The MBTA installed a fancy electronic transit fare collection system here in Boston for the subway and buses. It works exactly the same as the old token-based system, a fixed price for a ride of any length and at any time of day. The only difference that I noticed was that the cost of the collection system was so high that they had to raise the price from $1.25 per ride to $2 per ride.
Now it seems that there are some additional costs. Some MIT kids figured out how to crack the system and were going to present this embarrassing information at a conference. The MBTA had to hire lawyers and sue the MIT students in federal court to block the presentation. The taxpayers had to pay a judge to listen to the various lawyers argue.
i bet the new system is not vulnerable to token suckers!
Over at Bruce Schneier’s blog, you learn that the fare collection system is based on a chip called the “Mifare Classic”, that is in use on a number of different subway systems across the world. And it’s made by Philips, who believe in security through obscurity.
I am not sure of the practical implications of breaking a subway fare collection system. Would any sane person risk arrest to save a couple bucks? Of far greater concern is that this is also used in access control. Now imagine, if some random no-gooder wanted to access the nearby school/university/federal building that still had Mifare Classic in its systems. That’s a lot more scary. Especially when you consider that the bad guys have become a lot more tech-savvy of late.