Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity
    • Mobile

    MBTA Loses Gag Order Battle Against MIT Security Researchers

    By
    Brian Prince
    -
    August 19, 2008
    Share
    Facebook
    Twitter
    Linkedin

      A federal judge decided today not to extend the gag order imposed on three students to prevent them from releasing details of vulnerabilities in the Massachusetts Bay Transportation Authority ticketing system.

      The three students-Zack Anderson, RJ Ryan and Alessandro Chiesa-all hail from MIT (Massachusetts Institute of Technology) and were set to reveal details of their discovery at the Defcon conference in Las Vegas earlier in August. Before they could, however, the MBTA filed a lawsuit against both them and MIT in U.S. district court in Massachusetts and a judge issued a 10-day gag order Aug. 9 to block the students from making the presentation.

      In the Aug. 19 hearing, the judge denied a request by the MBTA to impose a five-month injunction blocking the students from releasing details of the attack while the agency fixes the issue. The students’ presentation reportedly illustrated a way to produce fare cards, reverse-engineer the cards’ magnetic stripes and hack RFID (radio-frequency identification) cards.

      The decision, however, does not necessarily end the controversy. There is still the lawsuit, and there have been no reports as of yet that the city is dropping it. There is also no shortage of opinions on whether or not the trio should have been allowed to present their findings at the security conference before the MBTA could address the issue.

      “This is a plain and simple case of irresponsible disclosure,” said Eric Ogren, principal analyst with the Ogren Group. “Other than fame for the presenters and MIT, what good comes out of this research? I do not see how the world is a better place with the publicity of defrauding transit systems. There is nothing responsible about this-I see this as a malicious action.”

      The students did notify the MBTA of their findings a few days prior to their scheduled appearance at Defcon, which Forrester Research analyst Chenxi Wang said is proper security etiquette for researchers who find vulnerabilities. However, the issue gets more complex after that if the organization wants to prohibit the researcher from discussing the vulnerability, she said.

      “Is it an irresponsible disclosure after the researcher has notified the company-in this case MBTA-but discloses the vulnerability before it is fixed?” Wang asked. “What if it takes a long time for the company to fix the vulnerability?”

      Wang continued, “In this particular case, it is arguable whether the vulnerability they discovered was critical or not. How many people would hack the RFID card to get free rides on the T? The MBTA is probably better off letting them publish the result and work with the researchers to fix the vulnerability rather than pursuing injunction in the court system.”

      Brian Prince

      MOST POPULAR ARTICLES

      Big Data and Analytics

      Alteryx’s Suresh Vittal on the Democratization of...

      James Maguire - May 31, 2022 0
      I spoke with Suresh Vittal, Chief Product Officer at Alteryx, about the industry mega-shift toward making data analytics tools accessible to a company’s complete...
      Read more
      Cybersecurity

      Visa’s Michael Jabbara on Cybersecurity and Digital...

      James Maguire - May 17, 2022 0
      I spoke with Michael Jabbara, VP and Global Head of Fraud Services at Visa, about the cybersecurity technology used to ensure the safe transfer...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      Applications

      Cisco’s Thimaya Subaiya on Customer Experience in...

      James Maguire - May 10, 2022 0
      I spoke with Thimaya Subaiya, SVP and GM of Global Customer Experience at Cisco, about the factors that create good customer experience – and...
      Read more
      Big Data and Analytics

      GoodData CEO Roman Stanek on Business Intelligence...

      James Maguire - May 4, 2022 0
      I spoke with Roman Stanek, CEO of GoodData, about business intelligence, data as a service, and the frustration that many executives have with data...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×