Infinite Money Glitch: Hacking Transit Cards
Four high school researchers reverse engineer Boston's CharlieCard RFID fare system, uncovering cryptographic flaws and building a portable fare machine.
Summary
Reverse Engineering Legacy Transit Smartcards
Municipal public transit systems rely on contactless RFID smartcards to store value and process turnstile entries, but many legacy implementations use outdated cryptographic architectures.
Analyzing Boston's CharlieCard Architecture
Four high school security researchers dissect the hardware and proprietary memory structure of the Massachusetts Bay Transportation Authority (MBTA) CharlieCard system, exploring legacy MIFARE card structures.
Building Custom Emulation and Portable Fare Tools
By intercepting card-reader exchanges and decoding stored balance blocks, the team developed custom hardware emulators and a portable fare modification device.
Responsible Disclosure to Government Agencies
The speakers recount their experience responsibly disclosing the vulnerabilities to the transit authority, sharing lessons for student researchers navigating vulnerability disclosure.
Related talks
Main Stage·42 min
Lennert Wouters · Ian Carroll
Cryptographic and implementation vulnerabilities in Saflok RFID hotel lock systems affecting millions of doors worldwide.
Main Stage·21 min
Eric Sesterhenn
Eric Sesterhenn presents in soviet russia smartcard hacks you: The classic spy movie hacking sequence: The spy inserts a magic smartcard provided by the agency technicians into the enemy's computer, ...the screen un...
Creator Stage·23 min
Tim Clevenger
Provides practical engineering best practices for deploying physical access control systems, covering supervised wiring, tamper resistance, and badge encryption.