Local criminals hire Russians to game New York's taxi system
(2022/12/20)
- Reference: 1671571808
- News link: https://www.theregister.co.uk/2022/12/20/jrk_nyc_russian_hacking/
- Source link:
Two men have been charged for allegedly conspiring with Russian hackers to manipulate the taxi dispatch system at New York's John F. Kennedy International Airport.
Taxis may wait for several hours at the airport in a holding area before being allowed to pick up passengers. They do so because the fare into Manhattan – [1]$52 presently – or other boroughs is typically substantial enough that it's worth the wait.
Daniel Abayev, 48, and Peter Leyman, 48, are accused of altering the JFK taxi dispatch system to advance selected taxis to the front of the taxi queue in exchange for a $10 payment, according to [2]a federal indictment [PDF] made public on Tuesday.
[3]
"As alleged in the indictment, these two defendants — with the help of Russian hackers — took the Port Authority for a ride," said Damian Williams, the United States Attorney for the Southern District of New York, in [4]a statement . "For years, the defendants' hacking kept honest cab drivers from being able to pick up fares at JFK in the order in which they arrived."
[5]
[6]
The scheme proved popular with taxi drivers, some of whom were supposedly exempted from the $10 fee when they managed to recruit other drivers to participate. Abayev and Leyman are said to have helped as many 1,000 drivers per day skip the line and to have paid Russian hackers more than $100,000 for "software development," as the bank transfers were described.
Drivers are said to have learned of the scheme by word of mouth and to have coordinated with Abayev and Leyman by sending their taxi medallion numbers using an unspecified chat app.
[7]
Abayev and Leyman allegedly tried various techniques to hack the taxi dispatch system, including bribing someone to insert a flash drive containing malware into computers connected to the netowrk, or accessing the dispatch system's Wi-Fi network without authorization, and stealing tablet computers connected to the dispatch system.
[8]Uber fined $14m for lying to get customers to ditch cabs
[9]City isn't keen on 5,000 erratic, traffic-jam-causing GM robo-cars on its streets
[10]Internet pranksters send hundreds of cabs to Moscow street, cause gridlock
[11]China allows robo taxis – without backup drivers – in parts of two major cities
The court filing indicates that between November 2019 and November 2020, Abayev and Leyman used unauthorized access to manipulate the dispatch system and move specific taxis to the front of the line.
The indictment does not specify which hacking technique ultimately compromised the dispatch system. But it cites a Computer Fraud and Abuse Act violation that suggests the use of malware, specifically Title 18, [12]Section 1030 (a)(5)(A): "knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer."
Abayev and Leyman each face two counts of conspiracy to commit computer intrusion, which carry a maximum sentence of ten years in prison.
The US Attorney's Office for the Southern District of New York did not immediately respond to an inquiry to explain how the scheme was ultimately detected. The Port Authority of New York and New Jersey did not immediately respond to a request for comment.
[13]
A spokesperson for the New York City Taxi & Limousine Commission was unable to meet our deadline but suggested a comment might follow later – The Register will update this story if so. ®
Get our [14]Tech Resources
[1] https://www.jfkairport.com/to-from-airport/taxi-car-and-van-service
[2] https://www.justice.gov/usao-sdny/press-release/file/1558891/download
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.justice.gov/usao-sdny/pr/two-men-arrested-conspiring-russian-nationals-hack-taxi-dispatch-system-jfk-airport
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/12/07/uber_australia_fined_misleading_deception/
[9] https://www.theregister.com/2022/09/27/gm_cruise_robocar_safety_waiver/
[10] https://www.theregister.com/2022/09/02/russia_taxi_jam_prank/
[11] https://www.theregister.com/2022/08/08/baidu_robot_taxi_license/
[12] https://www.law.cornell.edu/uscode/text/18/1030
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
Taxis may wait for several hours at the airport in a holding area before being allowed to pick up passengers. They do so because the fare into Manhattan – [1]$52 presently – or other boroughs is typically substantial enough that it's worth the wait.
