Muni Tickets Can Be Hacked for Free Rides

A video was released on the internet showing a PATH (a New York & New Jersey rail system) paper ticket with RFID technology being able to be easily re-written using a specific type of cell phone by easily replenishing the number of rides loaded onto the card.

As PATH uses the same gate and fare technology as Clipper, Muni is now the unintended victim of this hack as the same process can be done to their metro station issued paper tickets with the same electronic fare card technology (a.k.a. Limited Use Tickets or LUT).

This current hack is cannot reprogram hard plastic Clipper cards, it only affects the paper electronic tickets.  Interestingly, this could also have an effect on Golden Gate Ferry as all single and round-trip ride tickets are also issued in paper ticket form (as seen below).

The paper LUT that can be hacked

While the person who created the application with their smart phone is not going to release it, and did an effort to inform officials at PATH and the SFMTA about this problem, it makes me wonder...

Why such a huge lack of security on those paper tickets?  Now Muni and the MTC will have to spend a ton of money getting newer and more secure paper tickets to issue to Muni, and those tickets are not cheap to produce.  Muni purchases those paper tickets in bulk for an approximate cost of 25 cents each; Muni used to charge metro passengers a 25 cent fee when the machines was just installed, but quickly waived it when the public got mad, so the agency now has to spend hundreds of thousands of dollars a year.  With the need for more secure tickets, expect the cost to go even higher.

UPDATE: I just had an idea after publishing this.  Since the metro gates have magnetic card swipes, why doesn't Muni modify the ticket machines to issue a mag stripe paper ticket?  The paper ticket can also have information printed so it can still be used as a "flash ticket" for passengers who transfers to a bus line.  Mag stripes might be hackable, but reduces the risk because it doesn't use chips to use Clipper, and if it was hacked, would only be good on swiping at a metro gate; but an inspector can still visually look at the ticket and see if it's still valid or expired. 

The inside guts of a Muni LUT

It also comes to mind about Muni's decision to replace fare gates at their metro stations.  The agency and MTC spent millions of taxpayer dollars on fare gates that looks nice and accepts Clipper cards and LUTs sold at ticketing machines just outside the gates.

Why didn't the agency just consider a barrier free system?  It would have been simple and affordable by:

1. Painting a yellow or red line to designate the free area and paid zone.
2. Installing single ride ticketing machines that issues a printed ticket with no Clipper technology on the ticket.
3. Have Clipper card readers at the painted line for those with the cards to tag and enter the paid area.
4. Have fare inspectors do more random checks as there's no barrier to separate the paid and free zones.

Muni already runs on the honor system when you board a train or bus, so why put gates at the metro stations?

At least Apple didn't release an iPhone 5 with NFC capabilities, then people will attempt to hack their smart cards for free transit rides.

Let's remember folks, cheating public transit doesn't benefit anyone, including yourself, it hurts everyone.  Be honest and pay your share to ride transit.  If you cheat, you are scum, and scum will be punished.