Under the hood: After studying the workings of FasTrak transponders such as this one, Nate Lawson says that it is possible to copy or change the identification numbers used to bill drivers as they pass through highway and bridge tolls.
A researcher claims that toll transponders can be cloned, allowing drivers to pass for free.
Drivers using the automated FasTrak toll system on roads and bridges in California's Bay Area could be vulnerable to fraud, according to a computer security firm in Oakland, CA.
Despite previous reassurances about the security of the system, Nate Lawson of Root Labs claims that the unique identity numbers used to identify the FasTrak wireless transponders carried in cars can be copied or overwritten with relative ease.
This means that fraudsters could clone transponders, says Lawson, by copying the ID of another driver onto their device. As a result, they could travel for free while others unwittingly foot the bill. "It's trivial to clone a device," Lawson says. "In fact, I have several clones with my own ID already."
Lawson says that this also raises the possibility of using the FasTrak system to create false alibis, by overwriting one's own ID onto another driver's device before committing a crime. The toll system's logs would appear to show the perpetrator driving at another location when the crime was being committed, he says.
So far, the security flaws have only been verified in the FasTrak system, but other toll systems, like E-Z Pass and I-Pass, need to be looked at too, argues Lawson. "Every modern system requires a public security review to be sure there aren't different but related problems," he says. Indeed, in recent weeks, researchers announced flaws in another wireless identification system: the Mifare Classic chip, which is used by commuters on transport systems in many cities, including Boston and London. However, last week, the Massachusetts Bay Transportation Authority (MBTA) filed a lawsuit to prevent students at MIT from presenting an analysis of Boston's subway system.
The Bay Area Metropolitan Transport Commission (MTC), which oversees the FasTrak toll system, maintains that it is secure but says it is looking into Lawson's claims. "MTC is in contact with vendors who manufacture FasTrak lane equipment and devices to identify potential risks and corrective actions," says MTC spokesman Randy Rentschler. "We are also improving system monitoring in order to detect potentially fraudulent activity."
In the past, authorities have insisted that the FasTrak system uses encryption to secure data and that no personal details are stored on the device--just two unique, randomly assigned ID numbers. One of these is used to register the device when a customer purchases it, while the other acts as a unique identifier to let radio receivers at tolls detect cars as they pass by.
But when Lawson opened up a transponder, he found that there was no security protecting these IDs. The device uses two antennas, one to detect a request signal from the toll reader and another to transmit its ID so that it can be read, he says.
Sending false signals to GPS receivers could disrupt critical infrastructure.
In the category of "More bogus paranoia"
You may have been able to change the identity in your RFID tag, but most toll facilities (at least in the NY area where I drive) have cameras that capture both the vehicle and the driver.
If someone checks their bill, wonders how he could be driving in another part of the state and complains to the toll authority, it's a relatively simple matter to undertake a proper investigation.
Unless the perpetrator is prepared to also change the license plate, and make, model and color of his vehicle, he stands a fair chance of getting a visit from the Fuzz.
You've also the problem of stumbling upon an in-use ID, unless you have a portable RFID pinger set to the right frequencies and protocols.
In the end, this is hacker geek stuff, not the nightmare of mass toll anarchy. I can't wait for the first guy to get caught and the resulting national news whip-saw! You read it here first!
Dr. Orbis
Oh come on, this isn't that difficult to get away with. You go through a parking lot with a reader, and swipe every toll number you find. Then you modify your own transmitter to simply cycle through this huge list of numbers at random. Odds of getting caught on this, next-to-zero. Because who notices one extra toll on their account from time to time.
This is an easy case for a fraud detection scheme. Simply scan for transponder matches where the distance between scanners exceeds the possible travel distance at a reasonable(<100MPH)speed. Match transponders to vehicle license plates and arrest the mismatch.
They give you an anti-static bag.
Actually I have one of those FastTrak and they send you a anti-static bag to block out the signals for a voluntary project where they measure how fast you go between two points so they can show how fast traffic is going. If everyone does this then the only place to get the FastTrak ID is near the toll plazas so the thieves will be hanging around those locations. However, the California Highway Patrol likes to have many units at the toll plaza to clear up traffic accidents and to get toll jumpers also so it would be interesting so see what happens.
There are ways to protect yourself
There are a lot of people already protecting themselves from these type of crimes by installing a gps tracking device in their own vehicle.
Obviously, there are other reasons for this too, such as, theft protection and recording mileage for tax purposes. However, for the point of this article, an innocent victim can prove their vehicle was no where near a toll, contrary to any overwriting of a FastTrack device.
Instead of worry about sucking every dollar of toll out of you, the road authority should be building better roads. Here is the break down of effort by the road authority.
80% spent on getting money
10% spent on building roads
10% talk about how they are going to improve thing.
I have seen more accident at toll booths than at any other part of the highway.
If people want to rip of the road authority, to bad for them, they are not doing their job anyways. !
Brian Glassman
Manufacturing in the United States is in trouble. That's bad news not just for the country's economy but for the future of innovation.
On Twitter
Become a Fan on Facebook
Subscribe to the Feed
lkrndu
36 Comments
Aluminum Foils Eavedroppers
There already IS a FasTrack user privacy system: a sheet of aluminum foil.
Wrap the transponder in aluminum foil and it's isolated from any intercommunication.
Reply
Erica Naone
70 Comments
Re: Aluminum Foils Eavedroppers
I happened to speak with Nate Lawson at Black Hat on this subject, and he mentioned to me that the aluminum foil wrapper is a problem, as far as he's concerned, because taking the transponder in and out of the foil while driving seems like a potentially dangerous distraction for the driver. We also discussed opt-in versus opt-out systems of privacy. The foil is an example of an opt-out system -- the user has to actively protect her own privacy by remembering to wrap the transponder after using it. It's my opinion that an opt-in method, on the other hand, such as the privacy kit Lawson is working on, leaves the user more protected in the end.
Reply
grimmy
1 Comment
Re: Aluminum Foils Eavedroppers
I think he meant that the driver should affix the transponder on his head and a tinfoil hat on top; that should be quite easy to remove and replace when needed.
Reply