5 ms·

Transportation Hack 2.0: Flaw Found Calif.'s FasTrak System

11 points by acesamped 18y ago

MicahWedemeyer 18y ago
The lack of encryption in these things is just astonishing. Sure, encryption isn't a magic bullet, but it's the first line of defense, and most programming languages make it so damn easy to use.
- jonnytran 18y ago
  Yeah. The fact that these things are being found -- things that deal with people's actual money -- indicates just how incompetent the average ITer is when it comes to security. I wonder how long hackers have been exploiting these things _without_ announcing them.
- tptacek 18y ago
  Somehow, I'm guessing they're not running a JVM on an TI MSP4xx microcontroller. It's actually not damn easy to get encryption working on controller boards. What's more, for many of these kinds of systems, encryption that is anything more than a speed bump is very hard to get right, because of key management and round trip limits.
  - hhm 18y ago
    Even in a controller card, it's very easy to at least do some Caesar cipher or anything simple like that. They could even do something a little more complex without much troble.
    - tptacek 18y ago
      I'm not sure what the security advantage of ROT13 is.
      - hhm 18y ago
        I didn't say ROT13, it could be ROTx, or it could have a variable x (as with a big key), whatever... the advantage would be to make it slightly more difficult to find the meaning of the numbers in the card. I know security by obscurity doesn't work, but it's better than nothing.
        tptacek 18y ago
        I think it would have been even worse for FasTrak if Nate had got up on stage and said that they tried to pass XOR off as encryption. Then the story would not only be negligence, but also incompetence. There's a plausible story you can tell for why FasTrak isn't secured at all.
        hhm 18y ago
        You are right.
  - maximilian 18y ago
    A lot of controllers have builtin encryption hardware. If you put encryption in the original spec, its not that hard to include.
    - tptacek 18y ago
      I can see it being easy to add encryption to a 32 bit part deployed in a pizza box form factor on the bottom of a telephone pole or alongside a train track right of way. I'm not sure it's that easy when you're constrained to a 16 bit part that can't big bigger than a wallet, has almost no power available, needs to be distributed in volumes of hundreds of thousands or more, needs to cost almost nothing per part, and needs to be one of the vendors that plays well with RF. Again, this also misses the point that key management and protocol design are more important than the algorithm; it's not necessarily an easy problem to provision keys to 1,000,000 floating devices, nor is it necessarily easy to design a secure protocol that has to run in 1 round trip at 45MPH. Just some thoughts. Obviously we can agree that this system needs to be more secure. I'm not sticking up for FasTrak; I'm just trying to respect the problem.
      - gojomo 18y ago
        Until there's evidence someone is actually exploiting this at an economically relevant level, I wouldn't agree the "system needs to be more secure". And if it is being exploited, using the existing license-plate cameras may be a more effective means of securing the system than upgrading the transponder behavior.
        tptacek 18y ago
        I think the first point is sensible, even though I disagree with it. I'm not sure I understand how license plate cameras solve the problem, though. How many tens of thousands of license plates would need to be processed per day, and for what pattern? Also note that the economics are just part of the problem. Other problems include privacy, chain of evidence, and personal fraud damages.
        18y ago

11 points by acesamped 18y ago

The lack of encryption in these things is just astonishing. Sure, encryption isn't a magic bullet, but it's the first line of defense, and most programming languages make it so damn easy to use.

jonnytran 18y ago
Yeah. The fact that these things are being found -- things that deal with people's actual money -- indicates just how incompetent the average ITer is when it comes to security. I wonder how long hackers have been exploiting these things _without_ announcing them.
tptacek 18y ago
Somehow, I'm guessing they're not running a JVM on an TI MSP4xx microcontroller. It's actually not damn easy to get encryption working on controller boards. What's more, for many of these kinds of systems, encryption that is anything more than a speed bump is very hard to get right, because of key management and round trip limits.
- hhm 18y ago
  Even in a controller card, it's very easy to at least do some Caesar cipher or anything simple like that. They could even do something a little more complex without much troble.
  - tptacek 18y ago
    I'm not sure what the security advantage of ROT13 is.
    - hhm 18y ago
      I didn't say ROT13, it could be ROTx, or it could have a variable x (as with a big key), whatever... the advantage would be to make it slightly more difficult to find the meaning of the numbers in the card. I know security by obscurity doesn't work, but it's better than nothing.
      - tptacek 18y ago
        I think it would have been even worse for FasTrak if Nate had got up on stage and said that they tried to pass XOR off as encryption. Then the story would not only be negligence, but also incompetence. There's a plausible story you can tell for why FasTrak isn't secured at all.
        hhm 18y ago
        You are right.
- maximilian 18y ago
  A lot of controllers have builtin encryption hardware. If you put encryption in the original spec, its not that hard to include.
  - tptacek 18y ago
    I can see it being easy to add encryption to a 32 bit part deployed in a pizza box form factor on the bottom of a telephone pole or alongside a train track right of way. I'm not sure it's that easy when you're constrained to a 16 bit part that can't big bigger than a wallet, has almost no power available, needs to be distributed in volumes of hundreds of thousands or more, needs to cost almost nothing per part, and needs to be one of the vendors that plays well with RF. Again, this also misses the point that key management and protocol design are more important than the algorithm; it's not necessarily an easy problem to provision keys to 1,000,000 floating devices, nor is it necessarily easy to design a secure protocol that has to run in 1 round trip at 45MPH. Just some thoughts. Obviously we can agree that this system needs to be more secure. I'm not sticking up for FasTrak; I'm just trying to respect the problem.
    - gojomo 18y ago
      Until there's evidence someone is actually exploiting this at an economically relevant level, I wouldn't agree the "system needs to be more secure". And if it is being exploited, using the existing license-plate cameras may be a more effective means of securing the system than upgrading the transponder behavior.
      - tptacek 18y ago
        I think the first point is sensible, even though I disagree with it. I'm not sure I understand how license plate cameras solve the problem, though. How many tens of thousands of license plates would need to be processed per day, and for what pattern? Also note that the economics are just part of the problem. Other problems include privacy, chain of evidence, and personal fraud damages.
        18y ago