I found this bug by accident on my way home from work tonight. The reason I am writing this even though it’s a 0-day:
- I do not think it’s widely exploitable.
- And if it is, NYC isn’t losing any money over it as far as I could tell.
- It will help the MTA/NYC Transit find and fix the problem
- I’m not sure it’s reproducible since I wasn’t about to spend my own time and money to test it
Technically what I describe below is a security issue because it denies legitimate users entry/access and could allow a non-legitimate user a “free ride” if they happen to be in the right place at the right time. It might also cost a legitimate user an extra fare since they might swipe again at a different turnstile since they will assume they just swiped at a broken one.
Here’s the scenario that happened to me coming home from work tonight at around 7PM. Imagine three turnstiles lined up in a row.
- I swiped my unlimited metrocard at right most turnstile to enter subway system. I was denied access. It said ‘Go’ on the green readout but the turnstile wheel was locked. I swipe again and received the ‘Just Used’ message.
- Woman behind me swipes and turn style denies her access in the same way. (She then “hops the turnstile” and enters subway system.)
- As I try to swipe my card again and on the other turnstiles I continue to receive the “Just Used” Message. The left most turnstile readout says, “Just Usedd” with two Ds. I probably try around 5 times in the next few minutes. (I know I need to wait 15 min for the ‘Just Used’ flag to clear but I worked late and thought I might get lucky!)
- Legitimate users enter and leave the subway system through turnstiles. I don’t recall how many or which one’s they used. Although tired I don’t recall this watching and step 3 combined being more than 5 minutes.
- A legitimate user swipes card in middle turnstile to enter the subway and the right turnstile — without prompting or a card swipe (no one is in proximity) — lights up ‘Go’ on the green readout and allows access.
If NYC transit wants to contact me I’ll give them the location of the turnstile for them to investigate.