Court halts subway hacker talk

IDG News Service - A U.S. District Court judge ordered the cancellation of a Defcon conference talk scheduled for Sunday that would have detailed flaws in the Massachusetts Bay Transportation Authority's (MBTA) electronic ticketing system.

The MBTA filed a lawsuit Friday seeking to stop three MIT students and MIT from giving the talk. Judge Douglas Woodlock of the U.S. District Court for the District of Massachusetts issued a court order in favor of the MBTA Saturday afternoon.

The Boston-area transportation authority argued that the presentation would cause "significant damage to the MBTA's transit system," according to an online posting of the lawsuit.

MIT students Zack Anderson, Russell "RJ" Ryan and Alessandro Chiesa had been scheduled to talk about "The Anatomy of a Subway Hack: Breaking Crypto RFIDs & Magstripes of Ticketing Systems" at the Defcon conference Sunday at 1 p.m. local time. The MIT students and an MBTA lawyer did not return calls and e-mail messages seeking comment.

After talking with their legal counsel, Jennifer Granick of the Electronic Frontier Foundation (EFF), the students decided not to fight the court order and canceled the talk, a spokeswoman for the Defcon conference said Saturday.

Though the students are barred by court order from providing information that would have helped others circumvent the talk, their presentation slides had already been included in a conference CD given to Defcon attendees. The MBTA itself put some details in the public record, by filing a confidential assessment of its security system with the court.

In the Defcon presentation slides, the students described a variety of techniques that could be used to gain free access to Boston's transit system, some of which they admitted are illegal. They said that the point of the talk is to show the results of a penetration test of the MBTA system, but they were clearly aware that it could have caused legal problems. One slide simply read, "What this talk is not: evidence in court (hopefully)."

The passage in the Defcon show guide describing their talk began, "Want free subway rides for life?" That line was removed from the description of the talk posted at the Defcon Web site.

The students discuss physical security problems they found with the system, such as unlocked gates and unattended surveillance booths. They say they were able to access fiber switches connecting fare vending machines to the unlocked network, and they described techniques to clone and reverse-engineer the MBTA's CharlieTicket magnetic stripe tickets and CharlieCard smart cards.

In court filings, the MBTA said that 68% of its riders use the CharlieCard, which brings in about $475,000 to the transit authority each weekday.