Skip to main content

Security researchers identify transit system exploit in San Fran and New Jersey, create app to prove it

posted onSeptember 24, 2012
by l33tdawg

Mobile security company Intrepidus Group presented evidence during the EUSecWest security conference potentially identifying a major flaw in at least two US transit systems. Creating an Android app named "UltraReset" and using it in tandem with an NFC-enabled Android phone (a Nexus S, in this case), security researchers Corey Benninger and Max Sobell were able to reset and reuse -- free of charge -- transit access cards in both San Francisco's MUNI system and New Jersey's PATH system.

Before you go getting any bad ideas, know that Benninger and Sobell haven't released the app for public use, and warned both transit systems in late 2011 (though neither region has fixed the exploit, the duo claim). PATH and MUNI share a common chip access card -- the Mifare Ultralight -- which can apparently be reset for 10 extra rides (as demonstrated on video below) via Android phones with NFC, an OS newer than 2.3.3 (Gingerbread). Starting to sound familiar?

Source

Tags

Security NFC

You May Also Like

Recent News

Tuesday, November 19th

Friday, November 8th

Friday, November 1st

Tuesday, July 9th

Wednesday, July 3rd

Friday, June 28th

Thursday, June 27th

Thursday, June 13th

Wednesday, June 12th

Tuesday, June 11th