San Francisco - Hack A Meter - Park Free

I was born and raised in San Francisco so I can testify to the fact that parking in the City is difficult. The City has employed new electronic meters that use payment cards instead of coins for several reasons. In the past it was almost a game for parking meter collectors to take home some of the coins they collected. Also counting the coins can be a major headache and is labor intensive. So going hi-tech was an answer to control the flow of payments and to simplify the system. The City currently has some 21,000 + computerized meters spread across the landscape.

In steps the hi-tech folks to foil the system and who are able to make their own payment cards relatively easy. In a recent article over at PC World it states that:

Security researchers say that it is easy for a technically savvy hacker to make a fake payment card that gives them unlimited free parking. To prove their point, they will talk about how they built just such a card in about three days at a computer security conference Thursday.

According to Joe Grand, owner of Grand Idea Studio, San Francisco’s parking meters have no way of telling the difference between a genuine payment card and a fake. These cards can be used to pay 23,000 meters citywide.

Grand, who hadn’t worked much with smart cards, said that the work wasn’t particularly hard to do. His card simply replays the same signals used by genuine cards to the meter. Although he never actually used the card to get free parking, Grand said he was able to build a card with a balance of US$999.99 — the maximum possible — that would never run out of funds.

“If I found this problem, chances are somebody else knows about the problem and possibly is exploiting it,” he said. “That’s costing all of us taxpayers money.”

I would seem likely that if other cities are also using computerized meters, these other cities will eventually face the same problems. In a time of recessions when cities need ever dime they can get, this could be a potential major problem.

Comments welcome.

Source.