Hacking Electronic Toll Systems CNet (08/06/08) Mills, Elinor
as it appeared in the August 8, 2008 edition of ACM TechNews.
Attendees of the Black Hat 2008 security conference in Las Vegas were told that anyone with the right transponder reader could easily hack into the transponders used by drivers subscribing to electronic toll systems such as FasTrak and E-ZPass. Armed with the readers, hackers could steal unencrypted identification numbers off transponders, put the data onto their devices, and then stick the victim with the bill as they pass through tolls for free. Worse, data could be switched from a transponder installed in a vehicle used in a crime, thus providing the driver with an alibi. And while the identification number is not personally identifiable, it can be used to access customer information--including names, driver's license numbers, and credit card numbers--through the back-end database. Nate Lawson, a security expert at security consultancy Root Labs who warned of the vulnerability at Black Hat, is designing a privacy kit for the FasTrak system used in the San Francisco Bay Area that will allow users to put a "kill switch" on a transponder, thus making it unreadable until it is turned on with a special button. Click Here to View Full Article
