×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Cracking Atlanta Subway's Poorly-Encrypted RFID Smart Cards Is a Breeze

timothy posted about 4 months ago | from the but-you're-still-in-atlanta dept.

Crime 139

McGruber writes "Seven metro Atlanta residents are facing theft, fraud, and racketeering charges for allegedly selling counterfeit MARTA Breeze cards. Breeze cards are stored-value smart cards that passengers use as part of an automated fare collection system which the Metropolitan Atlanta Rapid Transit Authority introduced to the general public in October 2006. Breeze cards are supplied by Cubic Transportation Systems, an American company that provides automated fare collection equipment and services to the mass transit industry. At the time of this slashdot submission, the Wikipedia page for the Breeze Card (last modified on 2 August 2013 at 14:52) says: 'The Breeze Card uses the MIFARE smart-card system from Dutch company NXP Semiconductors, a spin-off from Philips. The disposable, single-use, cards are using on the MIFARE Ultralight while the multiple-use plastic cards are the MIFARE Classic cards. There have been many concerns about the security of the system, mainly caused by the poor encryption method used for the cards.'"

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

139 comments

Inevitable... (4, Interesting)

Shuntros (1059306) | about 4 months ago | (#45812093)

Old MiFare stuff is toast, security wise. Any old fool can order some UID-writable tokens on eBay from China, grab a copy of libnfc and mfoc, then things get interesting pretty quickly.

Re:Inevitable... (0, Flamebait)

Anonymous Coward | about 4 months ago | (#45812135)

gotta wonder what "any old fool" thinks when he goes to such lengths to steal from his fellow citizen and public transit in general to fund China.

/ middle-age long-time slashdotter here: I used to think that fundamentally good people became geeks and engineers and fundamentally bad people became bankers and lawyers. 15+ years of reading self-serving rationalizations (of piracy, of blatant tax evasion, of all sorts of blatantly anti-social behavior) slashdot has thoroughly disabused me of the former half of that theory. The latter half is still intact though.

Re:Inevitable... (2)

the_B0fh (208483) | about 4 months ago | (#45812237)

Why do you blame OP? Shouldn't you blame the company for using really stupid and known to be flawed encryption?

Re:Inevitable... (-1, Flamebait)

Anonymous Coward | about 4 months ago | (#45812521)

No, I don't blame the company; I blame the criminals who are exploiting the system and taking something for nothing. I blame the other criminals who are blatantly selling "cheap" rides. Just because something isn't secured very well is no excuse to exploit it. Those actions are criminal.

Re:Inevitable... (3, Insightful)

Shuntros (1059306) | about 4 months ago | (#45812647)

Well thanks Anonymous Coward (latin: buffoonus maximus), but that's a bit of a tenuous jump. I don't even use public transport, I'm just a guy who does a bit of NFC engineering for the day job and knows the difference between the wrong way to do it and the way I do it. The token security is weak, certainly, but it's easy to protect against with some very low-overhead crypto.

Re:Inevitable... (1)

Anonymous Coward | about 4 months ago | (#45815881)

So according to your logic, it's ok to steal something if the security is poor? Or to use a resource if it's security is poor?
Can I also punch someone in the back of the head because they're weak?

Re:Inevitable... (1)

sjames (1099) | about 4 months ago | (#45812657)

For the same reason we blame burglars even though houses still use doors that can be easiny kicked it and window that break so easily.

Re:Inevitable... (0)

Anonymous Coward | about 4 months ago | (#45813593)

Except of course that the op is a locksmith instead of burglar.

Re:Inevitable... (1)

Anonymous Coward | about 4 months ago | (#45812707)

is this a serious question? do you honestly need an answer to the question of "if a thief gets in a poorly defended house, who is overwhelmingly at fault?" is your moral compass so broken?

Re:Inevitable... (1)

Stan92057 (737634) | about 4 months ago | (#45814325)

No the blame goes to the criminals who hacked it and sold them. Fact is they had no business cracking the encryption what so ever. The door was locked they broke the lock doesn't matter how poor the lock is and Having the lock in place means stay out.

Re:Inevitable... (3, Insightful)

the_B0fh (208483) | about 4 months ago | (#45814487)

There is this thing called a "reasonable man" standard. If you run a business website, you're expected to run it behind a firewall, and have other security standards in place.

Otherwise, you end up like any one of those companies that get hacked. I had stated it incorrectly earlier - I do not mean to say criminals who hacked the system are not in the wrong. However, implementing shitting security is also wrong.

Just like a bank should have a reasonable security system, and the bank's vault should have something better than a $5 padlock. Bank robbers are wrong, but if a bank had only a $5 padlock on it, *THEY ARE WRONG TOO!*

WHY ARE YOU SO FORGIVING OF COMPANIES THAT IMPLEMENT SHITTY SECURITY OR PUTTING IN FAKE SECURITY?

Re:Inevitable... (1)

liquidpele (663430) | about 4 months ago | (#45814999)

WHY ARE YOU SO FORGIVING OF COMPANIES THAT IMPLEMENT SHITTY SECURITY OR PUTTING IN FAKE SECURITY?

Because often times perfect security is either impossible or at least more expensive to implement. These companies put up such things because a cost/risk analysis is done and they probably realize that only like 0.05% of people could scam the system out of a $1.50 ticket. This is business, not some geek wet dream.

http://xkcd.com/538/ [xkcd.com]

Re:Inevitable... (2)

the_B0fh (208483) | about 4 months ago | (#45815601)

Who is talking about perfect security? I'm talking about not deploying systems with *KNOWN* security problems.

