All my Deutschlandtickets gone: Fraud at an industrial scale

All my Deutschlandtickets gone: Fraud at an industrial scale

Speakers: Q Misell, Researcher, Max Planck Gesellschaft; 551724 / maya boeckh, Researcher

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=Rp4IfmlRktk

Overview

This talk, "All my Deutschlandtickets gone: Fraud at an industrial scale," delivered by Q Misell and 551724 / maya boeckh at 39C3, meticulously uncovers two distinct yet interconnected large-scale fraud schemes targeting Germany's popular Deutschlandticket. The presentation details how vulnerabilities in payment processing, cryptographic key management, and inter-company communication within the German public transport sector led to hundreds of millions of euros in losses. The speakers, through their dedicated research, exposed significant systemic flaws that enabled both sophisticated and surprisingly amateur fraudsters to exploit the system.

The talk is crucial for anyone involved in digital ticketing, payment systems, or critical infrastructure security. It highlights the profound implications of neglecting fundamental security principles in widely adopted public services. The speakers' findings not only detail the mechanisms of fraud but also reveal the challenges in reporting such vulnerabilities to reluctant or ill-equipped organizations, underscoring the broader issues of organizational security maturity and regulatory oversight in a decentralized environment.

The research presented is a testament to the power of independent security analysis in uncovering deeply entrenched problems that have significant financial and operational consequences. It serves as a stark warning about the need for robust security by design, clear accountability, and agile response mechanisms in modern digital ecosystems, especially those touching the daily lives of millions of citizens.

Background

▶ Watch: Discovering cheap Deutschlandtickets on Telegram (1:10)

The genesis of this problem lies in the introduction of the Deutschlandticket (Germany Ticket), a nationwide public transport pass launched in May 2023 for a monthly fee of €49 (later increased). Designed to simplify public transport usage and encourage sustainable travel, it quickly gained immense popularity, with millions of Germans adopting it. This widespread adoption, however, also created an attractive target for fraudsters, especially given the inherent complexities of Germany's decentralized public transport network.

Historically, Germany's public transport is operated by numerous regional Verkehrsunternehmen (transport companies), each with its own systems and operational nuances. This fragmentation extended to ticket issuance and revocation mechanisms, creating significant challenges for centralized oversight and coordinated security responses. Two primary systems exist for issuing Deutschlandtickets: the VDV KA (Verband Deutscher Verkehrsunternehmen Kernapplikation) and the UIC (Union Internationale des chemins de fer, or International Union of Railway Undertakings). While VDV KA has a revocation management system called KOSES, the UIC's ETCD (Electronic Ticket Control Database) is predominantly designed for international tickets, lacking a robust national equivalent for Deutschlandtickets. This disparity in revocation capabilities forms a critical backdrop to the fraud.

A key enabler for one of the fraud types is the German SEPA Direct Debit system, known as Lastschriftverfahren. Unlike traditional online card payments, direct debit does not require explicit authorization from the account holder for each transaction; it only needs an IBAN. Payments are reconciled asynchronously, meaning a ticket can be issued immediately upon request, with payment verification occurring several days later. This "async reconciliation simulator," as the speakers playfully termed it, creates a window of opportunity where tickets are valid before payment confirmation. Furthermore, there is no strong enforcement mechanism to verify the authenticity of the SEPA mandate or the realness of the provided IBAN, making it easy to use fake or stolen bank details.

The speakers' prior work also plays a role. Q Misell had previously developed Tixly (now Zugly), a platform designed to parse and store ticket data from various sources, including barcodes. This tool, initially intended for legitimate purposes, inadvertently became a "ticket laundromat," as it could extract the raw ticket data (Aztec codes) from fraudulently obtained tickets, allowing them to be loaded into digital wallets like Google Wallet, further isolating them from issuer-side revocation attempts. This accidental utility highlighted how existing infrastructure could be repurposed in unforeseen ways by malicious actors.

In essence, the problem existed due to a confluence of factors: a popular, high-value digital product (Deutschlandticket), a payment system with inherent asynchronous vulnerabilities (SEPA Direct Debit), a fragmented and poorly coordinated revocation infrastructure, and a general lack of robust security practices and oversight within the public transport ecosystem.

Key Findings

▶ Watch: Explaining SEPA direct debit payment vulnerability (4:10)

The research uncovered two primary, large-scale fraud vectors targeting the Deutschlandticket, leading to staggering financial losses and exposing severe systemic vulnerabilities.

