Not fare: Hacker app resets subway card for free rides (w/ Video)

Sep 23, 2012 by Nancy Owano report
Credit: Wikipedia

(Phys.org)—You have to love the ease and convenience of NFC technology in smartphones. Unless you run a mass transit system in a major city that moves millions of people in and out of trains, morning noon and night, then love alone is not enough. As fares form a crucial part of transit system revenue to keep everything running, system administrators would need to take note of what security hackers accomplished—an app that takes advantage of a weakness in NFC-based subway cards that lets users ride on trains for free. The two researchers, Corey Benninger and Max Sobell, from the Intrepidus Group, figured out a way that replenishes a fare-card balance.

They tested the app's success on two transit systems, New Jersey Path and San Francisco Muni trains. Benninger and Sobell said that other systems might be vulnerable to such an , in the form of an Android application that could make it possible for holders of a card to get free rides in Boston, Seattle, , Chicago, and Philadelphia. Those other systems were not tested by the researchers,

Their discovery was announced at the EUSecWest security conference in Amsterdam, where they told those attending that if they ever thought smartphone tricks could get them rides, then they would be correct. "A number of cities are rolling out RFID/ enabled access control as they move away from magstripe cards. This comes at a time when smartphones are also being enabled with NFC capabilities," they said.

This video is not supported by your browser at this time.

They also said it was unfortunate that mass transit systems in the cities that could be vulnerable did not appear to understand how the security around the systems needs to be implemented—it is not a matter of bad technology but of proper implementation. Both of these systems tested, they said, were not using the of these cards correctly, allowing the two researchers to re-set the cards' data.

The researchers wrote software for mobile phones to accomplish the free-ride exploit without difficulty. When a traveler exhausts the ride-remaining balance, the app can reset the balance to 10 rides remaining, not zero rides. They call their hack app UltraReset. They loaded up UltraReset on their smartphone and wrote data back to a card without the associated payment being required. They said anyone with know-how to rewrite data to the NFC chip can do this.

Benninger said that he coded the app in one night, and, he added, he is not a coder. The app works on Android 2.3 or later. Their demo shows the UltraReset app running on a Nexus S . "I can do that over and over again if I chose to," said Benninger.

Contactless payment technology supports the exploit. The train tickets have NFC chips built into them, and the hack exploits the Mifare Ultralight chip used in disposable contactless NFC cards. The chip makes the card work like a punch card system, but the card can flip bits on to indicate that a travel unit has been used. In the vulnerable systems, user information on the card is checked but the bits are never turned on. This allowed the two exploiters to rewrite the cards. The bits are supposed to block anyone from reverting the card to its original state, but it would only serve as a security feature if the authorities in charge were to turn that feature on.

The researchers hope that their discovery will eventually allow vulnerable transit companies to work out their card security implementation or adjust their back-end systems to make sure bits in the cards are turned on when travel units are used. San Francisco and New Jersey authorities were informed about this problem, they said, but as far as they know, both systems are still vulnerable, they added. San Francisco was informed in December 2011.

Explore further: Security CTO to detail Android Fake ID flaw at Black Hat

Related Stories

Recommended for you

Body by smartphone

10 hours ago

We love our smartphones. Since they marched out of the corporate world and into the hands of consumers about 10 years ago, we've relied more and more on our iPhone and Android devices to organize our schedules, ...

Breakthrough elastic cloud-to cloud networking

12 hours ago

Scientists from AT&T, IBM and Applied Communication Sciences (ACS) announced a proof-of-concept technology that reduces set up times for cloud-to-cloud connectivity from days to seconds. This advance is a major step forward ...

Security CTO to detail Android Fake ID flaw at Black Hat

Jul 29, 2014

Where have you heard this before: A team of security researchers discover a security flaw in Android devices. This is, however, news. This time, experts are talking about a flaw that involves a widespread ...

Software provides a clear overview in long documents

Jul 25, 2014

In the future, a software will help users better analyze long texts such as the documents for calls for bids, which are often more than one thousand pages long. Experts at Siemens' global research unit Corporate ...

User comments : 6

Adjust slider to filter visible comments by rank

Display comments: newest first

kochevnik
Sep 23, 2012
This comment has been removed by a moderator.
Bowler_4007
3 / 5 (2) Sep 23, 2012
if the cards are fixed could someone not then use the phone to spoof a card, if that could be done it could generate a lot of problems, someone might try generating random cards till one works, but if the system is ever changed so that the rides left on a card are not stored on the card then the hackers could end up generating someone elses card and using their journeys
zz6549
5 / 5 (1) Sep 23, 2012
It's possible, but if they implement it properly it would be incredibly hard to do. Just like trying to spoof someone's username and password on gmail. If you generated random username password combinations it could take millions (or billions, depending how you generate them) of attempts to create valid credentials.

Of course, given that this system was so easy to crack, I've concluded it was designed and implemented by monkeys. If the same talented monkeys were to implement the system so that the data was stored outside the card, they'd probably use a sequential value to uniquely identify cards. So cards would have numbers like 1, 2, 3, ...., 1292, 1293, 1294.. and so on. And of course they'd be unencrypted and easily changed.
baudrunner
4 / 5 (4) Sep 23, 2012
I swear, Humans are their own worst enemy. They invent things like The Internet, E-Mail, The Cloud, Near Field Communications etc. - all ripe for the plucking and exploitation by some bored hackers who for the most part are not actually criminal types. Yet another Can of Worms perpetrated upon Humanity by itself.

This reminds me of the hackers (from Stephen Levy's book: Hackers)who back in the seventies used a DEC PDP-11 and an early telephone modem to reprogram the New York City Transit scheduling information system - for the better, I might add. And this, after rewiring the PDP-11 to fix hardware bugs! I say we go real easy on perpetrators of these types of "crimes", because they are the spice that make this life worth living.
Argiod
3 / 5 (4) Sep 24, 2012
Anyone who says there's no such thing as a free lunch; never met a determined hacker.
alfie_null
not rated yet Sep 24, 2012
Even if the bits were turned on, I wonder how hard it would be to spoof? Like it or not, the best way to prevent fraud is to store the information off the card and only keep some sort of hard-to-guess credential on the card.

Alternatively, I suppose you could encrypt the information, but someone will probably eventually figure out the key, so you should plan to regularly change the keys issued with new cards.
JGHunter
not rated yet Sep 24, 2012
If the data was stored off the card, then the scan to access it could be sensitive to an artificial material manufactured for the card - that way fake cards would be impossible to make without knowing the composition of said material in the ID and being able to recreate it. If this scan was the only way of accessing the card, then amateur hackers would be unable to access it. Only gates would.