Like how WEP was known flawed and yet deployed, because of people like you. No one is talking about perfect security. But at least put some effort into making it secure, damnit. And by that, I don't mean letting your damned intern throw some shit together, but getting some seasoned professionals in the security field to work on it.

Re:Inevitable... (0)

Anonymous Coward | about 4 months ago | (#45812251)

Your notion that hacking your local transit company to get a free ride, or just to see "if you can do it" is "fundamentally bad"? Is a leap.

It's bad if you have a bad intent, but "China" 's benefit from the sale of a few badges is probably comparable to the loss of a very small % of fares by the agency.

If this is "fundamentally bad" you really don't want to know what goes on.

Re:Inevitable... (1)

Anonymous Coward | about 4 months ago | (#45813041)

It's stealing. It IS fundamentally bad. End of.

Now, it may have some upsides (education, vuln exposure/disclosure, financial [for the their]), but fundamentally, it's bad.

Re:Inevitable... (1)

bhcompy (1877290) | about 4 months ago | (#45813305)

Think of it from a macro point of view. You might save a few bucks, but it's remarkably difficult to get public transportation funding all across the US and ever dollar lost is just one more thing that those against public transportation will use against new and existing public transport projects in the future

Re: Inevitable... (0)

Anonymous Coward | about 4 months ago | (#45812533)

Vocation and moral intent can be loosely correlated, but (usually) only very loosely. For example, I know some small credit union 'bankers' who are very moral/'good' folks, and one lawyer who chooses his cases carefully and largely works pro-bono for those who would otherwise be walked on by the system. I do know examples of the scummy sorts of those vocations too, unfortunately. I've known good and bad techs, too.

Re:Inevitable... (1)

Shuntros (1059306) | about 4 months ago | (#45812677)

Honestly, what the actual fuck? Have you listened to yourself?

I don't actually use public transport. I just do some NFC work for the day job and know how weak the keys are in old MiFare stuff. No wonder you posted AC with that outburst of verbal diarrhoea.

Re:Inevitable... (-1)

Anonymous Coward | about 4 months ago | (#45812723)

Compare to Spelling Diarrhea....

Re:Inevitable... (0)

Anonymous Coward | about 4 months ago | (#45813571)

Diarrhoea is actually a correct spelling. If you're going to pick on someone for spelling because you have nothing intelligent to say, at least find a comment with spelling mistakes before you crack open a fresh can of Internet Douchebag Juice and squirt it around.

Re:Inevitable... (0)

Anonymous Coward | about 4 months ago | (#45813407)

Geeks aren't saints - why should we be special? Criminals exists everywhere. There may be more in finance, because you can steal so much more in one go. These counterfeiters get their money selling one subway card at a time. And they are easily caught - not because of tech flaws, but because they need so many customers. All the investigator needs, is to pretend to be an interested buyer.

Re:Inevitable... (0)

Anonymous Coward | about 4 months ago | (#45814041)

i guess the company selling the hardware, which is likely made in china, is also stealing from their fellow citizens and funding china

Re:Inevitable... (1)

mynamestolen (2566945) | about 4 months ago | (#45815397)

evil is a silly construct. Read: Howard K Bloom, The Lucifer Principle: A Scientific Expedition Into The Forces of History

Re:Inevitable... (-1)

Anonymous Coward | about 4 months ago | (#45812365)

Old MiFare stuff is toast, security wise. Any old fool can order some UID-writable tokens on eBay from China, grab a copy of libnfc and mfoc, then things get interesting pretty quickly.

No, when things get interesting is when the Feds show up
with a battering ram and wake you up at 03:30 and cuff your sorry
immoral unethical thieving ass, and you end up facing enough charges
that if you are convicted of all of them you won't see freedom until you
are considerably older.

why? (3, Informative)

Lehk228 (705449) | about 4 months ago | (#45812113)

I don't understand why these systems are set up like this, operationally it's not much different from EZ-Pass which works fine with an account based system, putting the value tracking on the cards is just asking for an upgrade treadmill even if it's well designed now, 10 years from now it will be easilly cracked. compare CPU vs GPU/FPGA/ASIC hashing advances

Re:why? (4, Informative)

QuietLagoon (813062) | about 4 months ago | (#45812139)

E-ZPasses Get Read All Over New York (Not Just At Toll Booths) [forbes.com]

After spotting a police car with two huge boxes on its trunk — that turned out to be license-plate-reading cameras — a man in New Jersey became obsessed with the loss of privacy for vehicles on American roads. (He’s not the only one.) The man, who goes by the Internet handle “Puking Monkey,” did an analysis of the many ways his car could be tracked and stumbled upon something rather interesting: his E-ZPass, which he obtained for the purpose of paying tolls, was being used to track his car in unexpected places, far away from any toll booths.

Re:why? (0)

Anonymous Coward | about 4 months ago | (#45812561)

Looks like there's a real need for Faraday Cage wallets nowadays.

Re:why? (3, Informative)

fluffy99 (870997) | about 4 months ago | (#45813403)

The plausible explanation is that they are simply using ez-pass as a means to assess traffic congestion, ie how long is it taking a car to traverse a section of highway. Of course I don't doubt that law enforcement wants access to track people, but generally cell phone tracking is more reliable and readily accessible. Wanna bet these are at the border as well?

