It has been reported that the new ride tracker MetroCard system for the New York City subway could potentially have a scary security loophole. This new ride tracker MetroCard system, as of yesterday, was implemented across all 472 of the subway stations in New York City, and it allows straphangers to check in and out of the subway at select stations using their ID cards and credit cards. Unfortunately, it appears that there is a major security loophole that is leaving both the riders and the MTA vulnerable.
The serious security breach was discovered by independent security researcher, Lexington Polly. According to Polly, the ride tracker contains publicly available “spoofing” software—which is malicious software specifically designed to send false data signals to a network in order to gain unauthorized access. He tested the system by accessing his own rides and found that it was possible for him to check out of a station before the actual train has departed. This could easily be abused by someone with ill intentions, because the MTA would have no way to monitor if someone was actually on the train or not.
In addition, the data could also be exploited to steal riders’ identities or to track their travel patterns. This could potentially be used for identity theft or to target people for an attack. This security flaw is obviously a huge concern for the MTA, especially in light of the increase in terrorist-related threats in recent years.
Though the MTA is in the process of building a more secure system, its current version should be used with caution. Riders should closely monitor their credit cards and bank statements to ensure that their financial information is not being used in an inappropriate manner. Additionally, riders should also use the ride tracker system cautiously, as there is no guarantee that hackers will not be able to take advantage of the security loophole.
The safety of the New York City subway riders should always be a top priority, and it appears that the MTA is currently taking steps to ensure that the ride tracker system is as secure as possible. However, until the MTA is able to completely close the security loophole, riders should be aware of the potential risks and should still be cautious when using the ride tracker system.