Tag Archives: nyc

Analysis: 0-Day NYC Transit System “Free Ride” Bug

I found this bug by accident on my way home from work tonight. The reason I am writing this even though it’s a 0-day:

  1. I do not think it’s widely exploitable.
  2. And if it is, NYC isn’t losing any money over it as far as I could tell.
  3. It will help the MTA/NYC Transit find and fix the problem
  4. I’m not sure it’s reproducible since I wasn’t about to spend my own time and money to test it

Technically what I describe below is a security issue because it denies legitimate users entry/access and could allow a non-legitimate user a “free ride” if they happen to be in the right place at the right time. It might also cost a legitimate user an extra fare since they might swipe again at a different turnstile since they will assume they just swiped at a broken one.

Here’s the scenario that happened to me coming home from work tonight at around 7PM. Imagine three turnstiles lined up in a row.

  1. I swiped my unlimited metrocard at right most turnstile to enter subway system. I was denied access. It said ‘Go’ on the green readout but the turnstile wheel was locked. I swipe again and received the ‘Just Used’ message.
  2. Woman behind me swipes and turn style denies her access in the same way. (She then “hops the turnstile” and enters subway system.)
  3. As I try to swipe my card again and on the other turnstiles I continue to receive the “Just Used” Message. The left most turnstile readout says, “Just Usedd” with two Ds. I probably try around 5 times in the next few minutes. (I know I need to wait 15 min for the ‘Just Used’ flag to clear but I worked late and thought I might get lucky!)
  4.  Legitimate users enter and leave the subway system through turnstiles. I don’t recall how many or which one’s they used. Although tired I don’t recall this watching and step 3 combined being more than 5 minutes.
  5. A legitimate user swipes card in middle turnstile to enter the subway and the right turnstile — without prompting or a card swipe (no one is in proximity) — lights up ‘Go’ on the green readout and allows access.

If NYC transit wants to contact me I’ll give them the location of the turnstile for them to investigate.

NYC holds ShredFest 2010 ID Protection

NYC rocks!!! If you care about protecting your identity attend NYC Shred Fest 2010, May 23rd from 10AM-4PM… Massive paper shredding for sensitive documents as a free NYC service! My tax dollars at work folks to help protect you… In addition, the first three people to each location receive a free shredder!

$550 to Social Engineer as a NYC/NYPD Traffic Cop

This ad (and the image below) will probably disappear soon so be sure to click on the link. It wouldn’t be difficult to buy this uniform, go out into the streets of NYC, pull someone over and threaten to give them a ticket unless they coughed up a few dollars. Illegal sure. But not unreasonable. Isn’t selling authentic police uniforms illegal?

All in excellent shape brand new .. .reason selling i moved to New Jersey from New York my new residence restrict me from having NYPD employment.

$550.00 for all are Best offer

More images in the ad. BTW, here’s how to spot a fake officer.

$550, NYPD Traffic Agent Uniform