Re:why? (1)

Anonymous Coward | about 4 months ago | (#45813569)

The technology is created by a company called Cubic Transportation Systems, and it turns out there are a lot of open questions about who is behind this company.

http://www.genuinewitty.com/2012/08/22/will-vancouvers-new-transit-passes-be-spying-on-you-and-who-has-access/

"A story came out recently linking Cubic to Trapwire- but, Cubic came out with a denial that they were connected. But, according to research by Cryptome.org, Trapwire is headquartered at the same address as Cubic, and some of the same people are on their board of directors. So, despite their denial, these companies are closely connected. Their customers include most of the major police and national security agencies in the western world."

Re:why? (1)

Bite The Pillow (3087109) | about 4 months ago | (#45814973)

Quote without relevance. When read elsewhere, they are not deducting a payment. That was the point, not putting the account on the card.
And, it seems to be part of traffic management, so I don't see a major security issue here.
Whatever point you had, it got missed completely.

Re:why? (2)

CaptBubba (696284) | about 4 months ago | (#45812157)

It allows for fallback to the stored value on the card if the data connection between the authenticating device and the home station is unreliable, as would be expected in a wide-ranging bus system when these cards were initially deployed.

Also EZPass and the like have the additional advantage of being tied to either a registered name or an easily identifiable way to bill someone (via a photo of the license plate) in case their account is empty. You don't have that luxury when dealing with people getting on and off mass transit.

It's very different... (0)

Anonymous Coward | about 4 months ago | (#45812161)

It's very different to EZ-Pass. All EZ-Pass needs to do is identify you. You don't get your current balance, nor do you get denied access to the road/bridge if your EZ-Pass isn't in credit/isn't active/etc.

EZ-Pass works because they have a backup mechanism, being video/photographs of license plates so they know who to charge if they can't charge through EZ-Pass - obviously that doesn't work for public transport.

you don't have an 100% live data link with systems (1)

Joe_Dragon (2206452) | about 4 months ago | (#45812201)

you don't have an 100% live data link with systems like this (lot's of metro systems have both bus and rail and there can be cell dead zones that have areas with no data link) and you don't really have a away to bill later if there is some kind of read error.

Re:you don't have an 100% live data link with syst (-1)

Anonymous Coward | about 4 months ago | (#45812589)

Learn the difference between:

Lots
Lot's

Also, you probably need to brush up on:

There
They're
Their

There is also:

Its
It's

Perhaps more of these... Educated people know the proper usage of these types of words.

Re:you don't have an 100% live data link with syst (-1)

Anonymous Coward | about 4 months ago | (#45812957)

Learn the difference between:

You're number one (index finger held erect).

And:

Jam it in your ass (middle finger held erect).

As a dumb-fuck you'll understand the proper usage of these digits.

Re:you don't have an 100% live data link with syst (0)

Anonymous Coward | about 4 months ago | (#45813743)

As someone who reads without having to sound out every word for possible homophones, it's really frustrating when the wrong word is used.

Re:you don't have an 100% live data link with syst (0)

Anonymous Coward | about 4 months ago | (#45814847)

It's is not, it isn't ain't, and it's it's, not its, if you mean it is.
If you don't, it's its. Then too, it's hers. It isn't her's.
It isn't our's either. It's ours, and likewise yours and theirs.
-Oxford University Press, Edpress News

See how easy that was?

Re: why? (1)

Anonymous Coward | about 4 months ago | (#45812289)

Stored value also has nicer anonymity. Nothing tying it back to your identity (ie buy it with cash). Drop it in the street and you've lost your money a la cash.

Re:why? (0)

Anonymous Coward | about 4 months ago | (#45812499)

Account based systems are a privacy nightmare.
With an account based system, you can basically track every pass user everywhere all the time.

Re:why? (1)

davidwr (791652) | about 4 months ago | (#45812787)

Account based systems are a privacy nightmare.
With an account based system, you can basically track every pass user everywhere all the time.

That depends. If it's post-paid or renewing-prepaid account, you are correct.

If it's a prepaid account that is purchased anonymously and not re-loaded when the money runs out or the number of pre-paid days expire, then the privacy issues are much less. All you can do then is say when the card was used. Unless you have something else to go by, such video camera coverage of one of the times it was used, you can't say who the card belongs to.

Subway tokens should be cash-like (1)

davidwr (791652) | about 4 months ago | (#45812771)

If I am not going to use cash, I'd prefer to use a token that is cash-like:
* is transferable like cash
* can't be tied back to me
* isn't widely counterfeited, so I'm not subsidizing freeloaders
* is convenient to use

Except may be for the counterfeiting part, subway tokens and prepaid fair passes generally meet this requirement.

I don't have any inherent objection to something that operates like a prepaid debit card, as long as I can purchase it anonymously without any additional fees beyond the fair itself. Just don't be surprised if I buy a new card every few weeks instead of reloading the existing one.

