The kids are alright

"High school students looking for free rides on the T usually just hop the fare gates. But four students at Medford Vocational Technical High School did it the hard way.

Seniors Matty Harris, Noah Gibson, and Zack Bertocchi, and junior Scott Campbell found a way to boost the cash value of any CharlieCard without paying a dime, using either a homemade electronic “vending machine” or a custom app running on a standard Android smartphone.

“We’re able to copy cards infinitely,” said Harris.

The typical Android phone contains a chip that transmits a low-power radio signal that allows Android owners to pay for coffee, snacks, gasoline, and other goods with their phone via the Google Pay service. After two years of research, the students found they could use that same chip to rewrite the data on a CharlieCard, adding up to $300 of credit to a card purchased for just 25 cents.

*snip*

"But instead of abusing their new-found power, the students reached out to MBTA cybersecurity officials in January and told them about it. Scott Margolis, the MBTA’s chief information security officer, said that without the students’ help, the T’s systems would have been defenseless against this newly discovered attack."

https://www.bostonglobe.com/2023/09/01/business/charliecard-hackers-high-schoolers/