Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

codebutler.com

Post reply on HN
Print view View original

11–18 of 18 posts

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#11

Post by megaframe »

davidmathers wrote: post #8
megaframe wrote: post #7

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than…

How is it a security problem? The article doesn't say anything about a security problem. On the contrary it says the security of some older fare cards has been compromised possibly allowing someone to alter their balance, though I am unaware of any attacks against DESFire.

I don't believe card in SF carry the balance information I thought that was on their side, issue is if people duplicate cards then they could share unlimited month passes.

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#13

Post by dfghjkfgh »

megaframe wrote: post #10
phlux wrote: post #9

Earlier quoted context omitted.

Assuming NFC works the same way Lockheeds RFID system works - you havea tag ID which is read against a back-end DB which holds the tags value, where the tag/card holds no value data itself, how can this work with SF Transit police checking cards? Assume you dupe your friends card, then both go through the turn style -- wont the system error as the system will say that the second read is either "tagged for exit" or ma…

It's tag only so if you tag again because lets say you were unsure you tagged, the second tag is disregarded, it's the same idea if I ride a bus but have to transfer I tag again but I don't pay again. It's just to verify I've tagged once since getting on. Can't say I've ever seen transit police but could be the buses I ride, and their's a fine for not being able to show you paid, but buses and muni is just tag as you…

Usually the reader has a local log of the last few cards read. If it detects the same card again within a certain time window it assumes it either read it twice - or two people are sharing a card - and ignores the second read

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#14

Post by gcb »

megaframe wrote: post #7

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than…

because limiting that misdemeanor to people that bought from dealextreme.com a $20 RFID duplicator kit instead of a $500 phone makes the world so much more secure.

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#15

Post by eik3_de »

If you're interested in reverse engineering RFID payment systems in public transfer, I can recommend you this talk from 27c3: https://events.ccc.de/congress/2010/Fahrplan/events/4036.en.... Video: http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/27c3-4036-en-r...

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#17

Post by onlydnaq »

pirko wrote: post #16

Tried with my transit card from SL (Stockholm Public Transport). Got "Unsupported card type: Mifare4k". I'm going to look into it more tonight.

You can find a presentation about the cards used by SL from last years SEC-T conference here http://www.sec-t.org/2010/presentation-videos.html

The name of the presentation is Hacking the RKF ticket system, it can be found at the bottom of the page.

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#18

Post by furyg3 »

megaframe wrote: post #7

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than…

Honestly, this is a problem for a) The transit authority which implemented a broken system and b) the person who gets caught counterfeiting a card / riding for free.

It doesn't take much of a security expert to warn you that the system is insecure when you're implementing something which trusts the card (not a central database), and the protocol is proprietary and uses weak encryption (mifare is 48-bit or so?).

Implementing a system which trusts the card is just asking for trouble, certainly considering the amount of horepower your average commuters are carying around in their pockets nowadays.

Post reply on HN