NFC glitch allows free commutes for life in NY subway

Security researchers in the US have discovered security holes that can allow commuters paying with NFC-enabled Android devices to have unlimited free rides on public transport.

Matteo Collura, 18, and Matteo Beccaro, 19, presented their findings before the hacking conference DefCon last weekend, tech site Mashable reported.

"You can get free rides for your life," Beccaro said at the hacking conference Saturday.

The report said the security holes allow attackers to time-stamp tickets with an NFC-enabled Android phone and turn a limited-ride ticket into an unlimited one.

Collura and Beccaro, who studied ticket security after Turin started using NFC-enabled cards in January, added the hacks are fairly easy to reproduce.

Becarro also noted they learned how the chips worked via advertisements on websites.

The two stamped several tickets and used a NFC reader costing less than $50 to see what happened inside the chip - whose data was not encrypted.

Both saw part of the ticket that allowed them to turn the OTP sector in read-only mode, meaning the data can't be modified.

This means the stamping machine can no longer change anything on it.

"After you lock the OTP sector, you do not have to do anything else to the ticket, ever. So, do it once and you get an unlimited-rides ticket," Beccaro told Mashable.

Also, Collura and Beccaro noticed the timestamp, which is used to determine whether the ticket must be stamped again, was stored in a part of the chip set in read and write mode, meaning anyone could read and write to it.

This meant that even after the 90-minute time frame for the ticket, one simply needed to scan the ticket with an NFC-enabled device and change the date.

"It's like stamping the ticket by yourself," he said.

The two offered a firmware update on the stamping machines so they would refuse to validate a locked ticket.

Mashable said the two also notified Turin's transportation agency, which said they fixed the first bug on streetcars and the buses — but not yet on the subway. — TJD, GMA News

Loading...

Editor’s note:Yahoo Philippines encourages responsible comments that add dimension to the discussion. No bashing or hate speech, please. You can express your opinion without slamming others or making derogatory remarks.

  • ‘Next leader must not be newbie’
    ‘Next leader must not be newbie’

    Vice President Jejomar Binay believes the next president of the Philippines must have vast experience and a long track record in governance and in dealing with crises. “I am very much convinced that the local government is the best training ground for those who want to run for national government positions,” he said. Binay said he is determined to run for president in 2016 on the strength of his competence and track record. …

  • Massacre suspect tests negative for poisoning
    Massacre suspect tests negative for poisoning

    A suspect in the Maguindanao massacre case who had been examined at the Philippine General Hospital (PGH) tested negative for poisoning, medical records released yesterday showed. However, the Quezon City court handling the multiple murder case resolved to isolate Police Officer 1 Pia Kamidon from the rest of the accused detained at Camp Bagong Diwa in Taguig for his safety. In a two-page order, Regional Trial Court Branch 221 assisting Judge Genie Gapas-Agbada ordered jail officials to …

  • ‘Homework first before Facebook’
    ‘Homework first before Facebook’

    President Aquino elicited laughter from students here as he reminded them to open books first before Facebook. “Finish your assignments first before making a raid in the Clash of Clans,” Aquino said, referring to a popular online game. In a speech during the turnover yesterday of two new three-story buildings at the Tarlac National High School, he said the government could only provide opportunities for learning but the rest of the work would be up to the students. The new school buildings …

  • Espina resignation confirmed; Noy looks for replacement
    Espina resignation confirmed; Noy looks for replacement

    President Aquino ended speculations yesterday and confirmed that Deputy Director General Leonardo Espina had indeed resigned as officer-in-charge of the Philippine National Police. As of this time, we are conducting various interviews and checks on the various candidates,” Aquino told reporters at the Tarlac National High School in Tarlac City. Aquino had kind words for Espina, saying that he stood by and defended the 44 slain police Special Action Force (SAF) commandos in the operation in …

  • Palace welcomes G7 concern over sea reclamation
    Palace welcomes G7 concern over sea reclamation

    President Aquino welcomed yesterday the Group of Seven industrialized countries’ expression of concern over rising tension in the West Philippine Sea and South China Sea, calling it a clear indication of the global scope of the problem ramped up by China’s massive reclamation activities in disputed waters. In Tarlac City where he led the turnover of new classrooms, Aquino told reporters that goodwill and not tension must prevail in the West Philippine Sea and South China Sea, where territorial …

  • DepEd, TESDA tie up for K to 12
    DepEd, TESDA tie up for K to 12

    The Department of Education (DepEd) has partnered with the Technical Education and Skills Development Authority (TESDA) in the first two years of implementation of the K to 12 program. “We will use TESDA centers as technical-vocational laboratories for senior high school,” DepEd Secretary Armin Luistro said during the inauguration of 30 new classrooms at the Tarlac National High School yesterday. The classrooms were constructed in partnership with the Philippine Amusement and Gaming Corp. …

  • SE Asia Stocks-Philippine falls on foreign selling; others flat to weaker

    BANGKOK, April 17 (Reuters) - Southeast Asian stock markets ended flat to weaker on Friday as Philippine stocks slid on selling led by foreign funds and Singapore shares extended losses with investors ... …

  • Philippine Airlines parent says back in black
    Philippine Airlines parent says back in black

    Philippine Airlines' parent firm said it had returned to profitability, the first time in three years either entity reported being in the black for an entire year. In a filing with the Philippine Stock Exchange Thursday, PAL Holdings reported an after-tax net profit of 129.74 million pesos ($2.93 million) in its fiscal year to December 31. …

POLL

Should Aquino be held accountable over the Mamasapano operations?

Loading...
Poll Choice Options