<\/p>\n
India\u2019s mass rapid<\/span> transit systems \u2014 or metro, as it\u2019s known locally \u2014 rely on commuter smart cards that are vulnerable to exploitation and allow anyone to effectively travel for free.<\/p>\n Security researcher Nikhil Kumar Singh<\/a> discovered a bug impacting Delhi Metro\u2019s smart card system. The researcher told that the bug exploits the top-up process that allows anyone to recharge the metro train\u2019s smart card as many times as they want.<\/p>\n Singh told he discovered the bug after inadvertently getting a free top-up on his metro smart card using an add-value machine at a Delhi Metro station.<\/p>\n The bug exists, Singh says, because the metro recharge system does not properly verify payments when a traveler credits their metro smart card using a station add-value machine. He said that the lack of checks means a smart card can be tricked into thinking it was topped up even when the add-value machine says that the purchase failed. A payment in this case is marked as pending, and subsequently refunded, allowing the person to effectively ride the metro for free.<\/p>\n \u201cI tried it on Delhi Metro\u2019s system and was able to get a free recharge,\u201d Singh told . \u201cI still have to initiate a recharge by paying for it using PhonePe or Paytm, but because the recharge still remains pending, it will be refunded after 30 days. That is why it is technically free,\u201d he said.<\/p>\n Singh shared with a proof-of-concept video he recorded in February showing how a smart card can be duped into adding value to a Delhi Metro card. After better understanding the bug, the researcher reached out<\/a> to the Delhi Metro Rail Corporation (DMRC) a day later. In response, the DMRC asked Singh to share the details of the bug over email, which he did, along with a technical report and a log file demonstrating the bug in action, which has seen. On March 16, Singh received a boilerplate reply, acknowledging the receipt of his email, but did not receive any further responses.<\/p>\n Singh told that the issue, which has not been fixed, exists in the smart cards themselves. Delhi Metro relies on MiFare DESFire EV1 smart cards manufactured by Dutch chipmaker NXP Semiconductors. Other metro systems, including Bengaluru, also use the same smart card system.<\/p>\n \u201cIf the technical infrastructure is the same in other state metro trains, then this bug will work there too,\u201d Singh told .<\/p>\n It\u2019s not the first time security researchers have found issues with the same brand of smart cards. Past research found similar vulnerabilities affecting the same DESFire EV1 smart cards that Delhi Metro uses, as well as other European mass transit systems. In 2020, MiFare introduced the DESFire EV3 as its contactless solution with better security.<\/p>\n Singh suggested that the smart card bug could be fixed if the metro systems migrate to DESFire EV3 cards.<\/p>\n Three DMRC spokespeople did not answer multiple emails seeking comment. When reached, a spokesperson for NXP (via agency) was unable to provide comment by the time of publication. Bengaluru Metro Rail Corporation, the body responsible for the city\u2019s metro service, also did not comment.<\/p>\n<\/div>\n