There was a lot of doom and gloom at BlackHat this year, but my favorite presentation was the one just picked up by the ACLU of Northern California
Researcher Nate Lawson has discovered that FasTrak transponders are vulnerable to sniffing, cloning, and surreptitious tracking of a driver’s comings and goings.
That is because the systems have no encryption or other technological protection measures to ensure that the information is not read by unauthorized readers or copied and cloned for misuse. Without protections, it is not just those toll booth and freeway sign readers that can track who you are and where you are going, but also that homegrown sniffer that Lawson plans to put up to collect information.
Lawson is amazed that “there has not already been widespread fraud, cloning, and selling of ‘free transponders’ that” were hacked and reprogrammed, he says. “There’s nothing there technically to prevent it.”
What he meant to say, I think, is that the system was not designed to prevent it today. However, an important point to his research is that the transponders also allow an attacker to WRITE data to them. This actually would allow the system to prevent abuse, should new/fixed code be installed with authentication capabilities.
Thus, something COULD be done to prevent and fix a number of flaws. The question is whether they will be done. In the meantime, you can not only sniff IDs and track people by the FasTrack system, but you can mix and install IDs as you please.
Hacking this system is actually not news, as Lawson suggests in the fact that he is buying transponders off the grey/black market. The officials surely watch this as well. They usually monitor some degree of abuse. Lawson is just the guy who wants credit for writing up his “research” and wants to be in the press for announcing the flaws, as opposed to building himself and his friends/family a free ride or making some pocket change for selling transponders.
In a similar case, Barbadians have harshly criticized the researcher who recently claimed to have “discovered” a snake on their island:
“If he needs to blow his own trumpet … well, fine,” said 43-year-old Barbadian Charles Atkins. “But my mother, who was a simple housewife, she showed me the snake when I was a child.”
One writer to the Barbados Free Press blog took an even tougher tone, questioning how someone could “discover” a snake long known to locals, who called it the thread snake.
At least Lawson did not try to rename FasTrack.