Hasta La Gadget!

For all the worries about sweeping US surveillance programs, Americans are claiming at least a few victories in the fight for privacy. Just look to New Jersey’s Supreme Court for an example — it has ruled that police need search warrants to obtain tracking information from cellular carriers. Citing a ruling that requires warrants for GPS tracking devices, the court has decided that attempts to obtain cellphone location data represent searches and fall under constitutional oversight. Cellphone users can expect a reasonable level of privacy when they sign up for service, according to the Supreme Court. While there’s no law on the books to restrict tracking, like there is in Montana, the ruling sets a precedent for police monitoring that could extend beyond New Jersey’s borders.

[Image credit: Jeff Schuler, Flickr]

Filed under: Cellphones

Comments

Via: New York Times

Source: New Jersey Supreme Court (PDF)

Mobile security company Intrepidus Group presented evidence during the EUSecWest security conference potentially identifying a major flaw in at least two US transit systems. Creating an Android app named “UltraReset” and using it in tandem with an NFC-enabled Android phone (a Nexus S, in this case), security researchers Corey Benninger and Max Sobell were able to reset and reuse — free of charge — transit access cards in both San Francisco’s MUNI system and New Jersey’s PATH system. Before you go getting any bad ideas, know that Benninger and Sobell haven’t released the app for public use, and warned both transit systems in late 2011 (though neither region has fixed the exploit, the duo claim). PATH and MUNI share a common chip access card — the Mifare Ultralight — which can apparently be reset for 10 extra rides (as demonstrated on video below) via Android phones with NFC, an OS newer than 2.3.3 (Gingerbread). Starting to sound familiar?

Intrepidus is, however, releasing a modified version of the app, named “UltraCardTester.” The modified app functions just like its nefarious progenitor, except it can’t add time to cards (see it in action below). The app can tell you how many rides you have left, and if a system is open to exploit, but it won’t assist you in the act of exploiting. We reached out to both New Jersey’s PATH and San Francisco MUNI on the issue, but have yet to hear back as of publishing.

Continue reading Security researchers identify transit system exploit in San Fran and New Jersey, create app to prove it

Filed under: Cellphones, Transportation, Wireless, Software, Mobile

Security researchers identify transit system exploit in San Fran and New Jersey, create app to prove it originally appeared on Engadget on Sun, 23 Sep 2012 19:48:00 EDT. Please see our terms for use of feeds.

Permalink   |  IDG News Service  | Email this | Comments