Re:why? (1)

citizenr (871508) | about 4 months ago | (#45813207)

I don't understand why these systems are set up like this, operationally it's not much different from EZ-Pass which works fine with an account based system, putting the value tracking on the cards is just asking for an upgrade treadmill even if it's well designed now, 10 years from now it will be easilly cracked. compare CPU vs GPU/FPGA/ASIC hashing advances

Because its expensive to run a lot of data over GSM links in every bus/tram in the city.
We use same system in Poland and recently a group of people (over 900!) got charged with fraud. They werent the ones selling cards, they were the users, and only stupid ones.
in polish http://niebezpiecznik.pl/post/900-wlascicieli-falszywych-warszawskich-kart-miejskich-bedzie-przesluchanych/ [niebezpiecznik.pl]

Someone also offers Android app that charges cards using phone buildin NFC. You pay with BTC (yes, bitcoins). Its only available over TOR :)
http://zaufanatrzeciastrona.pl/wp-content/uploads/2013/03/screen01.png [zaufanatrzeciastrona.pl]
City has NO technical way of discovering fake cards on the meters, they only stumbled on those cards because City was upgrading older VERY broken Classic cards to never less but still broken model, they did it by offering free exchange program. Some retards tried to turn in FAKE cards :D

evul sourcecode for clonning
https://github.com/ikarus23/MifareClassicTool [github.com]

Re:why? (1)

Rakishi (759894) | about 4 months ago | (#45813375)

Because its expensive to run a lot of data over GSM links in every bus/tram in the city.

You don't need to send a lot of data. Maybe, 1kb for each authentication event? Assuming 2 million authentications per day (a lot) that comes out to 2 gigabytes of data per day. Last I was in Poland I think that cost around 20 zloty ( $10) to get on a prepaid plan. Hell, you can have it send 100 times as much data and you'll still end up paying less than the cost of maintaining the hardware itself.

There's a lot of reasons to not go with a GSM based approach but data cost is not one of them.

Re:why? (1)

radarskiy (2874255) | about 4 months ago | (#45813533)

a) It's not a lot of data per link, but it is a lot of links. That 20 zloty plan is one link. Marta has 554 buses and 38 rail stations.
b) You have supplied no dataon the reliability of that link.
c) Pricing in Poland is not particularly relevant to Altanta, Georgia, USA.

Security (5, Informative)

ledow (319597) | about 4 months ago | (#45812115)

Like everything:

If you can buy the readers, and someone obviously sells the writers somewhere, you can clone them.

As soon as you then rely on these tokens to hold individual data themselves (with no reference to a central database), then they become valued targets for attack.

If you had these cards hold nothing more than a code number, and wired all the readers to talk home, then the system can't be "scammed" as such - people can have their cards cloned, of course, but you can spot it, you can trace them, arrest them at your convenience, and give the original account holder a new card in the meantime as soon as they report the fraud. But because everything has to talk to a central database, the cards are not so much "cash" as a stolen "credit card" - traceable, and stoppable.

Then, it doesn't matter if you do use something as common as MiFare (a school I used to work in used Mifare entry systems - they weren't expensive or hard to get hold of at all and I used to program my Oyster - London Tube travel - card to open the door for me in the morning if I'd forgotten my ID card). As soon as the readers are that commonplace, the writers will be available even if that means people are building their own and making fake "cards" the size of a Raspberry Pi with some RF circuitry to pretend to be a card. The next step is just a matter of shrinking the device.

MiFare is long-cracked. You can buy the cards for pence each and the readers (direct to USB, etc.) for a pittance. The next step up is no harder than going from magstripe readers and cards up to magstripe writers with the correct magstripe "level" to read/write the banking data on an old magstripe credit card.

Don't put "value" into a chip that can be cloned. Put the value into a central, monitored, system, and provide people only with a codenumber to access it. That codenumber can be cloned still, sure, but then you can watch out for it, notice it, blacklist it, catch people red-handed. And they can't go spending "free money" offline from your system.

This is my biggest bugbear with London's Oyster system. It's just a number for the most part, but they try to store "value" on the cards and let you buy newspapers with them. Now you have an offline, valued, unmonitored, commodity on an easy-to-clone chip.

Except you don't have a 100% link to your db (0)

Anonymous Coward | about 4 months ago | (#45812257)

Your somewhat lengthy description misses the key point that these things have to be usable in places where there is no data connection to a centralized database (e.g. on a bus), and so, they MUST contain value which can be locally (with no reference to a central database) validated and decremented.

I suppose you could do what credit card companies do for small transactions ($50).. always allow, but record the transactions, and go back later to reconcile. If someone "overdrew" their account, you could go after them after the fact. But then, you need to have a "tie" between a specific card and a specific person, which raises all sorts of privacy issues.

You also need to be sensitive to the aspect of "acceptable losses". In some cases, it is cheaper to let some fraud happen than it is to implement a more complex, expensive, and failure prone system to grind those losses down to zero. This is something the credit card companies have to a finely researched science. This is the primary reason why chip&pin isn't being used in the US. The fraud losses aren't quite high enough to justify the cost of replacing all the cards and readers.

There have been a number of studies over the years that show that "honor system" fare collection actually works pretty well, with random manual checks by transit police. Yes, there are people who cheat (but then, there are people who hop the turnstiles, too), but *most* people pay their fare. And you save all the costs of fare collection boxes, terminals, readers, etc.

Mind you, the companies who sell such boxes make the claim (not necessarily substantiated by data) that their costs are paid for in increased revenue, and are happy to whip up the political troops about "fraud waste and abuse".

Re:Except you don't have a 100% link to your db (2)

davidwr (791652) | about 4 months ago | (#45812797)

always allow, but record the transactions, and go back later to reconcile.

In other words, treat it like we used to treat credit cards back before instant verification.

Anyone else remember signing a multi-part credit card form and having the clerk run it through the "ker-chunker"?

