation system access cards, gaining physical access to facilities etc.

http://www-tech.mit.edu/V128/N30/subway/Defcon_Presentation.pdf


The gist of it:
-the amount of money is stored on the magnetic stripe, allowing you to change it easily and put as much money as you wish on the card.
- they figured out how to break the RFID cards
- they came up with warcarting: http://web.mit.edu/zacka/www/warcart.html

Heh is the MTA stupid or something?

 

[Anubis]

Originally posted by: PottedMeat

Originally posted by: Martin
Here are the slides of a presentation at DEFCON about hacking various public transportation system access cards, gaining physical access to facilities etc.

http://www-tech.mit.edu/V128/N30/subway/Defcon_Presentation.pdf


The gist of it:
-the amount of money is stored on the magnetic stripe, allowing you to change it easily and put as much money as you wish on the card.
- they figured out how to break the RFID cards
- they came up with warcarting: http://web.mit.edu/zacka/www/warcart.html

Heh is the MTA stupid or something?

YES

that was a stupid question

 

[txrandom]

Why couldn't they tell me this before I traveled to NYC?

 

[Modelworks]

Its been around for years.
People have been stealing credit card info like this for a long time.


Tip: If a cashier ever wants to swipe your card for you behind the register, watch them very closely.

 

[mugs]

Originally posted by: PottedMeat

Originally posted by: Martin
Here are the slides of a presentation at DEFCON about hacking various public transportation system access cards, gaining physical access to facilities etc.

http://www-tech.mit.edu/V128/N30/subway/Defcon_Presentation.pdf


The gist of it:
-the amount of money is stored on the magnetic stripe, allowing you to change it easily and put as much money as you wish on the card.
- they figured out how to break the RFID cards
- they came up with warcarting: http://web.mit.edu/zacka/www/warcart.html

Heh is the MTA stupid or something?

They were probably thinking that this method was faster, cheaper, and less failure-prone than having the turnstile access a centralized server to get the card's balance. Imagine what would happen if they had a network outage. :Q

They probably realized that people would figure out how to duplicate the cards, but only smart people would do that. Of course, they apparently didn't think that smart people might sell the duplicated cards to stupid people. :Q

I'm not sure how you could fully eliminate the issues with storing the info on a centralized server, and I'm not sure how you could prevent cloning cards either. Encryption would prevent people from manipulating the data, but it wouldn't prevent people from cloning cards. With some effort, they could use a centralized server to detect cloned cards (since the card contains a unique card ID, a value and a timestamp, it's easy to detect when a card is used multiple times). That would make a network outage non-critical.

 

[Modelworks]

They could prevent it by switching to smart cards, but those are not nearly as cheap as mag stripe cards. About 20x more cost.

 

[sdifox]

Originally posted by: Chrono
So I went to defcon, and I have to admit that it was not my thing at all. Luckily I was sent by my work and didn't have to pay for the convention.

Whut? What kind of company do you work for?

 

[JeffreyLebowski]

Originally posted by: jpeyton
Hack the planet!

Only works on 386 laptops plugged into payphones and if you use a 3d OS.

 

[Colt45]

Not terribly surprising.

Security through obscurity = fail.






although I don't think this is even obscure. lol.

 

[crab]

Originally posted by: sdifox

Originally posted by: Chrono
So I went to defcon, and I have to admit that it was not my thing at all. Luckily I was sent by my work and didn't have to pay for the convention.

Whut? What kind of company do you work for?

lol

 

[Tremulant]

Originally posted by: JeffreyLebowski

Originally posted by: jpeyton
Hack the planet!

Only works on 386 laptops plugged into payphones and if you use a 3d OS.

Extra points if the keyboard letters are wingdings or if the entire laptop has a camo paint job.

 

[OutHouse]

Originally posted by: Eeezee

Originally posted by: ric1287

Originally posted by: TallBill

Originally posted by: ric1287
would be cool except for the loads and loads of cameras that would catch you

Catch you adding money to your card at home?

when they track down the hacked cards (which they will) all they have to do is go back to the tapes of when that card was last used.

First, how will they know that it's hacked? It sounds like you're just modifying the magnetic strip. Most subway cards don't have a smart chip or anything like that, so there's essentially no way to detect hacked cards.

Furthermore, the cost of tracking down the hacked cards is far greater than the fares lost. Not only do they need to go through tons of video footage, but they also requires a method of prosecution, which requires even more funds.

No, the best thing they can do is preventative; either keep this information from becoming popular (which it never will be, since most people who want free fares aren't willing to figure out how to hack their cards) or change the cards and add security features.

and that is exactly why you would get caught.