Skip to main content
SpringerLink
Log in

Free Rides in Denmark: Lessons from Improperly Generated Mobile Transport Tickets

  • Conference paper
  • First Online:
Secure IT Systems (NordSec 2017)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10674))

Included in the following conference series:

Abstract

The term security ceremony describes a technical system extended with its human users. In this paper, we examine the inspection ceremony for the mobile transport ticket in Denmark. We find several security weaknesses that are ascribable to both human and computer components of the ceremony. The main vulnerabilities are due to the design choices of how the visual inspection ceremony is organised and the lack of information that is stored into the 2D barcode. These vulnerabilities allow a ticket holder to travel up to 8 zones with a 2-zone subscription and enable several people to travel with the same subscription. The attack is significant as it can be automated, and rather modest skills are necessary to break the inspection ceremony. We state four principles that aim at strengthening the security of inspection ceremonies and propose an alternative ceremony whose design is driven by the stated principles.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Ministry of Transport of Denmark: Danish infrastructure investments (2012). https://goo.gl/irpQQR

  2. Ministry of Foreign Affairs of Denmark: Transport infrastructure in Denmark (2012). http://denmark.dk/en/practical-info/work-in-denmark/transport-infrastructure-in-denmark

  3. Ellison, C.: Ceremony design and analysis. IACR eprint (2007)

    Google Scholar 

  4. BBC News: Forged rail tickets sold on dark web, BBC investigation reveals (2016)

    Google Scholar 

  5. International Union of Railways: Uic 918–3: International rail ticket for home printing (2007)

    Google Scholar 

  6. International Union of Railways: the UIC public key management website (2017). https://railpublickey.uic.org/download.php

  7. Radke, K., Boyd, C., Gonzalez Nieto, J., Brereton, M.: Ceremony analysis: strengths and weaknesses. In: Camenisch, J., Fischer-Hübner, S., Murayama, Y., Portmann, A., Rieder, C. (eds.) SEC 2011. IAICT, vol. 354, pp. 104–115. Springer, Heidelberg (2011). doi:10.1007/978-3-642-21424-0_9

    Chapter  Google Scholar 

  8. Bella, G., Coles-Kemp, L.: Layered analysis of security ceremonies. In: Gritzalis, D., Furnell, S., Theoharidou, M. (eds.) SEC 2012. IAICT, vol. 376, pp. 273–286. Springer, Heidelberg (2012). doi:10.1007/978-3-642-30436-1_23

    Chapter  Google Scholar 

  9. Johansen, C., Jøsang, A.: Probabilistic Modelling of Humans in Security Ceremonies. In: Garcia-Alfaro, J., Herrera-Joancomartí, J., Lupu, E., Posegga, J., Aldini, A., Martinelli, F., Suri, N. (eds.) DPM/QASA/SETOP -2014. LNCS, vol. 8872, pp. 277–292. Springer, Cham (2015). doi:10.1007/978-3-319-17016-9_18

    Google Scholar 

  10. Probst, C.W., Kammüller, F., Hansen, R.R.: Formal modelling and analysis of socio-technical systems. In: Probst, C.W., Hankin, C., Hansen, R.R. (eds.) Semantics, Logics, and Calculi. LNCS, vol. 9560, pp. 54–73. Springer, Cham (2016). doi:10.1007/978-3-319-27810-0_3

    Chapter  Google Scholar 

  11. Garcia, F.D., Koning Gans, G., Muijrers, R., Rossum, P., Verdult, R., Schreur, R.W., Jacobs, B.: Dismantling MIFARE classic. In: Jajodia, S., Lopez, J. (eds.) ESORICS 2008. LNCS, vol. 5283, pp. 97–114. Springer, Heidelberg (2008). doi:10.1007/978-3-540-88313-5_7

    Chapter  Google Scholar 

  12. Murdoch, S.J., Drimer, S., Anderson, R., Bond, M.: Chip and pin is broken. In: 2010 IEEE Symposium on Security and Privacy, pp. 433–446 (2010)

    Google Scholar 

  13. Schneier, B.: Flying on someone elses airplaine ticket (2003). https://www.schneier.com/crypto-gram/archives/2003/0815.html#6

  14. Jaroszewski, P.: How to get good seats in the security theater? Hacking boarding passes for fun and profit. In: DEF CON 24 Hacking Conference (2016)

    Google Scholar 

Download references

Acknowledgement

This work is supported in part by DemTech grant 10-092309 from the Danish Council for Strategic Research, Programme Commission on Strategic Growth Technologies.

Author information

Authors and Affiliations

  1. IT University of Copenhagen, Copenhagen, Denmark

    Rosario Giustolisi

Authors
  1. Rosario Giustolisi
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Rosario Giustolisi .

Editor information

Editors and Affiliations

  1. University of Tartu, Tartu, Estonia

    Helger Lipmaa

  2. Chalmers University of Technology, Gothenburg, Sweden

    Aikaterini Mitrokotsa

  3. University of Tartu, Tartu, Estonia

    Raimundas Matulevičius

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Giustolisi, R. (2017). Free Rides in Denmark: Lessons from Improperly Generated Mobile Transport Tickets. In: Lipmaa, H., Mitrokotsa, A., Matulevičius, R. (eds) Secure IT Systems. NordSec 2017. Lecture Notes in Computer Science(), vol 10674. Springer, Cham. https://doi.org/10.1007/978-3-319-70290-2_10

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-70290-2_10

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-70289-6

  • Online ISBN: 978-3-319-70290-2

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation