Skip to content
Snippets Groups Projects
Select Git revision
  • no-masters default protected
1 result
freerider's avatar
Update README.md
freerider authored
bcbfef4b
History
freerider's avatar bcbfef4b
History
Name Last commit Last update
LICENSE
PRIVACY.md
README.md
README.md

Freeriders' Handbook (TTC Edition)

Dedicated to all freeriders, particularly [TTC fare inspector lookout], [Planka.nu] and [Flea Market Socialist]

WHAT IS METROLINX

Network of transit checkpoints for tapping targeted surveillance metro card.

Or: Metrolinx is a Crown agency of the Government of Ontario that manages and integrates road and public transport in the Greater Toronto and Hamilton Area (GTHA), which comprises much of Ontario's Golden Horseshoe region.

WHAT IS PRESTO

Exploitable gateways to freeriding.

Or: Presto card is a contactless smart card automated fare collection system used on participating public transit systems in the province of Ontario, Canada, specifically in Greater Toronto, Hamilton, and Ottawa.

WHAT IS TTC

Toronto Transit Commission

PRESTO PRIVACY 101

FREERIDERS' PRIVACY (TTC Edition)

  • NEVER LINK YOUR IDENTITY TO THE PRESTO CARD
  • PAY AND REFILL YOUR PRESTO WITH CASH
  • WHEN NECESSARY, SWITCH IT ONCE A WHILE

EXPLOITS OF TTC FREERIDING

FILMSY DISABILITY GATES

HOW-TO VIDEO

ONE-PERSON GATE-BRUTEFORCE (10 SEC to 1 MIN)

  1. WALK TOWARD THE GATE
  2. IGNORE THE ERROR SOUND
  3. PUT YOUR DOMINANT FOOT INSIDE THE DISABILITY GATE
  4. LEAN YOUR BODY TOWARD THE DOMINANT FOOT AND PUSH THROUGH
  5. SOME PAIN FOR FIRST-TIMER, KEEP PUSHING WHILE USE YOUR HAND TO HELP
  6. WHILE ALSO LIFT YOUR REMAINING FOOT UP AND WALK INSIDE THE GATE
  7. KEEP IGNORING THE ERROR AND KEEP WALKING.

MULTI-PEOPLE GATE-BRUTEFORCE (MUTUAL AID)

  1. WALK TOWARD THE GATE
  2. IGNORE THE ERROR SOUND
  3. PUT YOUR DOMINANT FOOT INSIDE THE DISABILITY GATE
  4. LEAN YOUR BODY TOWARD THE DOMINANT FOOT AND PUSH THROUGH
  5. SOME PAIN FOR FIRST-TIMER, KEEP PUSHING WHILE USE YOUR HAND TO HELP
  6. WHILE ALSO LIFT YOUR REMAINING FOOT UP AND WALK INSIDE THE GATE
  7. KEEP IGNORING THE ERROR
  8. ONCE INSIDE FIRST-PERSON STANDS AT THE GATE LASER SENSOR (INSIDE BLACK SQUARES)
  9. ONCE INSIDE LASER SENSOR BLOCKED THE GATE WILL KEEP OPENING WHILE ERROR BLARING
  10. KEEP IT OPEN UNTIL EVERYONE INSIDE.

SCREW YOUR GATE SENSOR (DIRECT ACTION)

  1. WALK TOWARD THE GATE WITH YOUR [DUCT TAPE + WORK GLOVES + MASK] PPE
  2. IGNORE THE ERROR SOUND
  3. PUT YOUR DOMINANT FOOT INSIDE THE DISABILITY GATE
  4. LEAN YOUR BODY TOWARD THE DOMINANT FOOT AND PUSH THROUGH
  5. SOME PAIN FOR FIRST-TIMER, KEEP PUSHING WHILE USE YOUR HAND TO HELP
  6. WHILE ALSO LIFT YOUR REMAINING FOOT UP AND WALK INSIDE THE GATE
  7. KEEP IGNORING THE ERROR
  8. ONCE INSIDE FIRST-PERSON STANDS AT THE GATE LASER SENSOR (INSIDE BLACK SQUARES)
  9. ONCE INSIDE LASER SENSOR BLOCKED THE GATE WILL KEEP OPENING WHILE ERROR BLARING
  10. KEEP IT OPEN UNTIL EVERYONE INSIDE
  11. RIP A SQUARE OF DUCT TAPE
  12. SLAP IT ON THE INSIDE SQUARE SENSOR TO COVER ALL OF IT
  13. PERMANENT STICKING WITH Adhesive
  14. YOU ONLY NEED TO COVER ONE INSIDE SQUARE OF SENSOR
  15. WHAT IF YOU COVER ALL SENSORS IN ALMOST EVERY STATION?
  16. ???
  17. SOLIDARITY!
BEST REAR ENTRANCE: LAWRENCE STATION [NORTH ENRANCE]
  • ✔️ Rare Fare Pork
  • ✔️ Low Security
  • ✔️ NIMBYs Don't Climb Staircases

CHALLENGING REAR ENTRANCE: [SPADINA STATION]
  • ☠️ FARE PORK HEADQUARTER
  • ☠️ MEDIUM SECURITY
  • ✔️ TO STREETCARS - ACT CASUAL 🤫️

