Feeds

Hack ushers in the insatiable toll booth

The FasTrak to fraud and empty accounts

The essential guide to IT transformation

Black Hat A widely used device for paying traffic tolls electronically is vulnerable to tampering that could create trouble for those who use it, a researcher said Wednesday.

The FasTrak transponder uses radio frequency identification (RFID) technology to communicate with reader devices located at toll booths. Motorists use the devices to debit money from pre-established accounts so they don't have to wait in line to pay by cash. About 1 million of the devices are in use in California, according to a recent news report.

It turns out the FasTrak unit broadcasts its unique identification in the clear, allowing anyone who may be eavesdropping on the session to copy the ID and create cloned devices. Attackers could carry a simple hand-held device through a parking lot to sweep up large numbers of IDs and then sell counterfeited transponders. People whose devices were cloned would have no idea until they received bills for tolls they never authorized.

"It charges tolls to other people's accounts," said Nate Lawson, principal with security consulting firm Root Labs, who presented his findings at the Black Hat security conference in Las Vegas. "If you've read the ID from someone else and replay it, you're basically them and they get charged."

What's more, the FasTrak has an update mechanism that can get triggered without authentication. That allows attackers with simple equipment to reprogram the ID of devices belonging to other people.

The defects could be used to create chaos for the government agencies that rely on the transponder. Using ad-hoc devices placed at the side of a highway, miscreants could resign IDs for hundreds of thousands of devices. The attack would cause millions of dollars in uncollected tolls and replacement fees.

The design could also allow for other types of mischief. For instance, a person could carry out an "alibi attack" by writing his ID to someone else's device. When that person crossed a toll bridge, FasTrak records would show it was the attacker, not the victim, who took the trip, allowing the attacker to create a false alibi.

Lawson carried out his research by dissecting two transponders. Older models allowed him to easily access the firmware and all the data it stores. Newer models contain a "lockbit" that prevents access to the firmware, but with the help of fellow researcher Chris Tarnovsky, Lawson was also able to circumvent the measure.

So far, Lawson has had trouble getting the agencies that use FasTrak to respond to his research. He has not yet contacted Sirit Technologies, the manufacturer of the transponder. ®

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.