"Un-fare Advantage” - Hacking The MBTA CharlieCard From 2008 To Present
summary
Claims a phone plus cheap gear can: repeatedly refill a CharlieCard without paying, get replacement cards mailed without payment, provision new paid cards, and steal a card with a single physical tap. Proof uses an Android phone and Flipper Zero, the leaked 32 keys from Git repos, and the My Fair Classic tool Android app to snapshot and restore card state or clone to Gen‑2 clone cards. Experiments succeed, a free ride is demonstrated, and MBTA deploys monitoring and partial mitigations; fraud estimates rise into the hundreds.
AI-written summary · about
chapters (24)
- 0:00Intro
- 1:12What's the MBTA/Charlie Card?
- 2:49CharlieCard - 2008-Court Filing
- 4:21CharlieCard - 2016
- 7:56Flipper Zero - 2022
- 8:55Mifare Classic Card Dump
- 9:44Flipper Zero - Card Dump
- 10:03Flipper Zero Firmware
- 10:55Working Backwards
- 12:48Mifare Classic Toolkit
- 14:39Where's the Value?
- 15:18MBTA - Retail Sales Locations
- 16:47Need for Stored Value
- 20:04Lost Card
- 20:38Gen 2 Cards
- 21:05Gen2 Cards
- 22:09Rewriting a CharlieCard Snapshot
- 22:59Covert Disguise
- 24:41Vulnerability Disclosure
- 26:55Potential PR Nightmare?
- 28:44Harvard to the Rescue
- 30:33Suggested Remediations
- 31:32Actual Remediations
- 32:40Closing Thoughts
related talks
23mAll Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems
24mPicking Up My Tab...
38mMission mPOSsible
19mSamsung Pay: Tokenized Numbers Flaws and Issues
42mShuffle Up and Deal: Analyzing the Security of Automated Card Shufflers
33mHacking Next-Gen ATMs: From Capture to Cashout
07mI just hacked your app!
24mRecent Mobile App Security Incidents from Real-World Cases