The problem is more significant than GPS objections, according to the software engineer who hacked the system.
The New York City Taxi and Limousine Commission’s technology enhancement plan that puts GPS systems, credit card scanners and monitors in the city’s 13,000-plus taxis has come under fire again—this time from a passenger who hacked the computer monitor and gained access to its operating system.
On Dec. 1 software engineer Billy Chasen posted a walk-through on his personal blog ‘[An Error Occurred While Processing This Directive].com’ of how he hacked into a computer screen mounted on the back seat of a cab he hailed on New York’s Upper West Side. The story was initially reported Dec. 26 on WNBC.com, a local news station.
The screens, part of TLC’s technology initiative to update taxis, are used to help passengers map their route in a cab and as an entertainment portal as well, with segments broadcasting news, weather and advertisements. Customers also use the screens, along with a credit card reader, to pay for their fares.
Rather than catch a bit of Entertainment Tonight, Chasen found a different purpose for his monitor.
“When I got in a cab last night I was greeted with [an] error message,” wrote Chasen. “I’ve seen error messages in airports, on billboards…however this was the first public error message that I could interact with.”
Using his cell phone camera Chasen documented how he was able to open Internet Explorer using the touch-sensitive screen. He was then able to use a Sprint card listed on the monitor to get a dial-up connection giving him full administrative access to the monitor’s operating system.
“It was not only a security flaw, but people also pay with the screen if they use a credit card,” wrote Chasen. “That information could potentially be stored locally.”
Chasen said his ability to access the operating system posed a much greater threat than the problem of being tracked by GPS. In September, the New York Taxi Workers Alliance, a group representing about 10,000 New York City taxi drivers, held a two-day strike to oppose TCS’ mandated technology system implementation that includes GPS, the card reader and the touch screen. While the strike didn’t stop the systems from being installed in New York taxis, security threats potentially could stop the systems from being used to pay cab fares.
“You’re essentially giving strangers access to a computer that is shared with hundreds of customers,” wrote Chasen on his blog. “I also could have installed any software I wanted, assuming I had it online.”
Allan Fromberg, deputy commissioner for public affairs at TLC, said that the only thing Chasen (and the two WNBC reporters who also encountered an error message after reporting Chasen’s story) could have accessed was a couple of media files. “So the only thing they could have done with this is replay a couple media spots,” said Fromberg.
The reason Chasen was able to access the computer’s backend system at all is because the computer in his cab was one of two prototype systems still on the road. The cabs—and the prototype system from Veriphone—were pulled off the road the next day, according to Fromberg.
“This guy got into the cab Nov. 30 and the cabs were off the road by Dec. 1,” he said.
Fromberg also said that none of the credit card data input by customers to pay cab fares is stored in the system and that no one had access to it.
“There are extensive contract-required security protocols in place, which have exceeded government and credit card industry standards and have been stringently tested by internal and external security experts, which fully prevent access to anything other than media content residing in the taxicab itself,” said Fromberg in an e-mail to eWEEK. “There is no potential for any malicious activity.”
{ 14 comments… read them below or add one }
NYC Hack 01.01.08 at 4:27 pm
We need to find a way to hack into those systems so we can hook up our laptops and get online from our cabs.
yellowbori 01.07.08 at 8:11 pm
ha ha ha Im a driver at NYC and I have the GPS system, let me tell you that 8 or 9 of every passenger that get on my cab as soonest that go on they turn it OFF, if they expect to make money from advertisements cool but nobody is watching.
Josh 01.13.08 at 7:33 pm
Ummm…. the GPS should be for the driver, not the passenger. And if I was taking a cab, I certainly would NOT want stupid ads playing! Maybe they should install a backseat radio system for passengers to choose from different music. And of course set the volume to a limit so the passengers can’t jack it all the way up.
Sarah E 02.18.08 at 1:26 pm
I heard that GPS systems in NYC Taxicabs have affected the internet access of many large internet using companies in Manhattan. This is so because 13,000 vehicles moving in the city with wireless connection causes the internet to be down frequently. After reading this article, I am worried about my personal safety and I fear my identity can be in danger. I will never pay with a credit/debit card if I ride a taxi cab. If this happened I believe that the system can be hacked again. Also, I heard that many taxi cab drivers lose fares because sometimes the wireless connection all of a sudden most likely under tunnels. In my opinion, I believe that the GPS system affects both the driver and rider at times.
Mark 02.18.08 at 1:41 pm
I picked up a guy that said he only had a credit card to pay. I said fine since its the rules and didn’t want to say no and risk him being a tlc inspector. I lost $23.40 last night and tons of time because I drove to parkslope brooklyn from the city only to find out that his credit card was declined. The tlc is really making the shitty cab life even worse!
327 02.19.08 at 1:24 pm
you got to take him to an atm machine, and also ask him if he has another credit card. i suppose after that you could take him to the police.
Mark 02.20.08 at 12:27 pm
funny… the guy was in a rush and he only had a credit card not a atm card. I heard some driver took a lady to newark, after her credit card declined he locked the doors and took her to the police station and they arrested him!
327 02.25.08 at 2:07 am
the cab driver or the passenger?
Mark 02.25.08 at 11:37 am
the driver was put in jail, you are not allowed to take a person hostage for any amount of money. You could have a 400 dollar fare and the person can just leave.
Stephen 02.26.08 at 5:13 pm
We need Cab Security Camera in our yellow cabs! People takes advantage of using credits cards that not have money, and make believe they have it. We, the drivers are the loosers of our fare!
edward stover 03.06.08 at 1:44 pm
What ever happen to driver’s rights?
Ama 03.07.08 at 6:54 am
I took a lady from 125 and 8 av to metro torth at 125 and park av. She was so desparete to find a cab, so I took her out of my way after I was already off dutty. Her credit card was denied and she did not want to run at the Bank at the same corner. She just ran out of the cab saying it was not her fault if the card was denied.
When passengers asks to use credit card, I will not deny but I will tell them in advance that they are still responsible for the fare in case it is denied or the system is down. We need to know the few rights we have to act properly and not loose our fares.
khan jabar 03.08.08 at 12:41 pm
WE need live map so the passengers can search where are the going .Not this map which only tells you where are right now ,not worht it.
usman 03.09.08 at 7:38 pm
they should make a way, that the passenger who wants to use a card, they should swipe the card before the ride starts to make sure that the card is being accepted and has a good balance so it wouldnt be denied……but my being a taxi driver and a former hacker i hate the gps…..so much that i actually went out of my way and i hacked into it and when i tried to go on internet explorer it said creative labs card in it and i was able to go to a couple of sites….i figure its ok to do that since its my cab?