SecurityTube

Security experts hack and refresh US transit cards with Android app

JB

Two researchers have created an Android app that they say can re-program certain NFC-enabled travel-cards, such as those used in the San Francisco Muni and New Jersey PATH transit system.

The researchers, Corey Benninger and Max Sobell of the Intrepidus Group, showed off the tool on Thursday at the EUSecWest security conference in Amsterdam. The flaw they were exploiting can be found in paper-electronic tickets — designed for one-off or limited use — that use a MiFare Ultralight NFC chip from NXP Semiconductors.

The exploit allows the app's users to revert such a ticket to its original state. If the card had been used for all the originally-loaded 10 trips, for example, the hack would make it seem as though the card was freshly bought and fully loade