Daniel Abayev, 48, and Peter Leyman, 48, are accused of altering the JFK taxi dispatch system to advance selected taxis to the front of the taxi queue in exchange for a $10 payment, according to [2]a federal indictment [PDF] made public on Tuesday.
[3]
"As alleged in the indictment, these two defendants — with the help of Russian hackers — took the Port Authority for a ride," said Damian Williams, the United States Attorney for the Southern District of New York, in [4]a statement . "For years, the defendants' hacking kept honest cab drivers from being able to pick up fares at JFK in the order in which they arrived."
[5]
[6]
The scheme proved popular with taxi drivers, some of whom were supposedly exempted from the $10 fee when they managed to recruit other drivers to participate. Abayev and Leyman are said to have helped as many 1,000 drivers per day skip the line and to have paid Russian hackers more than $100,000 for "software development," as the bank transfers were described.
Drivers are said to have learned of the scheme by word of mouth and to have coordinated with Abayev and Leyman by sending their taxi medallion numbers using an unspecified chat app.
[7]
Abayev and Leyman allegedly tried various techniques to hack the taxi dispatch system, including bribing someone to insert a flash drive containing malware into computers connected to the netowrk, or accessing the dispatch system's Wi-Fi network without authorization, and stealing tablet computers connected to the dispatch system.
[8]Uber fined $14m for lying to get customers to ditch cabs
[9]City isn't keen on 5,000 erratic, traffic-jam-causing GM robo-cars on its streets
[10]Internet pranksters send hundreds of cabs to Moscow street, cause gridlock
[11]China allows robo taxis – without backup drivers – in parts of two major cities
The court filing indicates that between November 2019 and November 2020, Abayev and Leyman used unauthorized access to manipulate the dispatch system and move specific taxis to the front of the line.
The indictment does not specify which hacking technique ultimately compromised the dispatch system. But it cites a Computer Fraud and Abuse Act violation that suggests the use of malware, specifically Title 18, [12]Section 1030 (a)(5)(A): "knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer."
Abayev and Leyman each face two counts of conspiracy to commit computer intrusion, which carry a maximum sentence of ten years in prison.
The US Attorney's Office for the Southern District of New York did not immediately respond to an inquiry to explain how the scheme was ultimately detected. The Port Authority of New York and New Jersey did not immediately respond to a request for comment.
[13]
A spokesperson for the New York City Taxi & Limousine Commission was unable to meet our deadline but suggested a comment might follow later – The Register will update this story if so. ®
Get our [14]Tech Resources
[1] https://www.jfkairport.com/to-from-airport/taxi-car-and-van-service
[2] https://www.justice.gov/usao-sdny/press-release/file/1558891/download
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.justice.gov/usao-sdny/pr/two-men-arrested-conspiring-russian-nationals-hack-taxi-dispatch-system-jfk-airport
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/12/07/uber_australia_fined_misleading_deception/
[9] https://www.theregister.com/2022/09/27/gm_cruise_robocar_safety_waiver/
[10] https://www.theregister.com/2022/09/02/russia_taxi_jam_prank/
[11] https://www.theregister.com/2022/08/08/baidu_robot_taxi_license/
[12] https://www.law.cornell.edu/uscode/text/18/1030
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y6I@jc6WvxYdpUzeFX-6ogAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
What is this shit?
Gene Cash
Why the FUCK is it a regulated fee of over $50 to drive someone out of the airport?
As Adam Savage would say "THERE'S YER PRAHBLEM!"
How? Easy ...
"The US Attorney's Office for the Southern District of New York did not immediately respond to an inquiry to explain how the scheme was ultimately detected."
My guess is that one or more (comparatively) honest taxi drivers got fed up with watching the same dozen drivers always getting bumped up in the queue. The human brain is really good at seeing that kind of anomaly. Four or five drivers making calls to the Port Authority would probably be enough to flag it as being worth looking into.
The REAL question is why it took the Port Authority so long ... I'll bet the first complaints were rolling in within a couple weeks, a month at the outside.