blog Forget Black Hat in Las Vegas. Australia’s Ruxcon is where it’s at, complete with public transport ticketing hacks and shadow figures involved in advanced network security exercises. SC Magazine reports from the sidelines of the conference over the weekend, where a number of Australian students demonstrated how they had hacked an un-named public transport ticketing system. The publication reports (we recommend you click here for the full article):

“An Australian state public transport system has been cracked by a group of security researchers who were able to replicate cards to enable free travel.”

The Ruxcon precis of the group’s speech (they describe themselves under the team name ‘Trainhack’) states: “This talk will look at different techniques used in black-box reverse engineering of data storage formats, focusing on a case study of an outdated mass transit ticketing system which employed custom cryptography.”

Trainhack describes itself as “a group of security hobbyists currently studying computer science” … who enjoy “sunsets, French films, and coding in dark rooms while listening to repetitive electronic music”. Sounds like the ideal renaissance geek lifestyle partner. One only hopes that the public transport organisation with the weak security has patched its holes following the responsible disclosure of this issue. And that Trainhack stays out of the hands of law enforcement so that it can enjoy the odd Jean-Pierre Jeunet.

Image credit: Benjamin Diehl, royalty free

Tweet

1. Marcus
   Posted 22/10/2012 at 5:15 pm | Permalink | Reply

   !Surprise!

   ..
   not.

2. Michael Wyres
   Posted 22/10/2012 at 6:13 pm | Permalink | Reply

   I bet it’s Myki.

   It’s broken in every imaginable way, so it shouldn’t be too hard to hack.

   *grin*

   • Tom
     Posted 22/10/2012 at 11:41 pm | Permalink | Reply

     I bet it’s Myki.

     I was going to go with Sydney’s public transport system…

     but then I realised that we don’t have anything to crack :|

     • Tom
       Posted 22/10/2012 at 11:49 pm | Permalink | Reply

       A quick glance at the presentation slides says the offending system uses Magnetic stripe tickets. Maybe it is ShityRail after all :(

3. Steve Hodgkinson, Research Director IT Asia/Pacific, Ovum
   Posted 22/10/2012 at 9:43 pm | Permalink | Reply

   First prize for anyone who can hack into the Myki system and change the “CSC Pass” message which displays when a card is read at the entry gates to something rather more friendly like … maybe … “welcome” … or something. Seriously … “CSC Pass”? I realise this is probably not high on the priority list of the Myki team, but really. After all these years we have to put up with a message that looks like it was part of a pre-production system testing protocol. Like … is anybody awake at Myki?

4. Paul Maynard
   Posted 23/10/2012 at 4:10 pm | Permalink | Reply

   What;s the point in hacking a ticket for a system that isn’t fully gated and there’s no way of ensuring people are even buying the correct ticket and not abusing concessions unless they are physically caught with the wrong or no ticket? It’s a technical skite of little real value.

• • Topic
  • Voices
  • Posts
  • Freshness
• • Malcolm Turnbull, Time Traveller

    Started by:  quink in: Everything else

  • 2
  • 4
  • 2 days ago

     Karl

  • Article on 'Ultraviolet'

    Started by:  ray73864 in: Everything else

  • 2
  • 2
  • 4 days, 20 hours ago

     Karl

  • Surface sells out … of its tiny amount of stock?

    Started by:  Renai LeMay in: Gadgets

  • 4
  • 4
  • 5 days, 22 hours ago

     douglasrose

  • Coalition fraudband plan summary…

    Started by:  Hubert Cumberdale in: National Broadband Network

  • 4
  • 4
  • 1 week, 4 days ago

     JamesH1

  • NBN Is A Question Of Reliability

    Started by:  JamesH1 in: National Broadband Network

  • 1
  • 1
  • 1 week, 4 days ago

     JamesH1

  • Renai asked:

    Started by:  Tinman_au in: National Broadband Network

  • 1
  • 1
  • 1 week, 4 days ago

     Tinman_au

  • What Happened to Whirlpool posts

    Started by:  MikeK101 in: Everything else

  • 2
  • 2
  • 3 weeks, 3 days ago

     Bob.H

  • Conroy/Turnbull NBN Debate Next Week

    Started by:  zephram in: National Broadband Network

  • 1
  • 1
  • 3 weeks, 4 days ago

     zephram

  • Blocked from posting? Let me know

    Started by:  Renai LeMay in: Everything else

  • 2
  • 2
  • 3 weeks, 6 days ago

     Abel Adamski

  • Falsehoods of the day

    Started by:  Karl in: National Broadband Network

  • 4
  • 5
  • 1 month, 1 week ago

     Anonymous

  • Is IBM selling its Network Services Division to Telstra?

    Started by:  Renai LeMay in: Everything else

  • 1
  • 1
  • 1 month, 2 weeks ago

     Renai LeMay

  • 10 Terabit NBN plan? Yes please :)

    Started by:  daniel996 in: National Broadband Network

  • 2
  • 2
  • 1 month, 2 weeks ago

     Karl

  • Renai (or anyone else?): List of working tags?

    Started by:  Tinman_au in: Everything else

  • 3
  • 6
  • 1 month, 4 weeks ago

     midspace

  • Receiving spam from "OEMSoftware Newsletter"?

    Started by:  Renai LeMay in: Everything else

  • 4
  • 4
  • 1 month, 4 weeks ago

     midspace

  • A brief update on banned users

    Started by:  Renai LeMay in: Everything else

  • 6
  • 9
  • 2 months ago

     Autocrat

•