The first major vector was Payment Fraud, predominantly exploiting the asynchronous nature of SEPA Direct Debit. Scammers would use fake or stolen IBANs to "purchase" Deutschlandtickets from various regional transport companies. Because tickets are issued immediately and payment verification takes several days, fraudsters could obtain valid tickets, upload their Aztec codes to platforms like Zugly to generate wallet passes, and then sell these tickets at a discounted rate (e.g., €15-€30 for a €49 ticket) on platforms like Telegram. When the direct debit eventually failed, the issuing company would revoke the ticket from their app, but this revocation often failed to propagate to national blacklists or individual ticket control systems, especially for smaller regional operators. The investigation identified dticket.online as a major source of these fraudulent tickets, which was notably running in Django debug mode in production, allowing researchers to extract a full list of fraudulent tickets. This operation showed a degree of tactical awareness, with scammers moving their targets between companies like RMV, Schweinfurt, and Wuppertal to avoid detection, despite their otherwise amateur operational security (using residential IPs and personal PayPal accounts).

The second, and arguably more alarming, vector involved Private Key Compromise. This was discovered when researchers encountered Deutschlandtickets issued by dticket.su (a website using the Soviet Union's top-level domain), which, despite appearing legitimate, contained unusual data fields such as "Passenger type senior" (which doesn't exist for Deutschlandtickets), "Zone ID unknown zone one," and an issuer text of "DB Regio AG" while having the issuer code 5211 assigned to FVV (Verkehrsgesellschaft Frankfurt). This indicated that the tickets were not merely payment fraud but were being signed with an illicitly acquired private key belonging to FVV. The FVV key used DSA 1024 and SHA-1, outdated cryptographic algorithms known to be vulnerable to private key recovery through side-channel attacks like random number reuse or bias, especially when comparing multiple signed tickets. Other potential compromise vectors included coercion, illicit dealings, or simple exposure (e.g., an open S3 bucket).

FVV initially denied any wrongdoing, even providing a clearly photoshopped screenshot as evidence. When confronted, they shifted blame to their partner company, MoPLA, a Munich tech startup. However, the researchers, by analyzing public transparency registers, uncovered a complex web of holding companies demonstrating significant interconnection and shared ownership between FVV and MoPLA, contradicting FVV's claims of separation. This discovery, along with persistent reporting to the Deutschlandtarifverbund GmbH (DTVG), the oversight body, eventually led to the revocation of FVV's key (ID 5211) in early February. The DTVG's official reason was a "new security concept," but the true impetus was "suspected misuse" due to the researchers' findings. Alarmingly, the revocation process was severely delayed due to DTVG being "chronically underfunded" and key personnel being on holiday or sick, highlighting critical single points of failure. It was also revealed that FVV had a history of key misuse, having been previously removed from the VDV KA system for losing keys stored on physical Hardware Security Modules (HSMs).

Even after the FVV key revocation, new fraudulent Fatter tickets continued to appear, signed with the new FVV key. This led to the discovery of a critical payment processing bug within MoPLA's system. MoPLA's integration with Stripe (their payment processor) failed to verify if funds existed in a linked PayPal account or credit/debit card before issuing a subscription and subsequently the ticket. This allowed fraudsters to create accounts, link empty payment methods, and immediately receive valid Deutschlandtickets, with the "payment failed" email arriving minutes later. MoPLA's code was described as "typical startup code," indicating a lack of robust development and security practices.

The scale of the fraud was immense:

• Deutsche Bahn's internal logs identified approximately 50,000 tickets signed with FVV's stolen key, representing at least €2.9 million in losses (and this was only what DB saw, not including other regional operators).
• A Sondersitzung (special session) of the VDV protocol revealed that the total financial loss from all types of fraud (primarily direct debit) between January and October 2024 was estimated at €267 million, equivalent to €316 million at current prices, or the cost of 9.5 brand new ICE trains. This figure was derived by comparing self-reported Deutschlandticket usage with actual sales records.

The talk also touched upon ticket control system flaws, noting that many regional bus systems were not updated to recognize new barcode formats or to correctly process revocation lists, which were often disseminated manually via emailed spreadsheets. Some control apps were even found to bypass signature verification if a ticket was signed with an unknown key ID, effectively validating fraudulent tickets by omission.

