“We have a bunch of security vulnerabilities, but are too lazy to be bothered with them, so shut up. Don’t let the public know that they’re being screwed. If you do, we’ll take you to court. Yeah, I told you to shut up, but you didn’t listen, so now I’ll court-order you to stop talking. Our problems don’t exist!” Yet another reason I don’t like Boston.

I think the real problem is they went beyond simply finding the vulns. They *applied* them. This puts them in a very sticky legal situation, especially since their own slides act as admission of guilt.

Yeah, but the application of the exploits acts as a proof of concept. If these vulnerabilities were ignore-able, the transit authority wouldn’t have fought so hard to shut the kids up. If they didn’t actually apply the exploits, it becomes the kids’ word against the transit authority’s. The fact that they applied the exploits proves to everyone that the vulerabilities actually exist. Let’s just hope this whole ordeal acts as a wake-up call to the transit authority, as it very well should. But it’s Boston, so there’s a good chance it won’t. (Remember, same place a bunch of LED’s thrown together on a PCB was misconstrued as a bomb.)

Aside from the subway hacks, the presentation says they’ve built alot of really cool tools to help with their research.

One particular one is a toolchain to easily program ‘multi-core’ FPGAs to assist with their brute forcing of the subway RFID chips.

Even if the gag order continues, hopefully they’ll be able to post some of the tools that they developed that aren’t to do with subway systems directly.

Interesting point – this has showed up on WikiLeaks…

https://secure.wikileaks.org/wiki/Anatomy_of_a_Subway_Hack_2008

Sapere Aude,

M.

These kids are heroes.

These kids have showed how careless was the security in this public transportation used by many civilians.

What would append if some nutjob decide to make an attack on the subway?

How many lives we have to put on risk before doing something about it?

Do we need to wait for a disaster to append before we decide to do something about it?

These kids should be rewarded for being good citizens and risk their freedom in order to protect our lives by publishing the security risk on Boston.