EZ Pass and the fast lane ....

[Jerrold Leichter]

| > 	No mention is made of encryption or challenge response
| > authentication but I guess that may or may not be part of the design
| > (one would think it had better be, as picking off the ESN should be duck
| > soup with suitable gear if not encrypted).
|
|  From a business perspective, it makes no
| sense to spend any money on crypto for this
| application.  If it is free, sure use it,
| but if not, then worry about the 0.01% of
| users who fiddle the system later on.
|
| It would be relatively easy to catch someone
| doing this - just cross-correlate with other
| information (address of home and work) and
| then photograph the car at the on-ramp.
It would, in principle, be relatively easy to query these boxes yourself, or
listen in near a station.  You could quickly build up a database of valid
ID's, and could then build/sell a clone box, perhaps a "tumbler" box that
would rotate among valid ID's.

The actual money involved can be substantial - in the NY area, a cross-Hudson
-River commuter spends at least $5/day through EZ-pass, and you can now charge
things like parking at airports - $25/day or more.  So ... you'd think there
would be an active market in rigged EZ-pass boxes by now (as, for example,
there has been an active market for counterfeit monthly passes on the commuter
rail lines in the New York area.)  Curiously, if there is such a thing, it's
so far on a low enough scale that the press hasn't picked it up.

The basic protection mechanism involved is apparently quite simple:  Every
time you use EZ-pass, a photo of your license plate, and of the driver, is
taken.  The photos are kept for quite some time.  So cheaters can be tracked.

In addition, where there are high-value charges, there is usually a gate.  If
your EZ-pass is invalid, you're stuck in what is effectively a man-trap,
waiting for the cops on duty to check things out.  You'd better have a valid
EZ-pass to show them.  I don't know how much info they can get out of the
system, but it could easily tell them if, when they scan your "good" pass,
it shows a different ID from the one registered before.  (On the other hand,
high-speed readers - where there is no gate - are spreading.  Several were
recently installed at the Tappan-Zee Bridge, where the toll is $7.)

All in all, the system seems to depend on what I've heard described as the
"bull in the china shop" theory of security:  You can always buy more china,
but the bull is dead meat.
							-- Jerry

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com