Re:Except you don't have a 100% link to your db (1)

noh8rz10 (2716597) | about 4 months ago | (#45812855)

There have been a number of studies over the years that show that "honor system" fare collection actually works pretty well, with random manual checks by transit police. Yes, there are people who cheat (but then, there are people who hop the turnstiles, too), but *most* people pay their fare.

It's actually called "proof of payment". You buy a ticket or a pass in the station, and have it available for inspection. if you don't have the ticket, they fine you.

I assure you there's nothing "honor" about it. You're required to have a ticket, and pay a penalty if you don't have one.

Re:Except you don't have a 100% link to your db (0)

Anonymous Coward | about 4 months ago | (#45813495)

Except it's typically cheaper to pay the occasional penalties instead of tickets.

Re:Except you don't have a 100% link to your db (0)

Anonymous Coward | about 4 months ago | (#45815039)

In my jurisdiction, being caught without a ticket is a criminal matter. Like a speeding ticket, you won't get hauled to jail on the first offense, but if you do habitually, you can bet you will have a court date and real charges to deal with.

Re:Security (2)

jonbryce (703250) | about 4 months ago | (#45812461)

Oyster is mostly online. There is an offline backup, because if you use it on a bus, the bus may not have a network signal at your bus stop. If you do manage to hack an Oyster card, it will work for one day, but when the reconciliation is done overnight, your card will be blacklisted and it won't work the following day, even in offline mode.

Re:Security (1)

nogginthenog (582552) | about 4 months ago | (#45812575)

Oyster is far from perfect. The online system tells me "There are no season tickets on this Oyster card". Yet there is a monthly travelcard loaded on it that expires sometime next month (not sure when, thanks TFL!).

Re:Security (2)

ledow (319597) | about 4 months ago | (#45812681)

Not true - it's a lot more "offline" than you think.

That's why you have to nominate a station to "collect" your top-up - basically they preload to that station in the morning and then you card gets an instruction that you have X pounds more on it now. The card knows how much you have and works when the system is out (done it many times). That's how the vendor purchases work too - they rely on the card to have an up-to-date record of how much PAYG credit they have.

But, that said, when it is networked - as pointed out - it all gets noticed quite quickly. This is my point - network and keep online as much as possible and don't rely on the CARD to tell you how much money the user has. Use a number on the card to refer to a central database and take a loss on "system down" times rather than "use can clone any card" times (and then keep things up as much as possible).

Re:Security (1)

Shuntros (1059306) | about 4 months ago | (#45813503)

The main issue is that Oyster does do some level of cleverness. I only ever skimmed the paper so don't recall the details. The main issue in most use cases is that the spec says the token UID should be read-only. When you can buy tokens from China which completely disregard this and let you write sector 0 it's game over immediately for huge swathes of RFID installations which rely on UID alone.

My work ID does door access, printing, loads of stuff. Spoof the UID onto a blank token, remove the chip/antenna, place inside rear cover of watch. Super convenient, but alarmingly easy.

And you know that "tap and go" stuff your credit card has, distinct to the chip & pin functionality, for low-value purchases like a Double Whopper with cheese? Don't even get me started on that...

Re:Security (2)

ledow (319597) | about 4 months ago | (#45813839)

Our Mifare card access system used to read data off of the latest PayWave-type phones. To our systems it was just a random long number but it uses the same frequencies, protocols, etc. as everything else RFID to power itself/send it.

Caused havoc with our systems when people started buying Galaxy S3's and holding them in their hands while they swiped their entry cards. We wondered what the hell was going on for a long time.

Re:Security (1)

thegarbz (1787294) | about 4 months ago | (#45813665)

Don't put "value" into a chip that can be cloned. Put the value into a central, monitored, system, and provide people only with a codenumber to access it. That codenumber can be cloned still, sure, but then you can watch out for it, notice it, blacklist it, catch people red-handed. And they can't go spending "free money" offline from your system.

There's a problem with central database hookups, what happens when the link fails, what's the maintenance cost of a central database and all the links? In Brisbane they've all but given up on manual ticketing systems. I imagine the cost of a handful of people taking free rides is less than the cost of maintaining a central system, and less than the cost of what would happen when the system went down, or any kind of local database gets corrupted.

Yes there's ways around the value on the card problem, but are they really economical?

Re:Security (1)

xelah (176252) | about 4 months ago | (#45814309)

The writers are already commonplace: they're exactly the same as the readers, and an NFC phone can do it. But, you'll need an encryption key to do it (or you'll need to break the authentication or extract the key). These things are not just dumb storage devices, you have to authentication to them to read or write more than the card's unique ID (and you'd have to be a fool to rely just on that to identify a card). The old cards (MiFare Classic cards) are clonable because the encryption was weak. DESFire EV1s, like new Oyster cards, use 3DES or AES.

Another card scam... (3, Interesting)

QuietLagoon (813062) | about 4 months ago | (#45812129)

Police Warn of Gift Card Scam [nbcconnecticut.com]

.
Fare cards, gift cards, credit and debit cards used at Target, etc.,.etc,. etc...

When are we going to make our erzatz money secure?

Re:Another card scam... (0)

Anonymous Coward | about 4 months ago | (#45812701)

Never, because thats the whole point of ersatz money. All these cards are designed to improve convenience and efficiency at the expense of security.

Why do we have paper currency? Coin based currency is obviously more secure and harder to counterfeit.

