[HN Gopher] Teens Hacked Boston Subway for Infinite Free Rides-a...
       ___________________________________________________________________
        
       Teens Hacked Boston Subway for Infinite Free Rides-and This Time
       Nobody Got Sued
        
       Author : kjhughes
       Score  : 29 points
       Date   : 2023-08-11 17:54 UTC (5 hours ago)
        
 (HTM) web link (www.wired.com)
 (TXT) w3m dump (www.wired.com)
        
       | liminalsunset wrote:
       | Years and years ago the RFID cards that Cubic Transportation
       | Systems uses in my city were vulnerable to a similar kind of
       | attack involving the disposable RFID tickets issued to users who
       | bought a single fare instead of using the persistent cards. IIRC,
       | it ended up being fixed by setting the write protect bit on the
       | chips in the tickets, which supposedly had not been set. This
       | would have worked because the tickets were one-time use and not
       | disposable.
       | 
       | Similarly, it has been demonstrated that the iClass DY cards they
       | use in many universities for student cards (access, food billing)
       | are easily cloned.
       | 
       | It seems like most of the RFID card systems in widespread use
       | tend to be vulnerable to various attacks. Part of this is because
       | these systems are complicated and often run by large
       | organizations for which improvement would involve replacement of
       | entire fleets of cards and card readers, and would have to be a
       | large project in coordination with the vendor.
       | 
       | Perhaps the security vulnerabilities aren't actually so bad after
       | all though; in this case, provided the attack does not become
       | widely distributed, the percentage of users who take advantage of
       | it is probably small, and the loss proportionally small.
       | 
       | In the real world, the impact of scary sounding security
       | vulnerabilities is slightly softened by the scale at which
       | attacks occur and the value of the protected assets.
        
         | jstarfish wrote:
         | I used to work in an arcade that migrated from coins to mag-
         | stripe cards. Since it's scummy to be left with 0.4 points on a
         | series of cards when games cost 1.1-5.9 points per play, the
         | POS system facilitated a transfer of points across cards.
         | 
         | The workflow for it was predictable-- hit transfer, insert and
         | remove source card, insert and remove target card, confirm
         | transfer.
         | 
         | I never saw the code, but surmise the logic was implemented as:
         | inserting the first card calculated what the end balance should
         | be post-deduction (n=c1_points; c1_points=0). Inserting the
         | second card calculated what the end balance of _that_ card
         | should be post-transfer (c2_points=c2_points+n). Hitting
         | confirm executed the transaction and updated the point balance
         | on both cards.
         | 
         | Now, what happens when you insert the same card for the first
         | and second pass? An enterprising employee thought to ask, and
         | ran a lucrative side business selling cloned cards with
         | thousands of dollars of points for $100 a pop. (IIRC, he got
         | caught when one of his customers had a problem with their card
         | and asked a legit employee for help. The high balance invited
         | scrutiny.)
        
         | LorenPechtel wrote:
         | Yeah, so long as it's not splashed across the news the loss due
         | to hacking is probably less than the cost of defending against
         | it. In pretty much any system the cost of driving malicious
         | behavior to zero is higher than the cost of accepting that
         | there will be some malicious behavior.
        
       ___________________________________________________________________
       (page generated 2023-08-11 23:02 UTC)