Experts: New ticket app leaves MBTA vulnerable


The MBTA is on the forefront of new technologies, with plans to roll out digital ticketing on the Commuter Rail this fall, but security professionals say the transit agency shouldn’t be so sure the new system couldn’t be hacked.

“Everything has a flaw,” said Caitlin Johanson, technical specialist for Core Security Technologies.
This week the T announced plans to unveil an app for smartphone devices that will let riders buy passes using a debit or credit card.

Train conductors will then check tickets on riders’ phones to ensure their validity.

Developers from Masabi, the company launching the app, said color-changing, visually encrypted images and scanner codes will help deter fraudulent passes.

Johanson said from a “reverse engineering perspective,” however, once this technology hits the public market, that’s when the “frenzy will begin.”

“As a security professional, you come to realize that there is literally a workaround for everything … you just need to give it time,” she said.

While used widely in England, the T will be the first transit agency in the U.S. to use the new app, something Johanson said can be risky.

“Saying you can’t hack this coming into the U.S. is like putting a huge, red target sign on your forehead,” she said. “Boston is one of the top cities for hacker and security communities — it’s a rough area to introduce something like this.”

But MassDOT Secretary Rich Davey said the agency is relying on evolving security developments to stay “a step ahead.”

“Nothing in life is fool proof, but I expect we will have the most secure program possible,” he said.

Hacker pride

According to Johanson, those in the “hacker community” pride themselves on breaking through services deemed “un-hackable.”

“You get your name on this, that’s world news. Notoriety is one of the biggest currencies the hacker community has,” she said. “It’s not always about hurting someone as much as it is saying ‘look what I did.’”

Past MBTA scams

Being the target of massive ticket scams isn’t something new to the T.
In 2008, three MIT students figured out a way to get free subway rides and unveiled a video called “The Anatomy of a Subway Hack.”

In 2012, four people were  arrested for allegedly producing thousands of unauthorized T passes worth millions of  dollars.


Jews in eastern Ukraine ordered to register, Kerry…

Secretary of State John Kerry condemned reports that Jews in eastern Ukraine had been ordered to register with the authorities "or suffer the consequences."


Chelsea Clinton pregnant with first child

Chelsea Clinton is pregnant with her first child.


Divers struggle in search for South Korean ferry…

By Jungmin Jang and Narae KimMOKPO/JINDO, South Korea (Reuters) - Rescuers struggled with strong waves and murky waters on Thursday as they searched for hundreds…


New Hampshire moves to decriminalize adultery

For the first time in hundreds of years, it's about to be legal to cheat on your spouse in New Hampshire.


Dick Wolf to bring fictionalized world of 'Law…

A&E has ordered a pilot called "D.O.A." from "Law and Order" mastermind Dick Wolf that will focus on real detectives reexamining cold cases. A trio…


Review: 'Transcendence' is not stupid but sometimes lacks…

The cyberthriller "Transcendence" explores artificial intelligence, nanotechnology and other ethical quandaries, but has too much ambition, if anything.


Shane West talks WGN America's 'Salem'

The actor on history lessons, a new network and showing his butt.


Both feet on the ground with Aimee Mann…

What began with a cool double-bill of Ted Leo opening for Aimee Mann morphed into a full-fledged collaborative project that they're calling The Both. “There…


2014 Boston Marathon preview: Elite American, International runners…

2014 Boston Marathon: Elite American, International runners to watch


2014 NBA Finals odds: Ranking which playoff teams…

2014 NBA Finals odds: Ranking which playoff teams have the best shot at a championship. The Thunder, Clippers, Heat and Rockets lead the way.


2014 Patriots, full NFL schedule release date announced

2014 Patriots, full NFL schedule release date announced


Fantasy basketball: Finding next year's NBA studs

Before we put the 2013-14 fantasy basketball season to bed, it’s worth thinking about next year’s breakouts while they’re fresh in our mind.


Light-up nail art syncs with phone

This Japanese technology syncs light-up nail art with your phone.


Why is dance cardio taking off in NYC?

Instructors at some of the city's hottest classes explain why.


Earth Day travel in the Florida Keys

See why this eco-friendly destination deserves your attention.


Sorry, Facebook — FarmVille goes mobile with 'Country…

Zynga has released a version of the hit "FarmVille" tailored for smartphones and tablets in the hope of reaping a bumper crop of players.