Experts: New ticket app leaves MBTA vulnerable


The MBTA is on the forefront of new technologies, with plans to roll out digital ticketing on the Commuter Rail this fall, but security professionals say the transit agency shouldn’t be so sure the new system couldn’t be hacked.

“Everything has a flaw,” said Caitlin Johanson, technical specialist for Core Security Technologies.
This week the T announced plans to unveil an app for smartphone devices that will let riders buy passes using a debit or credit card.

Train conductors will then check tickets on riders’ phones to ensure their validity.

Developers from Masabi, the company launching the app, said color-changing, visually encrypted images and scanner codes will help deter fraudulent passes.

Johanson said from a “reverse engineering perspective,” however, once this technology hits the public market, that’s when the “frenzy will begin.”

“As a security professional, you come to realize that there is literally a workaround for everything … you just need to give it time,” she said.

While used widely in England, the T will be the first transit agency in the U.S. to use the new app, something Johanson said can be risky.

“Saying you can’t hack this coming into the U.S. is like putting a huge, red target sign on your forehead,” she said. “Boston is one of the top cities for hacker and security communities — it’s a rough area to introduce something like this.”

But MassDOT Secretary Rich Davey said the agency is relying on evolving security developments to stay “a step ahead.”

“Nothing in life is fool proof, but I expect we will have the most secure program possible,” he said.

Hacker pride

According to Johanson, those in the “hacker community” pride themselves on breaking through services deemed “un-hackable.”

“You get your name on this, that’s world news. Notoriety is one of the biggest currencies the hacker community has,” she said. “It’s not always about hurting someone as much as it is saying ‘look what I did.’”

Past MBTA scams

Being the target of massive ticket scams isn’t something new to the T.
In 2008, three MIT students figured out a way to get free subway rides and unveiled a video called “The Anatomy of a Subway Hack.”

In 2012, four people were  arrested for allegedly producing thousands of unauthorized T passes worth millions of  dollars.


Jeremiah Oliver funeral delayed until May

A judge has delayed the funeral of 5-year-old Jeremiah Oliver so that defense attorneys can carry out an independent autopsy.


'Barack Obama cheats on Michelle' claims Japanese politician…

A senior Japanese politician has marred Barack Obama's official visit to Tokyo with bizarre claims that the President cheats on his wife Michelle. Kazuyuki Hamada,…


British Royal family devastated by freak NY death…

The British royals have been left devastated by the death of Mark Shand, younger brother of Camilla, Duchess of Cornwall, after a freak fall in…


DA: Homeless man severely beat by men in…

Two former college football players pleaded not guilty to the alleged severe beating of a homeless man in Allston earlier this year.

The Word

Is Avril Lavigne's new music video racist?

Some fans say Avril Lavigne's new music video is offensive to Japanese people.


Jodie Foster married girlfriend Alexandra Hedison this weekend

No need to rely on cryptic Golden Globe speeches for your movie star sexual orientation questions anymore: Jodie Foster is married to a lady. Foster…


‘Survivor: Cagayan’ recap: Episode 9

It was only an hour-long episode, but there's a lot to cover this week. The drama of Survivor strikes again as the identity of the…

Going Out

Thursty: Revamped Audubon is back in action

Having been a long time fan of Trina's Starlite Lounge in Inman Square, one of my only complaints about the place is that there's only…


Patriot’s schedule comes up fair

Those looking for built-in excuses for the Patriots 2014-2015 season will have to look elsewhere, because their schedule came up fair. For the fourth straight…


Nava demoted, Victorino return imminent

  Red Sox outfielder Daniel Nava, who was batting a team-low .149/.240/.269, was demoted to Triple-A Pawtucket on Wednesday. "His struggles at the plate, I…


2014 NFL Mock Draft: Updated, new April 24…

2014 NFL Mock Draft: Updated, new April 24 version


MLB video highlights: Red Sox top Yankees, 5-1

John Lackey shines, Pineda ejected in Red Sox win


Spider-Man's web shooters get real

A German lab technician has created a working Spider-Man web shooter, which fires pellets and a harpoon-tipped, retractable fishing line instead of a liquid web.


Pippa Middleton's Etsy pick: Golden Thread Jewelry

Get a look at the jewelry Pippa Middleton loves and find out how you can buy it too.


What every parent needs to know to get…

Mom and author of "Small Talk," Tracey Blake, shares her five practical tips to help you develop your children's language skills.


Subway crush: Meet your soulmate on your commute

Read about a couple who has been 40 years after meeting on the train.