login

Every ride you take - Hacking a City’s Public Transportation

Let's talk about some critical infrastructure that millions of people use every day: Public transportation.
In this talk, I’ll present some findings that I discovered in the public transportation ecosystem of one of the largest cities in Argentina, impacting more than 1.5 million people daily. Reading code, chaining vulnerabilities, weak access controls, and flawed internal designs, I got full access to core mobility systems, from buses to taxis, including DVRs, transport cards, user data, real-time tracking and administrative panels. We’ll walk through the technical exploitation path, the real-world impact and the lessons learned.

Description

The talk is divided into 12 stages, showing step-by-step attack chains. In the first stages, I’ll relate the origin of the idea, provide information about the company, recon, and exposed .git directories that revealed source code, hardcoded credentials, and references to internal services and repositories, as well as some SQLi.

In Stage 3, I’ll present a Windows-based DVR system deployed on urban buses. Using a user with almost no permissions, I obtained an LFI. Using information from vendor manuals, documentation screenshots, and recovered internal paths, .frm and .ibd files were obtained and reconstructed in a Docker container. This allowed the recovery of credentials, leading to full administrative access to the DVR platform (DEMO).

With this access, it was possible to manage users and drivers, access sensitive internal data, and remotely view and control cameras and microphones installed inside buses. After some time, I figured out that this system was also used in 11 provinces, turning a local issue into a nationwide one.

In Stage 6, the research returns to the exposed .git files, where a private GitLab URL was found. From there, access to CI/CD pipelines, cron jobs, and a Docker registry was obtained.

While analyzing the cron jobs, multiple hardcoded credentials were found, including access to banking-related services and FTP servers. By analyzing the code and the .lock files, it was possible to upload a file to the FTP server, which was later pulled and executed by internal processes, resulting in RCE on the server.

Stage 8 marks the full infrastructure compromise. Using the reverse shell, it was possible to enumerate internal services, access production databases, bypass network segmentation, and identify additional systems.

Within the bus administration platform, access was obtained to the backbone of public transportation, managing drivers, users, companies, ticketing systems, real-time vehicle tracking, and remote operational controls such as fuel cutoff. Unlike the DVR platform, this system operates at city, regional, and national scale.

In Stage 10, I’ll show other systems that got access, for example: taxi applications and a large-scale bike rental system, affecting approximately 710 taxi drivers and more than 115,000 registered bike service users.

The final system explored was a government-related server containing highly sensitive information, including driver licenses, identification numbers, addresses, phone numbers, and operational records for taxi, bus, and private transport drivers. This was the point where I decided to stop the investigation and report it immediately.

The talk ends with the responsible disclosure process, challenges encountered when reporting vulnerabilities across multiple organizations and public entities, and lessons learned about securing critical infrastructure. The goal is to show how chaining basic vulnerabilities can lead to systemic compromise, and why public mobility systems deserve the same security attention as traditional critical infrastructure. Also I would like to encourage new generations to do ethical hacking and help build stronger relationships between hackers and companies.

Outline

  • Stage 0
  • Whoami
  • Disclaimer
  • Introduction
  • Stage 1
  • Landing page
  • .git folders enumeration
  • SQLi
  • Stage 2: Exposed .git
  • Hardcoded creds
  • Internal services
  • GitLab url in .git/config
  • Stage 3: DVR System
  • Intro
  • Internal paths discovery
  • LFI
  • Stage 4: DVR priv escalation
  • LFI to get .frm/.ibd
  • DB recovery (DEMO)
  • Stage 5: DVR Admin access
  • User and drivers data exposure
  • Internal system data
  • Access to all cameras & microphones
  • National presence
  • Stage 6: GitLab repos & CI/CD
  • Public repos
  • Public pipelines
  • Docker registry exposure
  • Stage 7: Cron + FTP
  • Cron job download file from FTP
  • Shell upload to the FTP server
  • .lock execution control
  • Stage 8: Reverse shell
  • Internal network access
  • Full database access
  • New systems discovered
  • Stage 9: Bus administration system
  • Access to users/drivers/company data
  • Ticketing & balance management
  • City+Regional+National buses
  • Control the buses remotely
  • Stage 10: Additional systems
  • APKs
  • Taxi apps
  • Bike rental
  • Full administrative access
  • Stage 11: Gov-related server
  • Taxi, buses and private transport records
  • Driver license, IDs, address, phones, etc
  • Stage 12: Ending
  • Disclosure process
  • Challenges & responses
  • Conclusions
  • Q&A