While reading the tech news last week, I found an interesting article here which talked about UltraReset. Coded up by a duo from the Intrepidus Group, UltraReset is app which allows users to take free rides on the metro in major cities like Seattle, Boston, San Francisco, and more. The app exploits a security flaw which allows users to refill their pay cards for free when their empty their current ride balance. UltraReset is able to do this by taking advantage of a flaw in the metro systems. As a reporter writes here, the problem with the metro systems were ‘not a matter of bad technology but of proper implementation.’ The cards have a security feature built in that can prevent attacks like UltraReset, where bits in the card are set to indicate that rides have been used. However, in the systems where UltraReset is successful, the metro systems never set these bits when the user scans their card, subsequently allowing malicious systems to edit the number of rides remaining on the card.
UltraReset, in particular, is an interesting hack because of its implications. NFC is becoming more and more common on smartphones, and its uses are extending beyond just metro fares. With popular services like Google Wallet using NFC, exploits to the systems behind NFC effects are growing. While UltraReset only allows users to get free rides on the metro, a hack to larger NFC systems like Google Wallet could mean more significant problems like bankruptcy or identity fraud. UltraReset is also an interesting hack in how simple it was. While the app is not available to the public, the creator said that anyone with a basic understanding of writing to the NFC chip and coding would be able to write a similar app in a night. NFC hacking is definitely a field that needs more exploration, as the consequences of an exploitation can be huge while the actual implementations of those exploits are very easy to construct.
References:
http://gizmodo.com/5945669/some-nfc-hackers-managed-to-develop-a-free-train-ride-app
http://phys.org/news/2012-09-fare-hacker-app-resets-subway.html