Tag Archives: NYC transit

Analysis: 0-Day NYC Transit System “Free Ride” Bug

I found this bug by accident on my way home from work tonight. The reason I am writing this even though it’s a 0-day:

  1. I do not think it’s widely exploitable.
  2. And if it is, NYC isn’t losing any money over it as far as I could tell.
  3. It will help the MTA/NYC Transit find and fix the problem
  4. I’m not sure it’s reproducible since I wasn’t about to spend my own time and money to test it

Technically what I describe below is a security issue because it denies legitimate users entry/access and could allow a non-legitimate user a “free ride” if they happen to be in the right place at the right time. It might also cost a legitimate user an extra fare since they might swipe again at a different turnstile since they will assume they just swiped at a broken one.

Here’s the scenario that happened to me coming home from work tonight at around 7PM. Imagine three turnstiles lined up in a row.

  1. I swiped my unlimited metrocard at right most turnstile to enter subway system. I was denied access. It said ‘Go’ on the green readout but the turnstile wheel was locked. I swipe again and received the ‘Just Used’ message.
  2. Woman behind me swipes and turn style denies her access in the same way. (She then “hops the turnstile” and enters subway system.)
  3. As I try to swipe my card again and on the other turnstiles I continue to receive the “Just Used” Message. The left most turnstile readout says, “Just Usedd” with two Ds. I probably try around 5 times in the next few minutes. (I know I need to wait 15 min for the ‘Just Used’ flag to clear but I worked late and thought I might get lucky!)
  4.  Legitimate users enter and leave the subway system through turnstiles. I don’t recall how many or which one’s they used. Although tired I don’t recall this watching and step 3 combined being more than 5 minutes.
  5. A legitimate user swipes card in middle turnstile to enter the subway and the right turnstile — without prompting or a card swipe (no one is in proximity) — lights up ‘Go’ on the green readout and allows access.

If NYC transit wants to contact me I’ll give them the location of the turnstile for them to investigate.