Technology Review - Published By MIT
Advertisement
[1] 2 Next »

Monday, August 25, 2008

Road Tolls Hacked

A researcher claims that toll transponders can be cloned, allowing drivers to pass for free.

By Duncan Graham-Rowe
smaller text tool iconmedium text tool iconlarger text tool icon
Under the hood: After studying the workings of FasTrak transponders such as this one, Nate Lawson says that it is possible to copy or change the identification numbers used to bill drivers as they pass through highway and bridge tolls.

Drivers using the automated FasTrak toll system on roads and bridges in California's Bay Area could be vulnerable to fraud, according to a computer security firm in Oakland, CA.

Despite previous reassurances about the security of the system, Nate Lawson of Root Labs claims that the unique identity numbers used to identify the FasTrak wireless transponders carried in cars can be copied or overwritten with relative ease.

This means that fraudsters could clone transponders, says Lawson, by copying the ID of another driver onto their device. As a result, they could travel for free while others unwittingly foot the bill. "It's trivial to clone a device," Lawson says. "In fact, I have several clones with my own ID already."

Lawson says that this also raises the possibility of using the FasTrak system to create false alibis, by overwriting one's own ID onto another driver's device before committing a crime. The toll system's logs would appear to show the perpetrator driving at another location when the crime was being committed, he says.

So far, the security flaws have only been verified in the FasTrak system, but other toll systems, like E-Z Pass and I-Pass, need to be looked at too, argues Lawson. "Every modern system requires a public security review to be sure there aren't different but related problems," he says. Indeed, in recent weeks, researchers announced flaws in another wireless identification system: the Mifare Classic chip, which is used by commuters on transport systems in many cities, including Boston and London. However, last week, the Massachusetts Bay Transportation Authority (MBTA) filed a lawsuit to prevent students at MIT from presenting an analysis of Boston's subway system.

The Bay Area Metropolitan Transport Commission (MTC), which oversees the FasTrak toll system, maintains that it is secure but says it is looking into Lawson's claims. "MTC is in contact with vendors who manufacture FasTrak lane equipment and devices to identify potential risks and corrective actions," says MTC spokesman Randy Rentschler. "We are also improving system monitoring in order to detect potentially fraudulent activity."

In the past, authorities have insisted that the FasTrak system uses encryption to secure data and that no personal details are stored on the device--just two unique, randomly assigned ID numbers. One of these is used to register the device when a customer purchases it, while the other acts as a unique identifier to let radio receivers at tolls detect cars as they pass by.

But when Lawson opened up a transponder, he found that there was no security protecting these IDs. The device uses two antennas, one to detect a request signal from the toll reader and another to transmit its ID so that it can be read, he says.

[1] 2 Next »

Tags

automobiles hacker RFID security wireless

Comments

  • Aluminum Foils Eavedroppers
    lkrndu on 08/25/2008 at 5:44 AM
    Posts:
    19
    Avg Rating:
    2/5
    There already IS a FasTrack user privacy system: a sheet of aluminum foil.

    Wrap the transponder in aluminum foil and it's isolated from any intercommunication.
    Rate this comment: 12345
    • Re: Aluminum Foils Eavedroppers
      Erica Naone on 08/25/2008 at 9:15 AM      		 Technology Review TR Staff
      Assistant Editor
      Posts:
      29
      Avg Rating:
      4/5
      I happened to speak with Nate Lawson at Black Hat on this subject, and he mentioned to me that the aluminum foil wrapper is a problem, as far as he's concerned, because taking the transponder in and out of the foil while driving seems like a potentially dangerous distraction for the driver. We also discussed opt-in versus opt-out systems of privacy. The foil is an example of an opt-out system -- the user has to actively protect her own privacy by remembering to wrap the transponder after using it. It's my opinion that an opt-in method, on the other hand, such as the privacy kit Lawson is working on, leaves the user more protected in the end. 
      Rate this comment: 12345
      • Re: Aluminum Foils Eavedroppers
        grimmy on 09/05/2008 at 2:33 PM
        Posts:
        1
        I think he meant that the driver should affix the transponder on his head and a tinfoil hat on top; that should be quite easy to remove and replace when needed.
        Rate this comment: 12345
  • Still busted!
    Dr. Orbis on 08/25/2008 at 10:30 AM
    Posts:
    7
    Avg Rating:
    4/5
    In the category of "More bogus paranoia"

    You may have been able to change the identity in your RFID tag, but most toll facilities (at least in the NY area where I drive) have cameras that capture both the vehicle and the driver.

