Motorist wins case after maths whizzes break speed camera code

Sydney Herald ^ | August 11, 2005 | Andrew Clark

[snowsislander]

A team of Chinese maths enthusiasts have thrown NSW's speed cameras system into disarray by cracking the technology used to store data about errant motorists.

The NRMA has called for a full audit of the way the state's 110 enforcement cameras are used after a motorist escaped a conviction by claiming that data was vulnerable to hackers.

A Sydney magistrate, Laurence Lawson, threw out the case because the Roads and Traffic Authority failed to find an expert to testify that its speed camera images were secure.

The motorist's defence lawyer, Denis Mirabilis, argued successfully that an algorithm known as MD5, which is used to store the time, date, place, numberplate and speed of cars caught on camera, was a discredited piece of technology.

Mr Mirabilis yesterday said he had received more than 100 inquiries from motorists anxious to use the same defence. "People have shown it [the algorithm] has been hacked and it's open to viruses."

Designed in the early 1990s by an American academic, MD5 safeguards against tampering by turning information into a 128-bit sequence of digits. However, researchers from China's Shandong University have proved it is possible to store conflicting pieces of information as the same MD5 sequence.

Nick Ellsmore, an encryption expert at the consultancy SIFT, said this theoretically meant the RTA could change the speed at which a car was recorded and retain the same code.

"Since the research came out, we've been recommending that clients move away from MD5 and we've certainly recommended that people don't use it for new applications," he said.

The NRMA said it was crucial the public had confidence in convictions. Its policy specialist, Lisa McGill, said: "We want a full audit and a review of the system to ensure that it is working appropriately."

The RTA's spokesman, Paul Willoughby, rejected the decision as a one-off: "No one, in relation to court cases, can be a hundred per cent sure they're going to win a hundred per cent of the time."

NSW's weekly take from the cameras is more than $1 million.

Meanwhile, the RTA denied reports that cameras catching toll evaders in the Harbour Tunnel are routinely turned off.

[snowsislander]

As a sidenote, I happened to do a "preview" of this page prior to adding html tags, and it looked just fine, despite the usual label warning "Body of Thread HTML okay REQUIRED".

[spetznaz]

Nice. Sorry, but I abhor traffic cameras. Nice to know that math (or maths, if you use Queen's English) is still helping out the world one formula at a time.

[Peter vE]

NSW's weekly take from the cameras is more than $1 million.

There's the key line in the story.

[coloradan]

It's not about public safety, it's about revenue enhancement.

[glorgau]

The set of "different sequences" that can be stored with the same MD5 key is finite. What the guy should have had to prove is that the speed number presented to the court was possible given the actual speed that he claimed to have been traveling.
All that said, good for him in coming up with a novel arguement for beating a traffic ticket. ;-)

[Moral Hazard]

". What the guy should have had to prove is that the speed number presented to the court was possible given the actual speed that he claimed to have been traveling."

It would have been an interesting intellectual exercise, but he would have to have access to the original data to prove it. If he did, there's easily available code to hack the speed value to whatever he wants it to be and still get the same hash value.

The problem would be that some other part of the data would end up being turned into garbage data to correct for the change in the speed data. His best hope would be if there was some empty space in the data record, like uninitialized space after an array, that he could modify.

[andyk]

People are still using MD5?

[snowsislander]

People are still using MD5?

Yes, they are. It's still in wide use as a simple checksum algorithm.

[steve86]

The body of thread is required, not the HTML tags. It was auto-formatted for you.