#schneier-on-security

prplcdclnw@diasp.eu

Hacking the “Bike Angels” System for Moving Bikeshares

This is very close to something we used to do in the Navy. See below.

https://www.schneier.com/blog/archives/2024/09/hacking-the-bike-angels-system-for-moving-bikeshares.html

I always like a good hack. And this story delivers. Basically, the New York City bikeshare program has a system to reward people who move bicycles from full stations to empty ones. By deliberately moving bikes to create artificial problems, and exploiting exactly how the system calculates rewards, some people are making a lot of money.

At 10 a.m. on a Tuesday last month, seven Bike Angels descended on the docking station at Broadway and 53rd Street, across from the Ed Sullivan Theater. Each rider used his own special blue key -­- a reward from Citi Bike—­ to unlock a bike. He rode it one block east, to Seventh Avenue. He docked, ran back to Broadway, unlocked another bike and made the trip again.\
\
By 10:14, the crew had created an algorithmically perfect situation: One station 100 percent full, a short block from another station 100 percent empty. The timing was crucial, because every 15 minutes, Lyft’s algorithm resets, assigning new point values to every bike move.\
\
The clock struck 10:15. The algorithm, mistaking this manufactured setup for a true emergency, offered the maximum incentive: $4.80 for every bike returned to the Ed Sullivan Theater. The men switched direction, running east and pedaling west.

OK. So here's the Navy thing mentioned above. It was called a "trim party." On nuclear-powered submarines there was a watch station in the Control Room called Chief of the Watch (the COW, not to be confused with the COB, Chief of the Boat^1^, which was a job title, not a watch station, but I digress). One of the jobs of the COW was to keep the submarine in trim. What does that mean? It means ensuring that if all propulsion is stopped, the submarine will neither slowly sink to the bottom of the ocean or slowly rise to the surface, and that it will remain perfectly level (not list to port or starboard, fore or aft). This is accomplished with trim tanks. Water in trim tanks can be pumped out into the ocean, allowed in from the ocean, or moved from one trim tank to another. Got it?

OK. So here's how a trim party works. Someone finds out that a new person is qualifying to stand COW. This person gets together a crew of about six people who are off-watch, they all go together to the forward end of the torpedo room, as far forward as you can be. One member of the party watches the indicator on the trim tank there to see when the new COW has pumped out water to correct the trim. Then the whole party goes to the aft end of the engine room, as far aft as you can go. Someone monitors the indicator on the trim tank there. This is repeated until the victim catches on and stops reacting to the trim party.

#bikeshare #bike-angels #rewards-system #hack #schneier #bruce-schneier #schneier-on-security #blog


^1^ Submarines, no matter how large, are called boats.