Re:Another card scam... (1)

phantomfive (622387) | about 4 months ago | (#45812821)

When are we going to make our erzatz money secure?

When it becomes cheaper to pay for security than for damages. Same thing with banking websites.

Any Detail, At All? (0)

Anonymous Coward | about 4 months ago | (#45812149)

So it's a breeze to crack Breeze card encryption? Yuk yuk yuk, you're hilarious.

What about any detail at all about this? What "weak" encryption do they use? How was it broken? What was the value of the fraud? Can these cards be used for anything else, or cashed out, or does this fraud require very extensive MARTA ridership?

Seven people have been charged with fairly serious crimes, but I can't see the value of the fraud being more than a few hundred or few thousand dollars. It's like counterfeiting $1 bills, what's the point?

Re:Any Detail, At All? (4, Informative)

McGruber (1417641) | about 4 months ago | (#45812269)

What about any detail at all about this? What "weak" encryption do they use? How was it broken? What was the value of the fraud? Can these cards be used for anything else, or cashed out, or does this fraud require very extensive MARTA ridership?

Seven people have been charged with fairly serious crimes, but I can't see the value of the fraud being more than a few hundred or few thousand dollars. It's like counterfeiting $1 bills, what's the point?

It appears that MARTA is just discovering the extend of the fraud, based upon the information in this article by the NBC affiliate in Atlanta: Atlanta Channel 11 TV News: 7 arrested for MARTA Breeze Card fraudl [11alive.com]

Some detail:

MARTA says the thieves spent $1 to buy the Breeze card, then reprogrammed the data on it to turn it into a 30-day pass. They then sold it to riders for $40, a deep discount of the real price of $96. That meant the thieves got to pocket $39, and the buyers got a cheap ride.

and

MARTA police chief Wanda Dunham says the cards were sold at MARTA stations and on Craigslist. But it was a suspicious buyer who purchased one at an area mall that contacted police. "He knew that wasn't the right fare so he called us, asked us to check into it," said Dunham.

As they investigated, the agency's Revenue Department noticed in November, a large number of cards were sold at its Chamblee and Lenox stations for only a dollar. Police started reviewing surveillance video to create a list of suspects.

MARTA won't say how many counterfeit cards the group sold, but says during the arrests it confiscated 400 fraudulent cards. Had the thieves sold them, their $400 initial investment, would have earned them $16,000.

MARTA says it's never had something like this happen before, but security expert Gregory Evans says MARTA needs to act fast, if wants to keep it from happening again. He says the hackers likely got away with their scheme using a simple card writer that costs just a few hundred dollars. "The crazy part, the scary part about this? MARTA would have never known if some had not gone back and told them what was happening. That's it," said Evans. Evans says the data on the card could be encrypted and an alert built into their software system. "If I go to use this card somewhere and all the sudden there's $100 on this card, their system should have caught that and said hold up," Evans said.

MAX-VALUE and EXP DATE hardcoding (1)

davidwr (791652) | about 4 months ago | (#45812813)

And this is why stored-value cards should have MAX_VALUE and EXPIRATION_DATE hard-coded into them.

Re:MAX-VALUE and EXP DATE hardcoding (1)

Anonymous Coward | about 4 months ago | (#45815893)

That doesn't help anything. Blank cards cost $1. You are supposed to add fares to them. The cards need to hold up to at least a 30 day pass. Max value would be a 30 day pass. That's what they were selling. They weren't selling $1000 credit or anything. Just a 30 day pass. Expiration dates are several years in the future. People want to keep their card and reload it as often as necessary. You would have to keep buying new fake cards every 30 days, to maintain the discount, so the expiration date is also irrelevant.

Re:Any Detail, At All? (0)

Anonymous Coward | about 4 months ago | (#45812955)

Stupid greedy hacker.

If an individual did this on his own, just to get free transit rides for himself, he probably would never have gotten caught. Try to sell the scam to everyone though, and obviously he will be detected.

Greed gets the stupid criminals into trouble. Maybe not every time, but damn well often enough.

Re: Any Detail, At All? (0)

Anonymous Coward | about 4 months ago | (#45815685)

MARTA says it's never had something like this happen before.

How would they know?

Re:Any Detail, At All? (2)

noh8rz10 (2716597) | about 4 months ago | (#45812877)

Seven people have been charged with fairly serious crimes, but I can't see the value of the fraud being more than a few hundred or few thousand dollars. It's like counterfeiting $1 bills, what's the point?

I spent $3,000 on Metrolink tickets last year in Los Angeles. I know many people who pay more. there is serious money in mass transit.

re MARTA (1)

Anonymous Coward | about 4 months ago | (#45812183)

Like most of the other government run entities in Atlanta, Marta is run by inept management and awards bids to cronies and
relatives. I am not surprised the system was outdated and ineffective.

Does it really need to be secure? (2)

JoeyRox (2711699) | about 4 months ago | (#45812267)

Naturally if they're going to spend the money on a secure system it might as well fulfill that goal. But do these metro metering devices really need to be all that secure? I checked MARTA's fare schedule and their most expensive ticket is $5 round-trip. Doesn't seem like enough incentive for the average joe to cheat it, esp. when you consider how transit authorities use a few high-profile prosecutions to discourage people from even buying second-hand tickets let alone hacking their own. In my view the system only need be marginally more secure than the honor system.