Technical Deep Dive

▶ Watch: Why revoking invalid tickets is difficult (4:45)

The technical underpinnings of the Deutschlandticket fraud reveal a complex interplay of payment system design, cryptographic vulnerabilities, and operational security shortcomings.

At the heart of the payment fraud lies the SEPA Direct Debit (Lastschriftverfahren). This system is designed for convenience, allowing a payee (e.g., a transport company) to initiate a debit from a payer's account simply by providing an IBAN and a mandate. Crucially, the system does not require real-time authorization from the account holder for each transaction, nor does it strictly enforce the verification of the mandate's authenticity or the IBAN's ownership at the point of transaction initiation. The payment process is asynchronous: a transaction is initiated, and the funds are processed and cleared over several days. This creates a critical window where a ticket can be issued immediately based on an unverified payment request. If the payment ultimately fails (due to insufficient funds, a fake IBAN, or a chargeback), the ticket issuer then attempts to revoke the ticket. However, the decentralized nature of German public transport means that these revocation signals often fail to propagate effectively across all regional transport companies and their diverse ticket control systems.

The private key compromise affecting FVV tickets exposed several cryptographic and key management failures. The FVV key (ID 5211) was signed using DSA 1024 and SHA-1.

• DSA 1024 is an older digital signature algorithm with a relatively small key size (1024 bits), making it theoretically less secure than modern alternatives. More critically, DSA is highly sensitive to the quality of the random numbers used during the signing process. If a random number is reused across multiple signatures, or if the random number generator has a predictable bias, it is possible to mathematically derive the private key from two signed messages. This vulnerability is well-known and has been exploited in other contexts (e.g., in PlayStation 3).
• SHA-1 is a cryptographic hash function that has been considered cryptographically broken since 2017, with practical collision attacks demonstrated. While its use here was for hashing data before signing, the general presence of outdated cryptography signals a lack of adherence to modern security standards.

The talk also highlighted the operational security weaknesses related to key management. FVV's history of losing keys, even those stored on Hardware Security Modules (HSMs) within the VDV KA system, points to a profound failure in implementing basic key lifecycle management. HSMs are physical devices designed to securely store and perform cryptographic operations with private keys, making them highly resistant to software-based attacks. Losing control of an HSM implies either physical compromise, gross negligence in handling the device, or a failure to implement proper access controls and auditing around the HSMs. The delay in revoking the compromised FVV key by the DTVG due to personnel being on holiday or sick further underscores the absence of a robust, redundant Public Key Infrastructure (PKI) management process. A critical PKI should have automated, or at least highly resilient, procedures for emergency key revocation, independent of individual staff availability.

The MoPLA payment processing bug was a classic example of insecure development practices. MoPLA, using Stripe as its underlying payment gateway, failed to correctly implement the necessary checks for fund availability. When a user added an empty PayPal account or a credit/debit card with zero balance, MoPLA's API would still proceed to create a subscription and issue a valid Deutschlandticket. Stripe, as a reputable payment processor, does provide functionalities to check for fund availability and validate payment methods. The flaw was in MoPLA's integration logic, where the developers evidently skipped or misconfigured these critical pre-authorization checks. The sequence of API calls demonstrated by the speakers (account creation, passenger creation, attaching empty card, setting as default, creating subscription, receiving ticket Aztec code) clearly showed how this bypass was possible, with the payment failure notification arriving only after the ticket had been generated and delivered to the user.

Finally, the ticket control infrastructure itself contributed to the problem. Many regional bus and train companies operate with older ticket validation devices that were not designed to handle the dynamic nature of the Deutschlandticket (e.g., new barcode formats, frequent revocation list updates). The process of updating these devices with new key lists or software patches often involved manual, archaic methods (e.g., emailing spreadsheets of keys, physically connecting devices with serial cables). Moreover, some control applications exhibited critical logic flaws, such as failing to perform signature verification if a ticket was signed with an unknown key ID, effectively treating an unknown key as valid rather than invalid. This created a gaping hole where tickets signed with newly compromised keys or even entirely fabricated keys could pass unchallenged if the control system hadn't been updated with the latest revocation lists or if its validation logic was flawed.

Demo / Proof of Concept

▶ Watch: Gaps in national ticket revocation systems (6:20)

The talk effectively incorporated demonstrations and proof-of-concept elements throughout its narrative, illustrating the practical execution of the identified fraud schemes.

