Security researcher Nate Lawson has found that the California Bay Area's FasTrak toll transponders have some significant privacy problems. The RFID devices are designed to receive and transmit data to allow for stop-free tollways, but Lawson's research found that someone with the right know-how and an RFID reader could walk around a parking lot and steal IDs from the transponders in parked cars. The stolen IDs could then be written to another transponder, allowing the thief to charge their tolls to the account of the unsuspecting victim, giving the hackers a free ride. But what is perhaps more unsettling is the ability to completely wipe information off victims' transponders, since the units support unauthenticated over-the-air upgrading.
Imagine the chaos that would ensue if a large number of people had their toll transponders cease to function. One possible fix would be for the existing cameras (that snap photos of cars without transponders) to take photos of random cars in an effort to catch the occasional RFID pirate, but any changes to the actual transponders would have to be passed through the California legislative system. Until then, you may want to just pay cash. [hackaday] (Hat tip to Fabienne!)