Re:Does it really need to be secure? (2)

BringsApples (3418089) | about 4 months ago | (#45812391)

In my view the system only need be marginally more secure than the honor system.

I couldn't agree more. And since there is an extreme lack of honor these days, I feel that the next step, rather than spend so much money to secure the transaction(s), is to simply utilize credit/debit cards. If that doesn't work, fuck it, shut the MARTA down; "Sorry folks, the people in this area are to wicked to have nice things."

Re:Does it really need to be secure? (0)

Anonymous Coward | about 4 months ago | (#45812471)

It is not the single trip, it is the monthly fee. A lot of city people buy a monthly pass which could be several hundred $$ a mo. If they can get a fake one for $50 or $0 then they are saving all that money for other things.

Re:Does it really need to be secure? (2)

Pembers (250842) | about 4 months ago | (#45812519)

Apparently they also do passes that are good for 30 days, which cost $96 (see the comment a few places above). The scam was to buy lots of $1 tickets and reprogram them into 30-day ones.

Re:Does it really need to be secure? (0)

booyabazooka (833351) | about 4 months ago | (#45814181)

Marta sucks. If you're using Atlanta's public transit, it's probably because you can't afford a car. To a minimum-wage earner, it's not hard to imagine that $5 a day is worth cheating.

Re:Does it really need to be secure? (0)

Anonymous Coward | about 4 months ago | (#45814761)

I take MARTA frequently and make north of $130k. But ok.

Re:Does it really need to be secure? (1)

Anonymous Coward | about 4 months ago | (#45815949)

They were saving $56 every 30 days buying counterfeit cards. Less than $2 per day. Where did you get $5 from? Lots of people who ride MARTA have cars. You not only save on gas and save on parking, you also don't have to deal with the traffic. Additional benefits, you can read or whatever on MARTA, not while driving. Additional benefit, you can be drunk on MARTA. You can go to happy hour after work, no worries. Additional benefits, less pollution and less dependent on foreign oil. MARTA is pretty good especially for getting to the airport. How do you get to the airport?

Quick question (5, Interesting)

Okian Warrior (537106) | about 4 months ago | (#45812935)

Out of curiosity, how much revenue comes in from fares, and how much expense goes out in fare maintenance?

A lot of metro systems charge fares in addition to getting public support from taxes. Has anyone thought to tally the costs of the fare system compared to the income? Things like cost of the machines, maintenance of the machines, maintenance of the turnstiles, accounting, law enforcement &c... all these things add up.

Even if the fares bring in revenue, it's probably minor. Most of the cost goes into collecting the fares, so most of that value is wasted.
The economy would get a boost if that money were freed up to be spent by consumers, and doing so would help the people who need it the most (ie - poor people).

This whole thing seems like a fabricated problem - a system that forces people to spend money just for the sake of spending it. Then spend more money reimplementing the system when the original system is found to have flaws, then spend countless hours and resources in enforcement and prosecution.

Just get rid of it. Let the money go into the economy.

Re:Quick question (0)

Anonymous Coward | about 4 months ago | (#45813091)

Out of curiosity, how much revenue comes in from fares, and how much expense goes out in fare maintenance?

A lot of metro systems charge fares in addition to getting public support from taxes. Has anyone thought to tally the costs of the fare system compared to the income? Things like cost of the machines, maintenance of the machines, maintenance of the turnstiles, accounting, law enforcement &c... all these things add up.

Even if the fares bring in revenue, it's probably minor. Most of the cost goes into collecting the fares, so most of that value is wasted.
The economy would get a boost if that money were freed up to be spent by consumers, and doing so would help the people who need it the most (ie - poor people).

This whole thing seems like a fabricated problem - a system that forces people to spend money just for the sake of spending it. Then spend more money reimplementing the system when the original system is found to have flaws, then spend countless hours and resources in enforcement and prosecution.

Just get rid of it. Let the money go into the economy.

You mean like how years ago some wise-acre calculated that it was cheaper to buy everyone in Washington DC a new compact car every three years than it was to fund METRO?

Re:Quick question (1)

radarskiy (2874255) | about 4 months ago | (#45813587)

While I am receptive to the concept that sometimes it is not worth it to collect the money (that why transit systems are moving to face cards, so that they don't have to handle change), fares also provide some demand management. Even if you are not applying demand-based fares, charging a non-zero amount the far end of the demand curve which would happily fill and overflow all capacity and will let you find when/where you really need to add new capacity.

Re:Quick question (1)

Okian Warrior (537106) | about 4 months ago | (#45813763)

While I am receptive to the concept that sometimes it is not worth it to collect the money (that why transit systems are moving to face cards, so that they don't have to handle change), fares also provide some demand management. Even if you are not applying demand-based fares, charging a non-zero amount the far end of the demand curve which would happily fill and overflow all capacity and will let you find when/where you really need to add new capacity.

Wow. Elliptical much?

Put it in terms of value. Does demand management have any value? Could demand be managed by another method, such as historical prediction, or simply by having people press a button to "call" trains to stations?

You can't make a case for options unless the value (or utility) of each option is known. Just referring to an amorphous ill-defined term "demand management" doesn't cut it.

Does demand management have any value? And if it does, is demand management by fares the best way?

Re:Quick question (2)

swb (14022) | about 4 months ago | (#45813733)

That's a great question. From what I've read about the Minneapolis light rail system, fares cover about a third of the operating cost. I'm not sure what the fare collection costs are (machines, enforcement, etc) but its hard to see them being more than 10% of the fare revenue, especially when you consider that a lot of the collection costs are upfront (buying, installing machines, etc) and basically one-time costs.

