Feeds

Hack ushers in the insatiable toll booth

The FasTrak to fraud and empty accounts

Beginner's guide to SSL certificates

Black Hat A widely used device for paying traffic tolls electronically is vulnerable to tampering that could create trouble for those who use it, a researcher said Wednesday.

The FasTrak transponder uses radio frequency identification (RFID) technology to communicate with reader devices located at toll booths. Motorists use the devices to debit money from pre-established accounts so they don't have to wait in line to pay by cash. About 1 million of the devices are in use in California, according to a recent news report.

It turns out the FasTrak unit broadcasts its unique identification in the clear, allowing anyone who may be eavesdropping on the session to copy the ID and create cloned devices. Attackers could carry a simple hand-held device through a parking lot to sweep up large numbers of IDs and then sell counterfeited transponders. People whose devices were cloned would have no idea until they received bills for tolls they never authorized.

"It charges tolls to other people's accounts," said Nate Lawson, principal with security consulting firm Root Labs, who presented his findings at the Black Hat security conference in Las Vegas. "If you've read the ID from someone else and replay it, you're basically them and they get charged."

What's more, the FasTrak has an update mechanism that can get triggered without authentication. That allows attackers with simple equipment to reprogram the ID of devices belonging to other people.

The defects could be used to create chaos for the government agencies that rely on the transponder. Using ad-hoc devices placed at the side of a highway, miscreants could resign IDs for hundreds of thousands of devices. The attack would cause millions of dollars in uncollected tolls and replacement fees.

The design could also allow for other types of mischief. For instance, a person could carry out an "alibi attack" by writing his ID to someone else's device. When that person crossed a toll bridge, FasTrak records would show it was the attacker, not the victim, who took the trip, allowing the attacker to create a false alibi.

Lawson carried out his research by dissecting two transponders. Older models allowed him to easily access the firmware and all the data it stores. Newer models contain a "lockbit" that prevents access to the firmware, but with the help of fellow researcher Chris Tarnovsky, Lawson was also able to circumvent the measure.

So far, Lawson has had trouble getting the agencies that use FasTrak to respond to his research. He has not yet contacted Sirit Technologies, the manufacturer of the transponder. ®

Intelligent flash storage arrays

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.