IDG News Service - The Massachusetts Bay Transportation Authority has sued three students and their school, MIT, hoping to stop them from disclosing flaws in the MBTA's electronic ticketing system.
The lawsuit claims that the presentation would cause "significant damage to the MBTA's transit system," according to an online posting of the suit, filed Friday with the U.S. District Court for the District of Massachusetts.
It names students Zack Anderson, Russell "RJ" Ryan and Alessandro Chiesa, who are scheduled to talk about "The Anatomy of a Subway Hack: Breaking Crypto RFIDs & Magstripes of Ticketing Systems" at the Defcon conference on Sunday at 1 p.m. local time. The MIT students and an MBTA lawyer did not return calls and e-mail messages seeking comment.
In a presentation distributed to Defcon attendees, the students described a variety of techniques that could be used to gain free access to Boston's transit system, some of which they acknowledged are illegal. They said that the point of the talk is to show the results of a penetration test of the MBTA system, but they were clearly aware that it could have caused legal problems. One slide reads simply "What this talk is not: evidence in court (hopefully)."
The passage in the Defcon show guide describing the talk begins, "Want free subway rides for life?" That line was removed from the description of the talk posted at the Defcon Web site.
The students discussed physical security problems they found with the system, such as unlocked gates and unattended surveillance booths. They say they were able to access fiber switches connecting fare-vending machines to the unlocked network, and they also describe techniques to clone and reverse-engineer the MBTA's CharlieTicket magnetic-stripe tickets and CharlieCard smart cards.
In court filings, the MBTA said that 68% of its riders use the CharlieCard, which brings in about $475,000 to the transit authority each weekday. The researchers refused to give the transit authority information about security flaws in its system ahead of the talk, the filings stated.
An MBTA vendor tipped off the authority on July 30 that the talk was scheduled, according to the court papers.
The CharlieCard is based on the same Mifare Classic RFID (radio frequency identification) technology used by many other transit systems around the world. Earlier this year, Mifare's producer, NXP Semiconductors USA Inc., sued to prevent researchers from presenting research on how to crack this technology. A Dutch court rejected NXP's claims last month.
The MIT students' talk is supposed to be posted online at an MIT site. At press time, it was not available.
With an average weekday ridership of 1.4 million commuters, the MBTA is the nation's fifth-largest transit system, according to the lawsuit.
Free Insider GuideCopyright © 1994 - 2012 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc.