    If someone checks their bill, wonders how he could be driving in another part of the state and complains to the toll authority, it's a relatively simple matter to undertake a proper investigation.

    Unless the perpetrator is prepared to also change the license plate, and make, model and color of his vehicle, he stands a fair chance of getting a visit from the Fuzz.

    You've also the problem of stumbling upon an in-use ID, unless you have a portable RFID pinger set to the right frequencies and protocols.

    In the end, this is hacker geek stuff, not the nightmare of mass toll anarchy. I can't wait for the first guy to get caught and the resulting national news whip-saw! You read it here first!

    Dr. Orbis
    Rate this comment: 12345
    • Re: Still busted!
      Otto on 08/26/2008 at 12:15 PM
      Posts:
      1
      Avg Rating:
      4/5
      Oh come on, this isn't that difficult to get away with. You go through a parking lot with a reader, and swipe every toll number you find. Then you modify your own transmitter to simply cycle through this huge list of numbers at random. Odds of getting caught on this, next-to-zero. Because who notices one extra toll on their account from time to time.
      Rate this comment: 12345
  • Fraud detection
    dnwdfw on 08/25/2008 at 2:46 PM
    Posts:
    10
    Avg Rating:
    4/5
    This is an easy case for a fraud detection scheme. Simply scan for transponder matches where the distance between scanners exceeds the possible travel distance at a reasonable(<100MPH)speed. Match transponders to vehicle license plates and arrest the mismatch.
    Rate this comment: 12345
  • They give you an anti-static bag.
    baddawg on 08/26/2008 at 5:47 PM
    Posts:
    1
    Actually I have one of those FastTrak and they send you a anti-static bag to block out the signals for a voluntary project where they measure how fast you go between two points so they can show how fast traffic is going. If everyone does this then the only place to get the FastTrak ID is near the toll plazas so the thieves will be hanging around those locations. However, the California Highway Patrol likes to have many units at the toll plaza to clear up traffic accidents and to get toll jumpers also so it would be interesting so see what happens.
    Rate this comment: 12345
  • There are ways to protect yourself
    GPS Tracking on 08/29/2008 at 11:32 AM
    Posts:
    1
    There are a lot of people already protecting themselves from these type of crimes by installing a gps tracking device in their own vehicle.

    Obviously, there are other reasons for this too, such as, theft protection and recording mileage for tax purposes. However, for the point of this article, an innocent victim can prove their vehicle was no where near a toll, contrary to any overwriting of a FastTrack device.
    Rate this comment: 12345
  • Waste of Time
    briang1621 on 08/31/2008 at 1:57 PM
    Posts:
    50
    Avg Rating:
    4/5
    Instead of worry about sucking every dollar of toll out of you, the road authority should be building better roads. Here is the break down of effort by the road authority.
      80% spent on getting money
      10% spent on building roads
      10% talk about how they are going to improve thing.
       I have seen more accident at toll booths than at any other part of the highway.
       If people want to rip of the road authority, to bad for them, they are not doing their job anyways. !
      Brian Glassman
    Rate this comment: 12345
Add New Thread

Related Articles
Advertisement

Current Issue

Technology Review November/December 2008
Sun + Water = Fuel
An MIT chemist has opened the way to making hydrogen fuel from water using sunlight.
•  Subscribe
Save 41%
•  Table of Contents
•  MIT News

Magazine Services

•  Gift Subscription
•  Digital Subscription
•  Reprints, Back Issues, Customer Service

Career Resources

Visit the Job Board and Resource Center to move your career to the next level.

MIT Technology Insider

Stories and breaking news from inside MIT about the latest research, innovations, and startups--in a convenient monthly e-newsletter. Subscribe today
Advertisement

Follow us on Twitter

Twitter

Get Technology Review updates via the web, cellphone, or Instant Messager – Follow techreview on Twitter!
Advertisement

More Technology News from Forbes

Wire Stories

Advertisement
Advertisement
TECHNOLOGY RESOURCES
Advertisement
MIT Massachusetts Institute of Technology