by Marie Szaniszlo, Boston Herald

3/6/08 - New research by a University of Virginia graduate student shows that “smart cards” like the CharlieCard may be vulnerable to cyber thieves, who potentially could steal fares or sell counterfeits.

The incentive for theft could increase if state officials proceed with plans to allow commuters to use a CharlieCard not only to ride the T, but also to pay Mass Pike tolls and access government-run parking facilities, with funds being automatically withdrawn from their bank account.

“These cards might have been OK years ago, when computers were much slower. But for about $1 more per card, the companies and agencies that buy these cards can get more secure ones,” said Karsten Nohl, 26, a UVA Ph.D. candidate in computer engineering who announced his findings at an annual convention of hackers, in Berlin.

Nohl claims that he and two partners, using equipment that cost less than $1,000, dismantled a microchip used in a smart card and mapped out its secret security algorithm. By running the formula through a computer program, they broke the encryption, he claims.

Karsten says his intent is solely to warn commuters about the possibility that an ID thief sitting next to them on the subway could hack into their smart card within minutes, using a laptop and a reader that can be purchased on the Internet for about $150.

Joe Pesaturo, an MBTA spokesman, yesterday said: “It is MBTA policy not to discuss the security measures around its smart card technology. If this group is well intentioned and has information it wants to share with the MBTA, then MBTA staff would be happy to review the information.”

A spokesman for NXP, the maker of the microchip Kasten and his colleagues claim to have breached, said the hackers obtained only a portion of the cryptographic algorithm.

“We constantly improve and review our products to make sure it’s up to snuff with the latest security threats,” Manuel Albers said.

Article URL