Virtual security appliances — because the vendor who can’t be bothered to package their software to work with multiple OS versions is completely trustworthy to throw in an arbitrary version of Linux, harden it, and keep it up-to-date also.
Chris Hoff has written a nice series of posts about this trend. The approach of sticking servers from multiple trust domains on the same SAN is a lot like installing a firewall, then tunneling all your apps over http. Won’t we ever learn?
While riding my bike, I saw the this board in the street. It looked like a Fastrak transponder so I picked it up.
There are a couple interesting notes. The board is labeled “TIRIS” (Texas Instruments RFID Systems), which explains the new company name, “SIRIT”.
In the older model, they used a custom Atmel chip instead of the TI MSP430 now in use. They probably moved to the MSP430 to save money. There are significantly less analog parts on the older design, which means more of the demodulation may have been done on the custom chip. There are two clock crystals instead of one. The buzzer was attached with external wires, not traces.
You can see a teardown of this same model but in nicer shape here. It looks like the 0006 model was both a cost reduction and generalization of the 0004 model. It would be interesting to look at the firmware of the Atmel microcontroller and see how it differs.
When I find a functional bug in an application, I think it’s useful to post the solution for others to find. Here are two recent problems I solved.
Thunderbird allows you to switch SMTP servers. However, sometimes it appeared like the setting change wasn’t taking effect. While I’d change the server, some mail would still use the old setting and some would use the new. Even plug-ins designed to help with this didn’t work reliably.
I tracked this down to the Identities feature. It allows you to set up different identities (email addresses) under a single account. This means that with two identities, there are actually three different places the SMTP server and other information is set. The global account settings panel (Tools -> Account Settings -> Outgoing Server (SMTP)) and all identities (… -> Manage Identities -> Edit each profile) need to be changed in order to switch servers. While I agree that some things make sense to make local to an identity (e.g., signature file), SMTP server should only be a per-account setting.
I like using cygwin on Windows for a somewhat reasonable Unix-like environment. There are two shells that can be used: bash and rxvt. The bash shell runs within a Windows command prompt instance, and inherits the same annoyances from there. Text selection works differently, there is no real terminal emulation, and scrollback is not reliable. I switched to rxvt to fix a lot of those problems, but had to keep bash around for one reason. When I tried to run Windows python from rxvt, it would just hang during startup. The cygwin python worked fine.
It turns out that the rxvt code allocates a pty. You can see this by typing “tty” in both bash and rxvt. The former reports “/dev/console” and the latter, something like “/dev/tty1″. I believe the reason is that Windows consoles (and thus bash) actually use a separate API for working with the user. Thus, Windows python calls to that API hang if the shell isn’t actually running in the console.
This is similar to an experience I had trying to do asynchronous IO with a Windows console. I had written a small serial port comms tool that would work interactively, printing output when the device generated it and accepting input from the user. It worked fine until the user started typing, then the input routine would block. Nothing worked with it, not WFMO, setting asynchronous mode on the stdin handle and polling, or even threads. A read from the console blocks all process execution, including all the process’s threads, until the input is completed.
I hope this helps you if you encounter similar problems.
The next Baysec meeting is tomorrow at Pete’s Tavern. Come out and meet fellow security people from all over the Bay Area. As always, this is not a sponsored meeting, there is no agenda or speakers, and no RSVP is needed. Thanks go to Ryan Russell for planning all this.
See you tomorrow, August 14th, 7-11 pm.
Pete’s Tavern
128 King St. (at 2nd)
San Francisco
Here are the slides from my FasTrak talk and a short summary of my findings. I’m hoping what I’ve found can help officials improve the security and privacy of these systems.
FasTrak and related toll collection systems have been around since the mid-90′s. I started looking at them because I had never signed up due to privacy concerns. However, while the underlying Title 21 standard is public, I couldn’t find any details about the internal workings of the system or any security measures. I bought a few transponders and took them apart to find out.
Besides support for the standard messages, I found no encryption. So it’s easy for an attacker to use a simple RFID reader to collect transponder IDs from cars in a parking lot, then replay them to bill tolls to the real owners. By only using each stolen ID once, it would be difficult to track them down.
Even more surprising, I found support for a lot of proprietary messages that go far beyond toll collection. By sending a few packets, an attacker can activate a hidden “update mode” that allows the ID to be wiped or overwritten with a different one. This goes against claims that the transponder is “read-only” and “there is no memory to write anything to”.
The ability to clone and/or overwrite IDs over-the-air calls into question the admissibility of FasTrak logs as evidence. They get regular subpoenas for these logs, and I wonder how many innocent people were convicted based on the claimed reliability of this system. A non-technical attack is to steal a transponder from the victim and surrepititiously plant it in someone else’s car, creating fraudulent evidence that the victim was somewhere they were not.
Also, the 511.org service creates a massive collection of data, logging every section of freeway traveled by each car that has a transponder. FasTrak has told a reporter (story) that this data is discarded after 24 hours but I can find no written evidence of this. Since all this system does is generate statistics of average travel times, it could be significantly reduced from its current form. Instead of querying and logging all cars, it could randomly sample cars so only 1 out of every 100 were used. Each record could be discarded after 10 minutes or so since the readers are located approximately at each freeway exit. A car that was logged at one sign but not the next probably exited.
This updated system would still achieve the stated goals while reducing the chances for a privacy compromise. It also would only require changing the server software, not the readers or transponders.
I’m working on an add-on “privacy kit” to retrofit transponders. It consists of a timer circuit and activation button, similar to a garage door opener. It keeps the transponder powered off except for a minute or so after the user presses the button. This protects the user from privacy exposure (except while paying tolls) and cloning or overwrite attacks. The downside is it would require technical skills to attach to the transponder. However, newer models are coming out that have an open battery bay, making it easy to add this privacy kit.
I hope to release schematics free of charge and create a kit that would be available at no profit to myself. Hopefully this will convince transponder vendors to add an opt-out capability into future designs.
Transit agencies interested in more details on my research can contact me here.
FasTrak transponder and IO tap board
I haven’t revealed all the details yet about my Blackhat talk on RFID toll pass security. One reason was I hoped to speak with Bay Area transit officials to alert them beforehand. The other reason is that I’ve still been analyzing the potential impact of the flaws I found.
Well, the results are in and it’s pretty serious. I’m reasonably certain an attacker can send a couple messages to a FasTrak transponder and wipe its internal ID. Also, the ID can be overwritten with a different one. There is a population of at least 1 million of these vulnerable transponders in California, sold over the past 15 years. They conduct 50 million transactions per year on Bay Area bridges. This does not include their use on southern California toll roads.
I think this is a big deal. If anyone reading this is responsible for engineering at FasTrak, please contact me. The messages I’ve sent via your website haven’t worked. Thanks.
Theme: Rubric. Blog at WordPress.com.
