Transportation Hack 2.0: Flaw Found Calif.'s FasTrak System

http://blogs.pcworld.com/staffblog/archives/007585.html

by acesamped • 18 years ago

11 14 18 years ago

blogs.pcworld.com

The lack of encryption in these things is just astonishing. Sure, encryption isn't a magic bullet, but it's the first line of defense, and most programming languages make it so damn easy to use.

jonnytran• 18 years ago

Yeah. The fact that these things are being found -- things that deal with people's actual money -- indicates just how incompetent the average ITer is when it comes to security.

I wonder how long hackers have been exploiting these things _without_ announcing them.

tptacek6• 18 years ago

Somehow, I'm guessing they're not running a JVM on an TI MSP4xx microcontroller. It's actually not damn easy to get encryption working on controller boards.

What's more, for many of these kinds of systems, encryption that is anything more than a speed bump is very hard to get right, because of key management and round trip limits.

hhm3• 18 years ago

Even in a controller card, it's very easy to at least do some Caesar cipher or anything simple like that. They could even do something a little more complex without much troble.

maximilian• 18 years ago

A lot of controllers have builtin encryption hardware. If you put encryption in the original spec, its not that hard to include.

Transportation Hack 2.0: Flaw Found Calif.'s FasTrak System

Related Stories