Experts: New ticket app leaves MBTA vulnerable


The MBTA is on the forefront of new technologies, with plans to roll out digital ticketing on the Commuter Rail this fall, but security professionals say the transit agency shouldn’t be so sure the new system couldn’t be hacked.

“Everything has a flaw,” said Caitlin Johanson, technical specialist for Core Security Technologies.
This week the T announced plans to unveil an app for smartphone devices that will let riders buy passes using a debit or credit card.

Train conductors will then check tickets on riders’ phones to ensure their validity.

Developers from Masabi, the company launching the app, said color-changing, visually encrypted images and scanner codes will help deter fraudulent passes.

Johanson said from a “reverse engineering perspective,” however, once this technology hits the public market, that’s when the “frenzy will begin.”

“As a security professional, you come to realize that there is literally a workaround for everything … you just need to give it time,” she said.

While used widely in England, the T will be the first transit agency in the U.S. to use the new app, something Johanson said can be risky.

“Saying you can’t hack this coming into the U.S. is like putting a huge, red target sign on your forehead,” she said. “Boston is one of the top cities for hacker and security communities — it’s a rough area to introduce something like this.”

But MassDOT Secretary Rich Davey said the agency is relying on evolving security developments to stay “a step ahead.”

“Nothing in life is fool proof, but I expect we will have the most secure program possible,” he said.

Hacker pride

According to Johanson, those in the “hacker community” pride themselves on breaking through services deemed “un-hackable.”

“You get your name on this, that’s world news. Notoriety is one of the biggest currencies the hacker community has,” she said. “It’s not always about hurting someone as much as it is saying ‘look what I did.’”

Past MBTA scams

Being the target of massive ticket scams isn’t something new to the T.
In 2008, three MIT students figured out a way to get free subway rides and unveiled a video called “The Anatomy of a Subway Hack.”

In 2012, four people were  arrested for allegedly producing thousands of unauthorized T passes worth millions of  dollars.


Sprint and T-Mobile offer further price discounts

Sprint unveiled a plan on Thursday that gives subscribers access to unlimited data for $60 a month, the industry's cheapest unlimited data offering.


Hundreds pay it forward at Florida Starbucks in…

The spontaneous chain of kindness continued for about 11 hours, totaling 457 transactions by the time it ended.


Weather system east of Caribbean could turn into…

An area of low pressure located east of the Caribbean Sea has a 50 percent chance of becoming a tropical depression or storm in the next 48 hours, U.S. forecasters…


U.S. hospital to discharge doctor treated with experimental…

An American doctor who contracted Ebola treating victims of the deadly virus in Liberia has recovered and will be discharged on Thursday by the Atlanta hospital that treated him with…


Review: 'When the Game Stands Tall' is both…

The high school football saga "When the Game Stands Tall" fumbles around for a focus while Jim Caviezel offers the most low-key coach in history.


Girlfriend in a coma: Chloe Grace Moretz

Chloe Grace Moretz is the best cheerleader "If I Stay" could ask for. As the star of the film adaptation of the successful YA novel…

The Word

The Word: Summer lovin' for Zac Efron and…

Ah, the summer romance. So intense, so fleeting. With Labor Day fast approaching, it should come as little surprise that the incredibly surprising romance between…

The Word

The Word: The Zac Efron-Michelle Rodriguez summer fling…

  Ah, the summer romance. So intense, so fleeting. With Labor Day fast approaching, it should come as little surprise that the incredibly surprising romance…


Fantasy football draft guide: How to draft your…

Many are wondering if we’re entering a new age in fantasy football drafting — one where running backs take a backseat.


Jets vs. Giants: 3 Giants storylines to watch

The Giants have plenty to work on as they reach the dress rehearsal preseason game Friday night against the rival Jets.


Jets vs. Giants: 3 Jets storylines to watch

Metro looks at three Jets storylines to watch as they play the Giants Friday.


Giants expected to work Corey Washington into first-team…

The day of reckoning for the Giants' fringe players will fall upon them Friday night against the Jets.


Big weddings may lead to long-term happiness

Dreaming of a big wedding? A new study indicates that the longer your guest list, the happier you’ll be in the long run. l A…


Online dating for every generation

Frank Jackson and his mother Maggie are like lots of modern families: They have dinner together regularly, keep each other updated on their lives —…


Going green could be the key to getting…

If we could just pursue the things that would actually make us happy, we could help the environment too, according to a New York researcher.…


Siren: A new dating app that puts women…

Online dating can be brutal, especially for single women. Noting that many women hate wading through inappropriate messages and photos, two tech entrepreneurs decided to…