DEF CON 31 - Infinite Money Glitch - Hacking Transit Cards - Bertocchi, Campbell, Gibson, Harris
Summary
Vocational high school students from Medford, Massachusetts, discuss their project of reverse-engineering and exploiting the MBTA's Charlie Card system. They detail how they initially tried to hack paper tickets but moved to contactless cards after the MBTA phased out the old system. Their research uncovered vulnerabilities in the MIFARE Classic technology used, including weak encryption and default keys. They successfully cloned cards, modified values, and even forged different card types like employee or senior passes. Despite the illegality, they chose to present their findings to the MBTA directly, aiming to improve security rather than exploit the system further.
Key Insights
Vulnerabilities in MIFARE Classic technology allow for manipulation of transit card data.
The MBTA's Charlie Cards utilize MIFARE Classic technology, which has known cryptographic weaknesses. The system uses a proprietary 48-bit encryption called Crypto1, which is susceptible to being cracked. Researchers also discovered that the system often relies on default encryption keys, making it easier to access card data. This allows for reading, writing, and modifying data on the cards, including fare values and card types.
Direct engagement with the transit authority led to security improvements rather than exploitation.
Instead of solely exploiting the discovered vulnerabilities, the students proactively contacted the MBTA to present their findings. This direct approach, though initially met with some resistance, led to a meeting where they shared their research and demonstrated how the system could be compromised. This interaction aimed to encourage the MBTA to implement better security measures to prevent future exploitation, prioritizing responsible disclosure over personal gain or widespread system disruption.
Sections
Introduction and Disclaimers
Vocational high school students from Medford, MA, presented their findings on hacking MBTA Charlie Cards.
The presenters are vocational high school students from Medford, Massachusetts, who call themselves 'amateur miscreants.' They are part of an underwater robotics team called Sunk Robotics. They acknowledged the illegal nature of their actions and stated the MBTA does not endorse or encourage such activities, warning of legal consequences.
The talk promised insights into reverse engineering transit cards and interacting with government agencies.
The students outlined what the audience would gain: potential free rides on the MBTA, lessons on reverse-engineering transit cards, advice on dealing with government agencies, and how to avoid legal trouble. They reiterated that their actions were illegal and advised against trying them.
Traditional Fare vs. Hacking
Traditional fare payment methods are seen as boring, costly, or too easy.
The presenters contrasted traditional fare payment (hopting gates, forcing them open, or simply paying) with hacking the system. Traditional methods were deemed too easy, boring, costly, or too legal, prompting the exploration of alternative, albeit illegal, methods.
Initial attempts focused on hacking older Charlie Tickets with mag stripes.
The project began with research into older Charlie Tickets that used magnetic stripes. These were found to have weak security, allowing for cloning and reverse engineering, potentially enabling free rides. However, the MBTA phased out these tickets, rendering this approach obsolete.
Transition to Charlie Cards and MIFARE Classic
Newer Charlie Cards use contactless smart card technology, specifically MIFARE Classic.
After the mag stripe tickets were discontinued, the focus shifted to the newer, tappable Charlie Cards. These cards were identified as using MIFARE Classic technology, a standard for data storage and communication developed by NXP.
MIFARE Classic employs Crypto1 encryption, which is proprietary and easily crackable.
MIFARE Classic's security relies on NXP's proprietary 48-bit encryption algorithm called Crypto1. While proprietary encryption might sound secure, it has been extensively studied by researchers. The 48-bit encryption can be cracked relatively quickly, and vulnerabilities have been found and exploited, often leading to legal action against researchers.
Tools and Techniques for Card Interaction
Acquiring suitable NFC readers proved to be a challenging and expensive ordeal.
The process of obtaining a functional NFC reader was difficult. The presenters went through several readers: an initial one from Amazon that was too complex (using libNFC), a pricier Proxmark III that didn't function correctly for reading/writing, a cheap AliExpress reader that broke, and finally a budget-friendly PN 532 that worked but required a Raspberry Pi and soldering.