For the payment fraud via SEPA Direct Debit, the speakers began by describing a real-world scenario: obtaining a Deutschlandticket from a Telegram seller for a mere €15 (compared to the official €49). They showed the resulting ticket, confirmed its legitimacy as a Stadtwerke Frankfurt Deutschlandticket, and then explained how this was made possible by the seller providing fake payment information to the Stadtwerke, which issued the ticket immediately. This served as a direct demonstration of the ease with which fraudulent tickets could be acquired and used.

Regarding the private key compromise, the speakers detailed their own purchase of a fraudulent ticket from dticket.su for €58 of their own money. This act provided them with a concrete sample of a ticket signed with the illicitly acquired FVV key. They then meticulously walked through the anomalies in the ticket data (e.g., "Passenger type senior," "Zone ID unknown zone one," mismatched issuer text), demonstrating how these discrepancies were clear indicators of a compromised key rather than simple payment fraud. The existence of dticket.su itself, a professional-looking website selling these tickets, acted as a live demonstration of the scale of this particular fraud.

Furthermore, the speakers' platform, Tixly (now Zugly), while not a live demonstration during the talk, was presented as a crucial analytical tool. They explained how Tixly became an "accidental ticket laundromat" by facilitating the extraction of Aztec codes from fraudulently obtained tickets, allowing them to be loaded into digital wallets. This illustrated how a legitimate tool could be leveraged to bypass app-based revocation mechanisms, thereby extending the lifespan of fraudulent tickets.

Perhaps the most explicit proof-of-concept was the step-by-step walkthrough of exploiting the MoPLA payment bug. The speakers detailed the exact sequence of actions:

1. Creating an account via Google OAuth.
2. Using the API to create a "passenger" record.
3. Attaching an empty payment method (e.g., an empty PayPal account or a credit card with zero balance).
4. Setting this empty method as the default.
5. Creating a subscription.
6. Immediately receiving the base64 encoded Aztec code for the Deutschlandticket.
7. Receiving an email approximately five minutes later stating that the charge failed, but with the ticket already issued and valid.

This detailed exposition, complete with screenshots of the API interactions, served as a clear, actionable proof of concept for how the MoPLA system could be abused to generate tickets without actual payment. Although the speakers noted that this specific bug has since been fixed, its inclusion vividly demonstrated the vulnerability and the "typical startup code" quality that enabled it.

In summary, the talk didn't rely on a single, isolated demo but rather wove practical examples, real-world purchases, and detailed exploit walkthroughs throughout, collectively serving as compelling demonstrations and proofs of concept for the various fraud methods discussed.

Defensive Implications

▶ Watch: How Tixly was used to launder fraudulent tickets (8:00)

The findings from this talk necessitate a multi-layered and comprehensive defensive strategy to secure the Deutschlandticket system and similar digital ticketing infrastructures. Addressing these issues requires not only technical fixes but also significant organizational, contractual, and regulatory reforms.

1. Secure Payment Processing:

• Pre-authorization for Direct Debits: For systems using SEPA Direct Debit, implement a mandatory waiting period for payment clearance before issuing tickets. While this might impact user experience, it eliminates the window for fraud. Alternatively, implement robust pre-authorization checks that verify fund availability in real-time.
• Enhanced Card Security: Mandate the use of 3D Secure for all credit and debit card payments to add an extra layer of authentication.
• Confirmation of Payee: Implement systems like "Confirmation of Payee" to verify that the name provided by the customer matches the name on the bank account for direct debits, preventing the use of fake or stolen IBANs.
• Robust API Integrations: Payment gateways like Stripe offer comprehensive fraud prevention and fund verification tools. Companies must ensure their API integrations correctly utilize these features and conduct thorough testing to prevent bugs like MoPLA's empty PayPal account exploit.

2. Robust Key Management and PKI:

• Modern Cryptography: Immediately deprecate and replace outdated cryptographic algorithms like DSA 1024 and SHA-1. Transition to stronger alternatives such as RSA 2048+ or ECC with SHA-256+ for signing tickets.
• Strict Key Lifecycle Management: Implement formal PKI processes and protocols for key generation, storage, usage, rotation, and revocation. This includes secure key generation practices (e.g., using cryptographically secure random number generators), multi-factor authentication for key access, and strict access controls.
• Hardware Security Modules (HSMs): Mandate the use of HSMs for storing all private keys. These devices are designed to protect keys from both logical and physical compromise. Critical processes should enforce that keys never leave the HSM.
• Regular Audits: Conduct frequent, independent security audits of key management practices, HSM deployments, and cryptographic implementations. These audits should verify the physical presence of HSMs and the integrity of key handling procedures.
• Emergency Revocation Procedures: Establish clear, well-rehearsed, and redundant procedures for emergency key revocation that are not reliant on individual personnel availability. This requires adequate staffing and cross-training within oversight bodies like the DTVG.

