paper tickets > smartcards, probably.

Following its adoption by the Department for Transport, the ITSO specification has been the legally mandated technological stack for all new smartcard ticketing systems in the United Kingdom. Many transit operators have adopted ITSO as their primary ticketing scheme as a result of the government’s endorsement and the plethora of vendors supplying ITSO-certified equipment. Despite this, there has been little research done into the security mechanisms provided by the specification. After creating a tool to interpret data stored on compliant smartcards, I compromised a public ITSO validator app by abusing backwards compatibility measures to clone a genuine smartcard and alter its contents in an unauthorised manner.

Transcript