MULTI-REAR ENTRANCES [SHEPPARD-YONGE STATION]
  • ✔️ OPEN-GATE BUS STATION
  • ✔️ NORTH REAR GATE (BEHIND MCD)
  • ✔️ SOUTH REAR GATE (BEHIND PRESO TEA)
  • ✔️ HULLMARK CENTRE
  • 🤫️ FARE PORK FREQUENTS
  • ☠️ MEDIUM SECURITY

TAILGATING

How to tailgate the Presto Subway Gates:

  1. Wait for a person to tap their Presto card
  2. As soon as the gates open walk behind that person
  3. Keep following them until you get inside
  4. As long as the sensor blocked or gate forced open
  5. Tailgating works with multi-people.
Image link is now a video

How to tailgate the Buses:

@iamprince_rg (✊🏽️)

  1. Wait for someone to get off the bus rear door
  2. As soon as the person leave hold the rear door to keep it open
  3. Let yourself into the bus and the forced rear door will close on its own
  4. Tip works better and covert in rush hours because driver would be too busy to mind.

OTHER TECHNIQUES

CHILD PASS

Presto Child Pass is unlimited traveling time because of the transit loophole that allow children under ages of 12 to ride for free and they can be obtained at Shopper Drug Mart.

Doggo's Sensor Blocking

  1. Train doggo friend to get in and block the inside square sensor
  2. As long as doggo stay block the sensor you can get inside
  3. Pet the doggo and give your friend some treat.

Using The Dangling Bag

  1. Dangle your day bag on the other side of the gate to block out the square sensor
  2. Walk in when gates open
  3. ???
  4. Profit!

USING FOOT

  1. Put a foot to the other side of the gates until parallel with the square sensor
  2. Once square sensor blocked out the gates will open
  3. This technique worked when they first rolled out the Presto gates
  4. Still works in some gates but longer sensor timeout has been setup to prevent this
  5. https://player.vimeo.com/video/271581411?h=cff03c7e7

EVADING FARE INSPECTORS

TTC fare inspectors usually stick to main stations but there are a few routes they frequents:

  • Fare cops start shift at 1138 Bathurst and from there they head to others.
  • Spadina Station is their HQ where they change shift & prey on people at streetcar platform. The 510 and 511 routes are frequently patrolled by Fare Inspection.
  • Bathurst Station is where they prey on people at streetcar platform, usually on weekends and rush hour but also often take the 7 Bathurst going Northbound to St. Clair / Bathurst to patrol the St. Clair streetcar lines. Sometime they will also get off at Dupont.
  • Sheppard-Yonge Station at the main entrance ticket booths and rear ticket gates
  • All terminal stations particularly Downtown Core.
  • Union and Ossington are frequent by fare cops.

Communications of TTC Special Constable / Fare Inspector:

Before their transition to digital Tetra after 2019, fare cops used analog radio service that were listenable on Broadcastify. At the moment, the only live feed still available is the Toronto Transit Control that included management, maintenance and security, but most of their Tetra comms is independent from control talkgroups.

STRATEGIES WHEN ENCOUNTERING FARE COPS

EXITING STREETCARS

When a streetcar arrived at a station platform fare cops (in pair of two or three) will block the first exit of the streetcar nearest to the station platform, if they patrol in three the third cop will block the middle exit. That leaves the furthest exits free from their reach. Act casual but walk quickly and blend with the crowd. Run when you need to.

RIDING STREETCARS

On rare occasions they will check for ticket on the transit just to fuck with people. When this happens, exit the vehicle at the nearest stop, with the closest exit doors you can find. TTC streetcar doors don't automatically open unless button pressed, or when it arrives at a stop, you will have to long press the door button beforehand to make it open as soon as the streetcar arrived at a stop. Run when you need to.

TRANSFER AS TEMPORARY PASS

Often people leave paper transfers on the ground or chair when they finished using them. These paper transfers have half/one-hour validity from the time of its purchase. Fare cops sometime will waive you pass when they don't check the validity of the transfers except on rush hour. A list of transfer locations.

HACKING PRESTO

RELAY ATTACK (NFC)

WITH PHONE

What you need:

WITH TRANSCEIVERS

What you need:

  • Presto uses MIFARE DESFire EV1 4k for NFC, which operates at 13.56 MHz.
  • MIFARE DESFire EV1 DOCUMENTATIONS: 1, 2, 3 and 4
  • NFC/SDR transceivers. The recommended budget open-source tool for this is Flipper Zero.
  • Proxmark3 is pricier option but offers more freedom to exploit Presto freqs.
  • Blank magnetic cards or programmable key fobs with equivalent frequencies range
  • Or you could build an Arduino NFC reader

How this works:

  1. Find your target's card
  2. Capture the signal with the NFC reader
  3. Clone the signal to programmable card/key fob
  4. Confirm your cloned batch.

PRESTO DENIAL-OF-SERVICE

THIS 0DAY IS WORK-IN-PROGRESS, FOR EDUCATIONAL PURPOSE ONLY

There is a bug in Presto machine that can crash all other machines on the same cluster. If you have a Proxmark3 or Flipper Zero, you can program the Presto card with null or blank input, but with valid send signal. Presto machine use Microsoft Windows CE 7.0 and is still possible vulnerable to something like CVE-2006-6908 with BoF denial-of-service. Not every Presto machine OS gets patched regularly.

The test way would by programming the null inputs or exploit payloads into the card signal, tap the card on a bus Presto machine and there is two ways this gonna crash: if the card get green light, this would be silent DoS, it won't show the error until the next person tap their valid card. If it shows error your card either worked or the command was denied.