Ethical Hacking of a Public Transport Mobile Ticket Service

Sammanfattning

Public transport plays an important role in sustainability development globally, and is often considered critical infrastructure. Utilized by billions of people in an increasingly digital world, many providers have also started to offer tickets for purchase directly in mobile phones. Despite all this, there is currently little available research on cybersecurity in the public transport sector. To combat this, in this case study we explored a number of potential cybersecurity vulnerabilities in a mobile ticketing application through white­box penetration testing following a threat modeling of the targeted system. In addition to presenting discovered security concerns, mitigations and theoretical impact were discussed, as well as general security properties of the system. The study is the first of its kind to be conducted in collaboration with a public transport provider, in this case Trafikforvaltningen, which through Stockholms Lokaltrafik (SL) provides all public transport in Stockholm, Sweden. A total of seven vulnerabilities with a measurable impact and six other security discoveries were found during the study. The most severe vulnerabilities all related to impairing the availability of the service for other users. The study found that a number of commonly reported vulnerability categories in public transport providers, such as issuing fake tickets or extracting personal information, were precluded due to a strictly server-side public-key cryptography implementation, and storing almost no personal information, respectively. The results presented in this study provides novel data to the currently scant cybersecurity research of public transport ticketing services. The findings help harden existing solutions and provides future guidance for developers and other stakeholders of public transport providers.