Public transit can be both a blessing and a curse. It gets you where you need to go, but only pulsating herd of other coughing, sneezing humans. But maybe that wouldn’t seem so bad if you didn’t have to pay for it. There’s an app for that.
Corey Benninger and Max Sobell, from the Intrepidus Group have developed an app called UltraReset which takes advantage of NFC vulnerabilities in the systems used by many public transit systems, including the New Jersey Path and San Francisco Muni trains where it was tested effectively. Using any Android phone with NFC capabilities and 2.3 or later, the UltraReset app can take a train card with zero rides, and refill it repeatedly, for free. Get ready to do some traveling, right?
This isn’t the result of some inherent flaw with NFC, but rather due to the fact that the transit systems tested just didn’t activate security measures to lock down the read/write permissions effectively. While it was only tested in San Fransisco and New Jersey, transit systems in Boston, Seattle, Salt Lake City, Chicago, and Philadelphia could be vulnerable as well. The pair recently showcased the app at a security conference in Amsterdam, and it’s worth noting that the exploit seems to still be effective, even though authorities were warned in December of 2011.
Obviously (and unfortunately, depending on what kind of person you are) the app isn’t available to the public, and wide should make fixing the problem a bigger priority. Until then, though, hackers ride free. [PhysOrg]
