SWR Contactless at Ticket Machines

(Hugh) #1

I’ve seen a few mentions of this around the forum but not a thread so if there is a dedicated one, feel free to merge!

I’ve tried to buy tickets from SWR ticket machines 4 times recently, and every time I use contactless I get an error on the card machine (but no notification in app):

IMG_20170923_053603
IMG_20170923_053603.jpg506x900 26.5 KB

BUT the best bit is (not that apparently I have loads of money in my account - I don’t!), this also crashes the ENTIRE ticket machine which then goes out of service and reboots:

IMG_20170924_203929
IMG_20170924_203929.jpg1691x951 236 KB

As I say, I’ve had this 4 times on 4 different machines in two different stations - has anyone else had problems like this? (Note: chip and pin first time works fine, if you pay by contactless then try to pay by chip and pin you won’t be able to because the machine will have frozen)

"Money Available" message using Contactless
Spain Mastercard Contactless EUR conversion
Contactless on Edinburgh trams ticket machines
New Northern Rail ticket machines freeze
(Sam Getliffe) #2

I’ve had this recently too, on numerous machines all around the South, it is a cool trick though, it just sends the entire machine into meltdown!!

(Benjamin Doherty) #3

Ha, I have never crashed the entire machine. Looks fun though.

However I have tried many times to buy my ticket using contactless at Egham station (SWR). It never works yet chip and pin always works. Strange. Plus When the south West Trains franchise was sold to the South Western Rail recently the location of the transaction has since been displaying as a random pub somewhere in scotland. Very odd.

#4

I haven’t used Monzo but contactless hasn’t worked for me on the two occasions I’ve tried with my MasterCard credit card (both directly and Apple Pay). Had to use PIN. Didn’t crash the machine though…

(Chris) #5

Hi, what card / device did you use ? I know its a daft question, but is it one you use elsewhere successfully too ?

As in Visa / MasterCard / ApplePay…

(James Murray-Ferris) #6

Now if only we could organise a mass crash of every machine then they might pay attention to it :stuck_out_tongue_closed_eyes:

(Andre Borie) #7

This is worrying - causing the whole machine to crash would probably mean there’s a way to execute code on the machine with a malicious card. :smiling_imp:

(Chris) #8

Or just the card readers response to the contactless chip has a problem and stops, locks the communications to the point of sale, so it has to be rebooted to recover.

Saw something similar with a German issued card on UK VeriFone VX810 PEDs a few years ago, it took a while, but we managed to work out that the name of the card was padded the wrong way and caused the reader to fall over.

I expect someone has read the specs differently to someone else and the card / device works on other hardware, but when ever it comes in contact with the stuff under the hood at the station causes issues.

(Hugh) #9

I’m pretty sure that’s possible actually on some badly designed POSes.

(Jamie Penman-Smithson) #10

I reported this on the in-app chat (with a photo of the great Windows 7 ‘Welcome’ screen) and they said they were looking into it. I’ve also had issues with contactless on other Verifone terminals.

(Tony Hoyle) #11

Some even run javascript on top of IE… https://pbs.twimg.com/media/DKLeKUZWsAEcrWp.jpg

An ATM compromise is just a matter of time I think, but banks take security semi seriously so it hasn’t happened yet.

(Andre Borie) #12

Better, use the exploit to put something like Cryptolocker or similar malware on the machine… :joy::joy:

(Dan) #13

Had a similar experience on two London Midland machines this morning, but I also seemed to have funds taken out of my account.

I don’t think the people waiting behind me were quite as impressed as I was that I’d managed to shut down the only two ticket machines, or that I seemed to have £14m in my current account.

#14

No, it has happened multiple times already. Of course often one has to ask whether what’s described as hack really is a hack, but given that some ATMs have USB ports, others are WiFi connected, and a very large number still run Windows XP - well …

These are just the stories that I remember off the top of my head from the last few years, and am still able to find without wasting too much time. I’m sure there is more…



It would be cool, though, if someone produced a hack that worked simply by inserting a specially crafted credit card. I haven’t heard of that yet…

#15

Yeah I had it just not accept contactless before (on the prepaid card), never had it reboot!

(Hugh) #16

That’s certainly what I was looking for :wink: There are some good Defcon talks on hacking ATMs

Interesting. If this over multiple TOCs then this implies it is an issue with the manufacturer of the machines (Scheidt & Bachmann)

(Will) #17

Can you provide the date, time and the station name where this happened?

I’ve asked SWR and they said they will investigate it.

#18

These machines run on obselete Windows XP and although installed since 2004 incorporate technology from the 1990s.

(Hugh) #19

The one I rebooted didn’t - it was Windows 7!

I’ve already tweeted them about it so hopefully they should get it sorted :slight_smile:

The more people that moan, the more likely they are to accept it is an issue with their machines.

#20

We had exactly that (huge balance and reboot) at Witley station Monday morning but with a different brand of pre pay card!