How Vulns in Global Transportation Payment Systems Cost You
Omer Attias dissects API vulnerabilities in popular mobile transit payment apps like Moovit, demonstrating fare evasion and passenger PII data leakage.
Summary
The Rise of Mobile Public Transit Ticketing
Transit agencies worldwide have rapidly adopted smartphone applications to streamline fare payments, ticket validations, and route planning across thousands of metropolitan areas.
Reverse Engineering the Moovit Mobile API
Omer Attias audits the API backend of Moovit, a mobility application serving hundreds of millions of users across 100+ countries, inspecting encrypted mobile traffic.
Exploiting Fare Validation and Payment Logic
Flaws in ticket issuance endpoints and authorization tokens allow malicious actors to generate valid transit passes without charge and manipulate billing assignments onto third-party accounts.
Harvesting Passenger Personally Identifiable Information
Insecure direct object references (IDOR) in passenger profiles allowed unauthorized extraction of customer PII, highlighting critical security requirements for smart city infrastructure.
Related talks
Main Stage·41 min
Joshua Maddux
Discovers widespread SSRF vulnerabilities introduced by Apple Pay merchant validation requirements in e-commerce applications.
Main Stage·35 min
Eaton Zveare · R Piyush
Reveals critical API authorization vulnerabilities in automotive dealer management systems that allowed national admin account creation and remote vehicle control.
Main Stage·24 min
Gregory Pickett
Demonstrates how fundamental architectural design flaws in backend APIs create exploitable vulnerabilities no patch can fully address.