FasTrak/EZ-Pass EToll Transponders Hacked
CNet News reports a FasTrak/EZPass exploit from the Black Hat security conference in Las Vegas. Millions of older transponders in use have unencrypted RFID chips, allowing a malicious individual to steal ID's and use those accounts to get free tolls using a "cloned" transponder. Transponders can also be reprogrammed on the fly, wreaking all sorts of havoc down at Billing Central. Also, an "electronic alibi" could be created that could have a miscreant listed in the system has having paid a toll at a particular place and time when they were elsewhere. Newer transponders do have some security to prevent reprogramming, although this was also defeated. The hacker involved suggests inserting a switch to the keep the transponder from automatically activating, the less convenient alternative being the bag the unit came in or an aluminum foil wrap.
More by Richard Chen
Comments
Join the conversation
mdf> I don't think it's a financial thing. We pay for our ipass transponders. If you DON'T have one, you pay double toll usually. So even if it was $100 instead of $20, you'd still make it back in tolls saved.
So I just went over to that Black Hat site to get at least an idea of what it was. Now, I don't advocate a police state or thought crime or any of that...but...in this case, couldn't we make an exception? Around here, we have TollTags, but it doesn't matter. As someone posted above, if you have a plate registered to a Tag, even if you don't have one and go through the toll, they just send you an "administrative fee" around 50 cents.
Robstar: We pay for our ipass transponders. I guess I should also have noted I am not an EZ-Pass customer. But this business of buying the transponders is variable: http://en.wikipedia.org/wiki/EZ-Pass (see table near end of article). For the 407 "ETR" (where I am also not a customer): http://en.wikipedia.org/wiki/407_ETR you rent the road, you rent the transponder, you rent the administrators while you rent the transponder while renting the road, and you probably rent the air you breath, while perhaps being simply charged for the CO2 you exhale, while you rent the road, renting the transponder, carefully managed by the rented administrators. RFortier1796: Now, I don’t advocate a police state or thought crime or any of that…but…in this case, couldn’t we make an exception? No.
This news story is just going to be more fodder fot the bureaucrats, taxers, big-brothers, and pro-big-government types who want to use GPS to figure out where we have been and charge us for road use based on that. Or the others who want to inspect all of our odometers and charge us on miles driven, over and above all of the gas taxes we've paid. We'll know they're serious when we begin hearing them make noises about putting GPS on scooters and bicycles, too.