[131655] in cryptography@c2.net mail archive
Re: road toll transponder hacked
daemon@ATHENA.MIT.EDU (Dustin D. Trammell)
Tue Aug 26 12:05:22 2008
From: "Dustin D. Trammell" <dtrammell@bpointsys.com>
To: Matt Blaze <mab@crypto.com>
Cc: Cryptography <cryptography@metzdowd.com>, mheyman@gmail.com
In-Reply-To: <BC63261C-3273-4082-BEF0-2781D8537B3D@crypto.com>
Date: Tue, 26 Aug 2008 10:56:09 -0500
--=-0lLIAXvAYzN5dkLSOC4T
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
On Tue, 2008-08-26 at 10:52 -0400, Matt Blaze wrote:
> On Aug 26, 2008, at 10:15, mheyman@gmail.com wrote:
> > So, I believe, at least for E-Z Pass, the attack would have to include
> > cloning the license plate and pictures may still be available whenever
> > a victim realizes they have been charged for trips they did not take.
>=20
> I believe that's correct. In fact, the plate recognition technology =20
> they
> use seems to be good enough to make the transponder itself redundant.
> I know several people with E-Z Pass who disconnected the internal
> battery of their transponder (out of concern that there might be
> hidden readers around town that track vehicles at places other than
> toll gates). Even with dead transponders, their accounts are still
> charged accurately when they pass toll gates. (The sign displays "EZ =20
> Pass
> not read" or some such thing, but the account is debited within a day
> or two anyway).
This is the same for the state-wide Texas tag, TxTag[1]. If your tag
doesn't register, or you disable or remove it, the toll system can still
accurately bill you based on your license plate and vehicle
registration. If you're not in the TxTag system at all, they simply
mail you a bill.
[1] http://www.txtag.org/
--=20
Dustin D. Trammell
Security Researcher
BreakingPoint Systems, Inc.
--=-0lLIAXvAYzN5dkLSOC4T
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQBItCeWXqktT9dTuAARAvhdAJ0XBVLyC8kX98TFvOYpKSgr0E8ILgCfUYbo
7DLh/Ooe4QH2KSmGtSBToD4=
=Lse6
-----END PGP SIGNATURE-----
--=-0lLIAXvAYzN5dkLSOC4T--
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
