Not fare: Hacker app resets subway card for free rides (w/ Video)

September 23, 2012 by Nancy Owano, report
Credit: Wikipedia

(—You have to love the ease and convenience of NFC technology in smartphones. Unless you run a mass transit system in a major city that moves millions of people in and out of trains, morning noon and night, then love alone is not enough. As fares form a crucial part of transit system revenue to keep everything running, system administrators would need to take note of what security hackers accomplished—an app that takes advantage of a weakness in NFC-based subway cards that lets users ride on trains for free. The two researchers, Corey Benninger and Max Sobell, from the Intrepidus Group, figured out a way that replenishes a fare-card balance.

They tested the app's success on two transit systems, New Jersey Path and San Francisco Muni trains. Benninger and Sobell said that other systems might be vulnerable to such an , in the form of an Android application that could make it possible for holders of a card to get free rides in Boston, Seattle, , Chicago, and Philadelphia. Those other systems were not tested by the researchers,

Their discovery was announced at the EUSecWest security conference in Amsterdam, where they told those attending that if they ever thought smartphone tricks could get them rides, then they would be correct. "A number of cities are rolling out RFID/ enabled access control as they move away from magstripe cards. This comes at a time when smartphones are also being enabled with NFC capabilities," they said.

They also said it was unfortunate that mass transit systems in the cities that could be vulnerable did not appear to understand how the security around the systems needs to be implemented—it is not a matter of bad technology but of proper implementation. Both of these systems tested, they said, were not using the of these cards correctly, allowing the two researchers to re-set the cards' data.

The researchers wrote software for mobile phones to accomplish the free-ride exploit without difficulty. When a traveler exhausts the ride-remaining balance, the app can reset the balance to 10 rides remaining, not zero rides. They call their hack app UltraReset. They loaded up UltraReset on their smartphone and wrote data back to a card without the associated payment being required. They said anyone with know-how to rewrite data to the NFC chip can do this.

Benninger said that he coded the app in one night, and, he added, he is not a coder. The app works on Android 2.3 or later. Their demo shows the UltraReset app running on a Nexus S . "I can do that over and over again if I chose to," said Benninger.

Contactless payment technology supports the exploit. The train tickets have NFC chips built into them, and the hack exploits the Mifare Ultralight chip used in disposable contactless NFC cards. The chip makes the card work like a punch card system, but the card can flip bits on to indicate that a travel unit has been used. In the vulnerable systems, user information on the card is checked but the bits are never turned on. This allowed the two exploiters to rewrite the cards. The bits are supposed to block anyone from reverting the card to its original state, but it would only serve as a security feature if the authorities in charge were to turn that feature on.

The researchers hope that their discovery will eventually allow vulnerable transit companies to work out their card security implementation or adjust their back-end systems to make sure bits in the cards are turned on when travel units are used. San Francisco and New Jersey authorities were informed about this problem, they said, but as far as they know, both systems are still vulnerable, they added. San Francisco was informed in December 2011.

Explore further: No more virtual pickpocketing of credit cards, thanks to new tap and pay technology

Related Stories

Samsung rolls out NFC phone sticker innovation (w/ Video)

June 14, 2012

( -- Samsung has announced its introduction of stickers with embedded NFC chips, to be sold by major carriers in packs, so that NFC-enabled Samsung smartphones, with a tap against the sticker, can carry out tasks. ...

BlackBerry to use key technology by Assa Abloy

November 8, 2011

Assa Abloy AB, the world's leading lock group, said Tuesday it is collaborating with Research in Motion to include key-card technology in upcoming BlackBerry models.

Recommended for you

AI and 5G in focus at top mobile fair

February 24, 2018

Phone makers will seek to entice new buyers with better cameras and bigger screens at the world's biggest mobile fair starting Monday in Spain after a year of flat smartphone sales.

Google Assistant adds more languages in global push

February 23, 2018

Google said Friday its digital assistant software would be available in more than 30 languages by the end of the years as it steps up its artificial intelligence efforts against Amazon and others.


Adjust slider to filter visible comments by rank

Display comments: newest first

Sep 23, 2012
This comment has been removed by a moderator.
3 / 5 (2) Sep 23, 2012
if the cards are fixed could someone not then use the phone to spoof a card, if that could be done it could generate a lot of problems, someone might try generating random cards till one works, but if the system is ever changed so that the rides left on a card are not stored on the card then the hackers could end up generating someone elses card and using their journeys
5 / 5 (1) Sep 23, 2012
It's possible, but if they implement it properly it would be incredibly hard to do. Just like trying to spoof someone's username and password on gmail. If you generated random username password combinations it could take millions (or billions, depending how you generate them) of attempts to create valid credentials.

Of course, given that this system was so easy to crack, I've concluded it was designed and implemented by monkeys. If the same talented monkeys were to implement the system so that the data was stored outside the card, they'd probably use a sequential value to uniquely identify cards. So cards would have numbers like 1, 2, 3, ...., 1292, 1293, 1294.. and so on. And of course they'd be unencrypted and easily changed.
4 / 5 (4) Sep 23, 2012
I swear, Humans are their own worst enemy. They invent things like The Internet, E-Mail, The Cloud, Near Field Communications etc. - all ripe for the plucking and exploitation by some bored hackers who for the most part are not actually criminal types. Yet another Can of Worms perpetrated upon Humanity by itself.

This reminds me of the hackers (from Stephen Levy's book: Hackers)who back in the seventies used a DEC PDP-11 and an early telephone modem to reprogram the New York City Transit scheduling information system - for the better, I might add. And this, after rewiring the PDP-11 to fix hardware bugs! I say we go real easy on perpetrators of these types of "crimes", because they are the spice that make this life worth living.
3 / 5 (4) Sep 24, 2012
Anyone who says there's no such thing as a free lunch; never met a determined hacker.
not rated yet Sep 24, 2012
Even if the bits were turned on, I wonder how hard it would be to spoof? Like it or not, the best way to prevent fraud is to store the information off the card and only keep some sort of hard-to-guess credential on the card.

Alternatively, I suppose you could encrypt the information, but someone will probably eventually figure out the key, so you should plan to regularly change the keys issued with new cards.
not rated yet Sep 24, 2012
If the data was stored off the card, then the scan to access it could be sensitive to an artificial material manufactured for the card - that way fake cards would be impossible to make without knowing the composition of said material in the ID and being able to recreate it. If this scan was the only way of accessing the card, then amateur hackers would be unable to access it. Only gates would.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.