WiFi suspended at big UK train stations after 'cybersecurity incident'

Really depends on the devs. I've seen it go both ways. But you are right, most retests I have done after the pentest issues were fixed is weird. They actively engineer around our suggested fixes instead of actually doing the work they are told to do

"worse" doesn't ring true, they have really just stayed the same. IMO this is fine, as I've not needed to use a machine in a year or two. You buy rail tickets on your phone with QR code tickets and tap in and out of TFL with your choice of phone/watch/card/oyster. We don't need to revamp the buying a physical ticket machines, why? Who do they serve, only really tourists who don't know they just need to use thier card to tap in or use a website or app to buy either QR code or pick up train tickets.

The TfL contactless system doesn’t generally overcharge, as long as you properly tap-in and tap-out.

The system as a whole seems to be designed to prevent overcharging at all costs. In situations where is ambiguous what you should be charged (there’s a number of interesting edge-cases), the system always charges you the lowest possible amount. Even in the event of user error (such as forgetting to tap-out), the system does it best the guess what you did, such as looking at your history and assuming you meant to tapped out at a station you normally use, or looking for a station where the gates where left open (due to a major event, overcrowding concern, evacuation etc), and assuming you left the system there.

The contactless system is substantially more capable for handling these issues correctly, and generally better at charging less, than the older Oyster system.

For various reasons, the contactless system sadly still lags behind Oyster, with basic functionality like NR discount entitlements missing and showing no signs of emerging anytime soon. The physical infrastructure, like the gatelines, are all still controlled by Cubic as well.

Even in terms of security, you have TfL deciding to adopt SMS for multi-factor authentication (no TOTP/HOTP/push-based MFA) for their contactless portal. Which they only started enforcing a year ago. I don't get how anybody can defend decisions like these. We've known SMS is unsuitable for this use-case for years.

Do you know if Cubic or Tfl continues the development for contactless system?

The problem is I found it very slow. Compared to most East Asia / Japan contactless system. Where in 95% of cases complete the whole transition in less than 100ms.

> What happened is that some kid phoned up helpdesk and said they were x and they had lost their phone, can you please help me to reset my password and 2fa (because the phone was nicked, its standard operating procedure right?)

Then the policies that they had in place for these eventualities were insufficient.

> From there they managed to SSO into critical shit.

We're all speculating here without many details of what actually happened, but the questions I'd be asking are:

- Was the person whose account was compromised somebody that needed to routinely have access to Oyster card refund information?

- Was the person whose account was compromised somebody that needed to routinely have access to Oyster card refund information for a handful of customers, as part of working in a support role?

- Was the person whose account was compromised somebody that needed to have access to Oyster card refund for five thousand distinct customers, accessed in a very short timeframe? Why didn't security controls exist that prevented exfiltration of those volumes of data?

- Why were TfL directly storing bank account details in the first place when there are better-equipped partners who have experience securing data that could have handled this?

- Why is TfL so awful at providing Oyster refunds in the first place? They could very easily make it so you could get refunds back onto a Debit/Credit card (without needing to store the PAN), but instead the only options they give you are bank account/sort code (which have to be given over the phone) or back onto the Oyster card - needing to be physically collected within 3 to 4 days or the refund gets "lost" - completely useless if you don't live in London.

> that shit is _hard_, even harder for a safety critical place like TFL. They have something like 40k employees, and a whole bunch of disparate systems.

I don't care, it's not good enough. Everybody in London has no choice but to share some amounts of data with TfL if they want to use the transport system. They've shown they're incompetent time and time again. They can't do the work they've committed to do on-time either, and we pay them shedloads of public funds for this level of service.

> What happened is that some kid phoned up helpdesk and said they were x and they had lost their phone, can you please help me to reset my password and 2fa (because the phone was nicked, its standard operating procedure right?)

Do you have a source for this?

I'd agree with this. At some point in the past, a final-salary defined benefit pension and the job security may have gone some way to levelling the playing field a bit.

The theory is right but in practice none of this is really run by the public sector anything remotely difficult is just contracted out to the private sector and they go with basically the cheapest bid from a "big" company. In this case it's telent and they probably just brought a captive portal product (the cheapest, of course ;)) and it got hacked.

And on parts of the Northern Line (between Euston and Charring Cross) there's now even 5G down there.

The issue with on train wifi is the companies see it as a pure cost centre and aren't incentivised to provide a quality product there. Some have even turned it off!

The on train hardware is usually half decent but they typically go with the cheapest tender for the operation of it.

This is the kind of BS you get when you have private companies run parts of your infrastructure. Imagine the productivity gain of millions of journeys where users can reliably access fast internet. In most cases stumping for a quality multi sim provider, maybe a 5G upgrade and decent bandwidth allowance and support would get you most the way to that. WCML for example already has really decent coverage on my phone doing tethering but somehow onboard wifi is unusable, despite the train having multi sim multi radio hardware and special external antennas.

Visitors to the UK might be charged roaming fees by their foreign mobile provider.

I'd guess there are still a subset of people with very limited data plans, or who don't have plans at all and use tablets or laptops.

If you can offload an amount of those people from asking your staff questions about train times and connections and get them checking online instead, I would guess that could be a cost saving?

I suppose it is also something that helps make the train more appealing than other forms of transport. If I know I can turn up 30 mins early and get some work done (or just browse the web), then that help cement the train as a nicer way to travel compared to a bus, or even a car where you cannot work at all if you are the driver.

Tourism - and if you've run out of roaming data or are being charged per MB then it's actually very useful.

We need a better way of doing it though, this unauthenticated network with a captive portal running on some embedded device or some php on a cloud server somewhere is total junk.

There is wifi that is authed via your mobile provider on TFL (now mostly redundant as lines now have 4g/5g) but I think it's actually also piped back to your mobile provider and usage comes out of your allowance if you've got one. What if we were able to do the auth step via sim (so we know who is on the network if there's bad traffic) but terminated the traffic ourselves (i.e doesn't come out of your mobile allowance or get piped to them in the first place).

Please give me a link, I highly doubt that.

These days they can use ChatGPT and whatnot to track down all the pesky errors and omissions you encounter when trying to use those guides on anything but the exact setting the person making the guide is showcasing in their example.

But yeah, script kiddies learn their skills online, same as it's always been.

Doctoring web requests with Burp and the like in order to circumvent arbitrary input restrictions on the client side is an absolute godsend when dealing with crappy web forms, legacy software, etc.

Yes but mainline stations it's captive portal open wifi. I think it literally is called network rail free wifi or something.