Judge refuses to lift order squelching students' subway card hack A federal judge has refused to strike down an order gagging three Massachusetts Institute of Technology undergraduates from discussing gaping security holes in electronic payment systems used by Boston's transit agency. US District Judge George A. O'Toole Jr. let a previous order stand, despite arguments from Electronic …
IMHO, Massachusetts Bay Transit Authority's tactic is to use the Digital protection act in their favor to totally destroy the MIT students' lives financially and from the business/employment standpoint, by demonstrating how evil they are. That is why they are demanding all documentation and code. MBTA is going to use the students to set an example for future students and hackers not to repeat this "intrusion."
Personally, I believe their tactic will backfire. I just not sure how...
Foreign countries, for example.
"Your honor, I can't control what others do with my work, especially if it is in a foreign country".
Of course, adding full details, like the checksum algorithm to increase the fare, and maybe kits for sale. Software to be added later with a download. Let the judge reach out over the ocean to quash THAT!
I can almost guarantee a retalittory attack by the underground community by ensuring that a simple "Click to Add Credit" application for the cards will be released shortly - ensuring that the masses all rip-off the transport system.
If they'd let these guys speak at Defcon then they'd be in a better position now. The cards they're using are so flawed it's unbelievable - by keeping people in the dark all they're doing is burying their head in the sand....
This post has been deleted by its author
If MBTA has any smarts at all they should dropp this case and hire these students to FIX the broken system.
IT WILL BACKFIRE:
This case wont get to trial and if it does ALL the information will become "Public Record" and do more damage to MBTA in the long run. With keys left in unlocked boxes, unattended security booth to documents left in public view MBTA will have more questions to answer than these students ever will.
This will hardly destroy any MIT students ability of anything in the future nor does it show how evil they are. In fact it shows how smart they are and being MIT students, will enhance the choices of employment in the future.
"...destroy the MIT students' lives financially and from the business/employment standpoint, by demonstrating how evil they are. That is why they are demanding all documentation and code. MBTA is going to use the students to set an example for future students and hackers..."
I would put money on the fact that MBTA will try to use the documents and code to fix the problems however if the students and EFF go all the way on this issue, they will FORBID MBTA to use the documents and code. YES they can do that and claim copyright on docs and code ( the documents I have show a copyright on them) thus legally claim damages for a real crime.
they should not be permitted access to the documents, the court should seal them. MBTA can pay a security professional to secure there system like they should have done in the first place! In fact no its MBTA's problem full stop. free speech should be permitted. as long as they dont use the hack there is no crime. this is not minority report!
'But the Emperor has got no clothes' said the young boy.
'Right that's it - I am arresting you for pointing out how incredibly stupid the Emperer has been' said the palace guard.
And no-one ever pointed out that the emporer had no clothes on again. They just laughed about what a complete idiot he was behind his back. The end.
A gentleman above stated that in Europe that something like this is handled differently and an individual is obligated to bring forward their results. I totally agree with that mentality.
So I just read and downloaded the publicly available court documents in PDF. I wish to thank the MBTA for allowing me to read how to defraud their subway system online as well as drawing my attention to this via this very public court case. I mean I am in Toronto Canada I would not of hear this story otherwise. So now I know how to get free rides when I go to Boston. Since I know that your actions here clearly indicate you have no interest in fixing the security issues at hand.
As any business should pay for work completed. I believe the MBTA should be paying the MIT students for the code they wish to have a copy of. At the very least claim copyright to your own code and charge a licensing fee. I know a lot of people reading this think it is nuts what I am saying but these students put a lot of time and effort into their work. Not Only did they find out all of the details on what was wrong they even approached the MBTA and told them all of their findings and tried to help. Worse case scenario I suggest building a patenting a fix for the security holes found and begin to pitch this fix to the bulk of the major cities who are also using this same system. The research papers professionalism combined with this professors reputation and this public court case will most likely have at least one or more of the cities signing a contract with them.
Paris because at least she knows when to close her legs and hang her head in shame...unlike the MBTA.
This post has been deleted by its author
Yet more proof, if any were needed, of how low our educational systems are slipping. University used to be about teaching students how to think for themselves, and make rational judgements about scenarios that they had not (yet) read about in textbooks.
So: these guys found out something interesting, and the first thing they thought was "Cool! lets brag to everyone that will listen about how to get free rides for life" (I'm para-phrasing, but only slightly.) What the hell did they think would happen next??
The Dutch (or was it Belgian) researchers that discovered a similar flaw had a very hard time of things, and they were far more professional / academic about their findings.
Twats like these guys are the ones who are truly responsible for the ever increasing number of stupid laws we have. It is journo's jobs to report, it is politicians job to make new laws, and it students jobs to learn and stay out of trouble!
Does anyone know if they have presented the exploit to the MBTA? Have the MBTA been given any time to resolve the issue? How expensive will it be and how long will it take to fix?
I fully accept that they should be able to publish, but as the recent DNS weakness has been handled, allow people/companies who could be at risk of attacks to fix the problem (within reasnoble time limits) before you publish. Just going straight out and letting everyone know how to exploit a weakness is irresponsible.
Ummm what?! It's "twats" like you and those that will never advance science or society with that mentality.
Case in point examples:
-Galileo: Heliocentrism
-Leo da Vinci: concepts of flight
-Heisenberg
-Einstein
blah blah blah; there have been hundreds of brilliant, geniuses that have spent their lives learning and causing trouble because their beliefs (ie, now confirmed science) were controversial and/or heretical at the time.
From all the hackers that were exploiting this and expecting it to be shut down!
Now that the court has squashed publisizing the flaw, they can continue quietly hacking the system.
(What? you surely didn't think that the first ones to publicly talk about it were the first ones to find it, did you?)
This sounds to me like a few of the "higher-up" transit employees are trying to cover their own asses (not that they could have prevented an exploit). But would Massachusetts government employees really go through all this legal action to discredit others in order to save face?
Well, yes.
Let's not forget the Boston area "Lite-Brite / Improvised Explosive Device" scare when the city flipped out over a few signs placed in areas with high foot traffic and on some bridges.
If you don't remember, an advertising company, contracted by Cartoon Network's daughter network [adult swim] to place several light up signs in Boston that had a "home made" appearance.
After the signs had been in place for a few WEEKS, Boston officials finally acted, by making arrests, and stating that the signs "...had all the components of an improvised explosive device, except the explosive..." (so does a clock radio).
So this major fowl up illustrated one of two things, Bostonian law enforcement are unable to identify I.E.D.s (if these signs did not resemble bombs), or that actual bombs could, in fact, be placed in Boston for weeks without detection (if the signs did resemble bombs).
So, yes, in Massachusetts, the city and other local governments will censor your Freedom of Speech if it makes them look ignorant.
But I think everything could be worked out if everyone would just get together and discuss it. Maybe over a cup of tea? It could be like a party. In Boston. They could call it The Boston Tea... Oh wait, that name is already taken.
Cheers
»Tøny
Paris Hilton, because sometimes, Massachusetts is just as clueless.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
