Students crack Australian state transport system
An Australian state public transport system has been cracked by a group of security researchers who were able to replicate cards to enable free travel.
Theo Juleene, Karla Brunett, Damon Stacey, and Dougall Johnston used flaws in the system's decades-old custom cryptographic scheme to access transport data and reproduce tickets.
A team of four security researchers, using the group name TrainHack, presented their work in a talk dubbed Reverse Engineering a Mass Transit Ticketing System at the Ruxcon security conference in Melbourne last week. It cost only a few hundred dollars to buy a card reader and equipment to crack the cards. They chastised the use of weak custom encryption but in line with disclosure agreements did not name the type of cryptography used or identify the affected organisation.