You do wonder what would happen if they just made riding it free. It might mean more ridership which would enhance some of the secondary economic value of the system which seems to be a major selling point (reduced traffic, development on the line, etc).

Re:Quick question (1)

Okian Warrior (537106) | about 4 months ago | (#45813951)

I'm not sure what the fare collection costs are (machines, enforcement, etc) but its hard to see them being more than 10% of the fare revenue, especially when you consider that a lot of the collection costs are upfront (buying, installing machines, etc) and basically one-time costs.

I can't find a detailed budget for Minneapolis, but fare costs for other cities are always over 85% (for cities I've looked at to date) and can be higher than 100% in some cases. BTW, fares account for only 15% of the Minneapolis light rail revenue (source [patch.com]).

There are a lot of hidden costs, such as personnel to collect the coins/tokens/strips, empty and reload the machines, personnel to do maintenance, and such. Personnel are very expensive to maintain - did you include the pensions?

I don't know what the expenses are either, but I'm sure it's over 85%.

Factor in the invisible savings (decreased traffic, higher local economy through increased usage, decreased pollution, less need for other infrastructure such as parking) and it looks like a clear win.

Re:Quick question (2)

bsa3 (200) | about 4 months ago | (#45814413)

There are indeed reasonable number of fare-free systems. But you neglect the core purpose of public transit as it is seen by most US governments—i.e. distributing cash. Even if a system has 10% farebox recovery, they still get to buy the equipment and employ people to collect the money. Sure, they could go to proof-of-payment (or drop fares entirely), and further reduce costs by putting the Buy America Act and Davis-Bacon out of their misery, but that would reduce the opportunity for graft.

not public works, political cover (0)

Anonymous Coward | about 4 months ago | (#45815045)

It's not to distribute cash.. It's to provide political cover to respond to TEA types... Gol durnit, I demand that the illegal alien riding the subway pay a fare and not suck off my 'murican taxes. I think highly of our soldiers (but haven't actually served) and we need to protect murica against freeloaders. Gol durned socialists and communists.. Keep your effen hands off my Medicare and Social Security.

Re:Quick question (0)

Anonymous Coward | about 4 months ago | (#45814773)

MARTA receives zero public funding, so everything it does depends on the revenue from fares.

3 questions (1)

jonwil (467024) | about 4 months ago | (#45813645)

1.Why are these things so weak and easily broken
2.Why don't the companies that make them invest a bit more money in making them harder to break (instead of on lawyers to sue people who break them)
and 3.If the companies that make them wont fix them, why isn't someone else offering systems with stronger encryption?

Re:3 questions (1)

Velex (120469) | about 4 months ago | (#45814549)

I'd really like to know the answer to #3.

Off the top of my head, I don't understand why they don't have a private key known only to the bus/station equipment that does the reading/writing of the amount on the card and some kind of incrementing or rotating ID to prevent replay attacks/card cloning? Each bus could have an ID and a counter, then each morning distribute to a system on each bus the bus/counter combinations that have already been used maybe say in the past 3 or so months depending on how much data that would be and how much storage would be available on the bus. Make sure to design in some key rotation of the private key as well. Sure, it's not perfect and probably has attack vectors I'd need a second set of eyes to catch, but it's better than this and doesn't require any wireless anything except maybe at the station (or a USB thumb drive would work just fine to get the lists to the busses in the morning). Why isn't there a market for a more secure system?

Is there really something about a solution along those lines that would cost an order of magnitude more than the existing equipment or at least more than these flawed systems cost bus operators both in lost revenue and paying the lawyers?

BUT, I guess implementing a system that would require some serious effort on the part of a criminal to circumvent doesn't play as easily into the American narrative of poor folks and their lack of virtue and lives of petty crime. I also don't have any family in government or backroom connections that would get me the contract, either. Maybe that's sadly the answer to #3.

That leads us to an answer to #2 and sort of to #1 as well: it's more satisfying to Americans to create a flawed system and catch people in the act of exploiting that system than it is to just implement a system that's too difficult to circumvent.

MARTA (-1)

Anonymous Coward | about 4 months ago | (#45813905)

Moving Africans Rapidly Through Atlanta.

Can't resist.

NYC born, recently moved to Atlanta (2)

Deemus (115875) | about 4 months ago | (#45814023)

MARTA - Moving Africans Rapidly Through Atlanta (or so the locals call the system).

It's probably wrong to, but I applaud the hackers. It's really only the poor folks in Atlanta that use the system (everyone else drives) and every little bit they can save helps.

Re:NYC born, recently moved to Atlanta (1)

BenoitRen (998927) | about 4 months ago | (#45814785)

I find the abbreviation, MARTA, cute. Reminds me of a certain video game character.

Re:NYC born, recently moved to Atlanta (0)

Anonymous Coward | about 4 months ago | (#45815619)

Hmmm. I've lived in Atlanta for well over a decade and never heard it called that. I guess it shows the type of people you hang out with.

Also, I use MARTA daily and seem to be making six figures. The only non-random times MARTA is downright unpleasant is after the Peachtree road race when hundreds of sweaty smelly joggers are riding or before/after Braves/Falcons games.

The Breeze system sucks. The old token and monthly pass system was much more reliable and convenient.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...