Hack your local subway
by Grant Martin / August 13, 2008
Frequent travelers on any metropolitan subway system know that the two major means for fare tracking and billing are via magnetic strip and Radio Frequency Identification (RFID). And every nerd and his RPG character know that those systems can be both readable and exploitable.
To see how secure the Boston subway system was, several MIT students decided to run an analysis on the security of the infrastructure; what they found was a little disturbing. By simply wandering into unlocked doors, opening unlocked cabinets and peering around they were able to find keys to the system, get access to network hardware and find and copy employee identification.
On looking into the security of the magnetic and RFID systems, they were able to reverse engineer the code on the magnetic stripes and reconfigure the data to post $653 to a subway card. Similarly, the group analyzed the RFID contents and were able to disassemble the code.
The students point out that numerous transportation systems around the globe use these systems and technology.
Naturally, all of this quite illegal — the students were just illustrating a point to the MBTA that there are security vulnerabilities in the system that can fairly easily be exploited. Hopefully, they and the company that makes subway infrastructures perks up and makes some serious security changes as a result of this reserach.
Check out the full 87 page presentation on the execution hosted at MIT.
Source / Gadling