Extracting encryption keys required specialized attacks and exploiting default credentials.
To interact with the MIFARE Classic cards, the encryption keys needed to be obtained. Initial attempts using attacks like Nested and Dark Side (with tools mfoc and mfcuk) were unsuccessful. A breakthrough came when they discovered a repository of default keys for MIFARE Classic, which allowed mfoc to successfully extract all 16 keys (A and B).
Card Cloning and Data Manipulation
Cloning Charlie Cards was achieved using special 'magic cards' and a custom program.
With the encryption keys and a binary dump of a Charlie Card, they used special 'magic cards' (which allow UID editing) to clone the data. Their custom C program, called 'Charlie Clone,' efficiently copied card data. When tested, the cloned card worked, deducting money, while the original card retained its value, indicating the card itself was the source of truth, not a central database.
Card cloning has limitations, including upfront investment and detection risks.
Despite the success of cloning, there were drawbacks. To get a card with a certain value (e.g., $50), one still needed to initially load $50 onto the original card. Furthermore, the MBTA could detect cloned cards, leading to them being disabled, requiring the user to purchase new ones.
Reverse Engineering the Checksum and Fare Storage
Identifying and cracking the checksum was crucial for editing card data.
The presenters attempted to forge cards by editing data directly. They noticed two bytes at the end of the data that likely functioned as a checksum, similar to older Charlie Tickets. Standard checksum algorithms failed, suggesting a custom implementation. They found that XORing checksums from two identical data lines on different cards yielded a consistent 'checksum modifier,' enabling data transfer.
A breakthrough revealed that money is stored in half-pennies and requires specific manipulation.
Through extensive trial and error, often involving lengthy sessions at subway stations with portable NFC readers, they identified the bytes storing the monetary value. They discovered the values were stored in units of half-pennies and required specific mathematical operations (XORing with 'data modifiers' and 'checksum modifiers') to modify. This allowed them to change the fare value on a card.
A repeatable method was developed to set arbitrary monetary values on cards, up to a limit.
They developed a repeatable strategy involving adding a small amount (like a quarter) to enable further modification. By XORing data and checksums, they could generate new values. This process allowed them to set card values precisely, eventually reaching a limit close to the signed 16-bit integer maximum ($327.67). They refined this to avoid the need for frequent quarter additions by creating a lookup table of modifiers.
The system allows for forging card types beyond just monetary value.
Beyond manipulating monetary values, the reverse engineering allowed them to change the 'card type.' This permitted them to create fake employee, senior, or student cards, further demonstrating the system's vulnerability.
Building the 'Bang Machine' and Responsible Disclosure
A physical device, the 'Bang Machine,' was built to automate card data modification.
To automate their findings, they built a device called the 'Bang Machine.' Multiple iterations were created, with the final version capable of reading NFC/MIFARE cards, modifying data (like expiration dates and money values), and interacting with readers. It featured a web front-end and a rudimentary Android app.
The students chose to present their findings directly to the MBTA.
Rather than releasing their findings publicly or exploiting the system further, the students decided to contact the MBTA. They filled out a complaint form, which unexpectedly led to an invitation to the MBTA headquarters.
The meeting with MBTA executives involved demonstrating the vulnerabilities and discussing solutions.
During the meeting at MBTA headquarters, they presented their research and demonstrated the capabilities of their 'Bang Machine.' They explained how they could alter card values and types. The MBTA executives were present, and the discussion focused on how the MBTA could prevent such exploits in the future. No pictures were allowed during this meeting.
A 'demo' video showcased the modification of a Charlie Card's value and type.
A video demonstration was partially shown, illustrating the process of buying a Charlie Card, altering its monetary value to $251.50, and changing its card type to 'employee.' This visually confirmed the effectiveness of their reverse engineering and modification techniques.
Ask a Question
*Uses 1 Wisdom coin from your coin balance
![Kali Linux Basics: Beginner Guide + Essential Commands [35 Min]](https://i.ytimg.com/vi/AGVTX9HQp1M/hqdefault.jpg)
