Feeds

The Boston Trio and the MBTA

How the transport bods silenced security researchers

Protecting against web application threats using SSL

The annual DEFCON conference in Las Vegas in early August got a bit more interesting than usual when three graduate students from the Massachusetts Institute of Technology were enjoined from giving a presentation by a court in Boston.

The three - Zach Anderson, RJ Ryan and Alessandro Chiesa - intended to present both a paper and slides to the assembled masses of hackers explaining certain configuration issues with respect to the Massachusetts Bay Transportation Authority (MBTA) fare card system for riding the Boston subway system. The fare card system, or Fare Media system, used stored value cards, known as CharlieCards, after a locally famous song by the Kingston Trio called Charlie on the MTA.

Let me tell you the story
Of some boys from MIT
On a tragic and fateful day
They put out some information
Kissed their career and reputation
And took for ride the MTA

The cards were subject to various cloning attacks, which would permit both sophisticated and unsophisticated hackers to create duplicate CharlieCards, and therefore evade payment for subway rides.

Needless to say, when the lawyers for the MBTA learned of the DEFCON presentation, they were not amused. While there are disputes about who contacted whom first, and precisely what information was going to be disclosed or not disclosed at the presentation, ultimately the MBTA went to court in Boston and obtained a temporary restraining order (TRO) preventing the release of certain information about the vulnerabilities. The TRO was eventually reversed by the court, but not until the trio was denied the opportunity to make their presentation. Of course, in keeping with the Streisand effect, where attempts to censor content merely draws attention to it, both the slides and the paper to be presented were widely disseminated in advance of the TRO.

Much of the debate over the TRO has focused on the prior restraint on free speech aspects of the case. However, more important to security researchers are the questions of responsible or irresponsible disclosure of security vulnerabilities, and potential civil or criminal liability for doing so.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.