I am on the Citizen's Advisory Council for the SFMTA. I also happen to be specialize in computer security! I have asked SFMTA staff to have this item put on a committee agenda so we can get a full post mortem of what happened. It will likely be a few months before we get any real details.
Since people are asking...
The ticket kiosks run Win2k, the subway display screens run Flash (on Win2k I imagine), and the SFMuniCentral display is DOS under OS/2. For the latter, it might be running Linux now. The subway system is in the middle of a major modernization project since SF is going to open a new subway line with new cars in the next 18 months.
Why is the response so slow? I mean why can't they just replace everything in the ticket kiosks and then restore the central system from a backup on new machines?
100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.
As another random fact, the screens in BART stations showing upcoming departures are ASP.Net websites. I once saw the generic error config page (At least I hope I am remembering correctly that it was the generic user facing error page).
Fix the SFMTA would be a great hackathon project. I'm sure there's more than a few willing and talented people in the city to lend their skills to solving this immediate problem...
I think this is a good idea, but there isn't much in the way of API access or documentation for SFMTA systems. Beyond Nextbus, there is no API to poll for data. Nearly everything requires a request for information or Sunshine request, where a staff member stops what they are doing, goes to an internal system (Trapeze, for example), does a C&P, removes HR info, and passes it along.
That being said, some of the newer SFMTA projects do have a data stream to at least scrape, like road construction schedules, Muni Forward, and Vision Zero collision data. There is a whole lot more data available, most of it released quarterly, I could help get access too as well.
Looks like it tinkered with the MBR, but I'm very curious as to why it's also saying "Missing operating system" under the message. Maybe the string is part of the replaced MBR for added effect?
I've always been curious about the type of embedded OS that ATMs and ticket kiosks use. Most of the time, it seems to be an unpatched version of Windows.
Does anyone know what the SFMTA runs on their kiosks?
Not sure about SFMTA but I know BART at Fremont is running Windows9x for its pay machines. Once I clicked the "add fare" button too fast and somehow dropped to desktop.
I made software for a few museum exhibitions with multiple interactive terminals (sometimes up to 30). At first we used WinXP/Flash, and later moved to Linux/Opera (to cut licensing fees and shorten development time). That was 6 years ago.
[+] [-] pdx6|9 years ago|reply
Since people are asking...
The ticket kiosks run Win2k, the subway display screens run Flash (on Win2k I imagine), and the SFMuniCentral display is DOS under OS/2. For the latter, it might be running Linux now. The subway system is in the middle of a major modernization project since SF is going to open a new subway line with new cars in the next 18 months.
[+] [-] dkarapetyan|9 years ago|reply
100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.
[+] [-] ZanyProgrammer|9 years ago|reply
[+] [-] kaiku|9 years ago|reply
[+] [-] pdx6|9 years ago|reply
That being said, some of the newer SFMTA projects do have a data stream to at least scrape, like road construction schedules, Muni Forward, and Vision Zero collision data. There is a whole lot more data available, most of it released quarterly, I could help get access too as well.
[+] [-] Animats|9 years ago|reply
[1] http://www.sfmunicentral.com/sfmunicentral_Snapshot_Objects/...
[+] [-] Animats|9 years ago|reply
[1] http://www.sfmunicentral.com/sfmunicentral_Snapshot_Objects/...
[+] [-] i336_|9 years ago|reply
Looks like it tinkered with the MBR, but I'm very curious as to why it's also saying "Missing operating system" under the message. Maybe the string is part of the replaced MBR for added effect?
Also, dupe thread with more comments: https://news.ycombinator.com/item?id=13050262 - maybe those comments could be moved over here.
[+] [-] yarou|9 years ago|reply
Does anyone know what the SFMTA runs on their kiosks?
[+] [-] web007|9 years ago|reply
[+] [-] some1else|9 years ago|reply
[+] [-] xenadu02|9 years ago|reply
Making life worse through technology, welcome to the future!
[+] [-] Animats|9 years ago|reply
“You Hacked, ALL Data Encrypted. Contact For Key([email protected])ID:681 ,Enter.”
[+] [-] s_q_b|9 years ago|reply
1. He's not Russian.
2. This a good hacker but an amateur at OPSEC.
[+] [-] kbaker|9 years ago|reply
http://www.sfexaminer.com/hacked-appears-muni-stations-fare-...
[+] [-] jrspence|9 years ago|reply
[+] [-] AgentME|9 years ago|reply
[+] [-] tedunangst|9 years ago|reply
[+] [-] iask|9 years ago|reply