Def Con speaker [pukingmonkey] has spent quite a bit of time studying methods government and law enforcement use to track private citizens’ vehicles on the roads. One of the major tracking methods is E-ZPass, an electronic toll collection system used in several states around the country. [pukingmonkey] cracked open his E-ZPass tag to find a relatively basic circuit. In his DEF CON presentation (PDF), he notes you shouldn’t do this to your own tag, as tags are legally not the property of the user.
The tag uses a 3.6 volt long life battery to operate. When idle, the tag only draws 8 microamps. During reads, current draw jumps to 0.3 mA. Armed with this information, it was relatively simple to add a current detecting circuit that outputs a pulse on tag reads. Pulses are then fed into a toy cow, which lights up and “Moos” on each read.
With the circuit complete, it was time for some wardriving around New York City. In [pukingmonkey's] rather harrowing drive between Times Square and Madison Square Garden, (a route with no tolls) the cow was milked 6 separate times. New York Department of Transportation has long stated that these reads are used only to track traffic congestion. Even so, we’d suggest putting your tag away in an anti-static bag (Faraday cage) when not approaching a toll.
[via Boing Boing]Filed under: misc hacks, security hacks, wireless hacks
