FasTrak/EZ-Pass EToll Transponders Hacked

Richard Chen
by Richard Chen

CNet News reports a FasTrak/EZPass exploit from the Black Hat security conference in Las Vegas. Millions of older transponders in use have unencrypted RFID chips, allowing a malicious individual to steal ID's and use those accounts to get free tolls using a "cloned" transponder. Transponders can also be reprogrammed on the fly, wreaking all sorts of havoc down at Billing Central. Also, an "electronic alibi" could be created that could have a miscreant listed in the system has having paid a toll at a particular place and time when they were elsewhere. Newer transponders do have some security to prevent reprogramming, although this was also defeated. The hacker involved suggests inserting a switch to the keep the transponder from automatically activating, the less convenient alternative being the bag the unit came in or an aluminum foil wrap.

Richard Chen
Richard Chen

More by Richard Chen

Join the conversation
4 of 17 comments
  • R H R H on Aug 08, 2008

    mdf> I don't think it's a financial thing. We pay for our ipass transponders. If you DON'T have one, you pay double toll usually. So even if it was $100 instead of $20, you'd still make it back in tolls saved.

  • RFortier1796 RFortier1796 on Aug 08, 2008

    So I just went over to that Black Hat site to get at least an idea of what it was. Now, I don't advocate a police state or thought crime or any of this case, couldn't we make an exception? Around here, we have TollTags, but it doesn't matter. As someone posted above, if you have a plate registered to a Tag, even if you don't have one and go through the toll, they just send you an "administrative fee" around 50 cents.

  • Mdf Mdf on Aug 08, 2008

    Robstar: We pay for our ipass transponders. I guess I should also have noted I am not an EZ-Pass customer. But this business of buying the transponders is variable: (see table near end of article). For the 407 "ETR" (where I am also not a customer): you rent the road, you rent the transponder, you rent the administrators while you rent the transponder while renting the road, and you probably rent the air you breath, while perhaps being simply charged for the CO2 you exhale, while you rent the road, renting the transponder, carefully managed by the rented administrators. RFortier1796: Now, I don’t advocate a police state or thought crime or any of that…but…in this case, couldn’t we make an exception? No.

  • ZoomZoom ZoomZoom on Aug 08, 2008

    This news story is just going to be more fodder fot the bureaucrats, taxers, big-brothers, and pro-big-government types who want to use GPS to figure out where we have been and charge us for road use based on that. Or the others who want to inspect all of our odometers and charge us on miles driven, over and above all of the gas taxes we've paid. We'll know they're serious when we begin hearing them make noises about putting GPS on scooters and bicycles, too.