3. Centralized and Effective Revocation:

• Unified Revocation System: Develop and enforce a centralized, real-time revocation system that all Deutschlandticket issuers and control entities (trains, buses) must integrate with. The current efforts by DTVG to roll out a blocklist for UIC format tickets are a positive step but need universal adoption and compliance.
• Real-time Propagation: Ensure that revocation lists are propagated to all ticket control devices (e.g., hand scanners, on-board computers) in near real-time. Manual updates via spreadsheets or serial cables are unacceptable for a national system.
• Updated Control Systems: All transport companies must upgrade their ticket control hardware and software to support modern barcode formats (e.g., UIC format Deutschlandtickets) and to consistently perform signature verification against known, unrevoked keys. Control apps should explicitly flag tickets signed with unknown keys as invalid, rather than implicitly validating them.
• Digital Wallet Integration: Leverage remote revocation capabilities of platforms like Google Wallet and Apple Wallet. Implement mechanisms to prevent fraudulent tickets from being copied across multiple devices (e.g., Google's hash-checking system).

4. Organizational and Regulatory Reforms:

• Contractual Penalties: Amend contracts for Deutschlandticket issuers to include clear penalties and sanctions for security breaches, key compromises, and failure to comply with security standards. This creates financial incentives for good security practices.
• Adequate Funding: Ensure that oversight bodies like the DTVG are adequately funded and staffed, particularly for security and PKI management, to prevent single points of failure.
• Security by Design: Promote a "security by design" philosophy across all development and operational aspects of the Deutschlandticket. This includes thorough security reviews, penetration testing, and developer training.
• Enhanced KYC/AML: For platforms that integrate with digital wallets and issue signing certificates (e.g., Apple Developer accounts), stricter Know Your Customer (KYC) and Anti-Money Laundering (AML) checks should be enforced to identify and prevent fraudulent actors from obtaining developer credentials.
• Fraud Monitoring: Implement advanced fraud detection systems that monitor for anomalous ticket issuance patterns (e.g., high volume from specific IPs, rapid issuance followed by payment failures, unusual ticket data fields).
• Passenger ID Verification: Reinforce the policy for ticket inspectors to compare the Deutschlandticket against a valid ID card to combat ticket reuse and ensure the legitimate holder is traveling.

5. Transparency and Accountability:

• Open Disclosure: Encourage a culture of responsible disclosure when vulnerabilities are found, and ensure that companies respond constructively rather than defensively or obstructively.
• Public Reporting: Maintain public transparency regarding security incidents and the measures being taken to address them, fostering trust with the public.
• No Debug Mode in Production: Enforce strict deployment policies to prevent development configurations (like Django debug mode) from being run in production environments.

By implementing these comprehensive defensive measures, the vulnerabilities exposed by this talk can be mitigated, restoring trust and security to the Deutschlandticket system.

Key Takeaways

• Systemic Fraud at Industrial Scale: The Deutschlandticket system suffered from widespread fraud, primarily through payment bypasses and private key compromises, resulting in estimated losses of over €300 million.
• Asynchronous Payments are a Critical Vulnerability: The SEPA Direct Debit system's asynchronous nature, coupled with a lack of immediate payment verification, created a significant window for fraudsters to obtain valid tickets without genuine payment.
• Cryptographic Key Management is Paramount: The compromise of a private key due to outdated algorithms (DSA 1024, SHA-1) and poor operational security (e.g., lost HSMs, delayed revocation) highlights the catastrophic impact of inadequate PKI practices.
• Decentralization Exacerbates Security Challenges: The fragmented German public transport landscape and lack of coordinated, real-time revocation systems allowed fraudulent tickets to remain valid across different operators, impeding effective countermeasures.
• Organizational and Contractual Weaknesses: Underfunded oversight bodies, single points of failure in security operations, and a lack of contractual penalties for security negligence contributed significantly to the problem's scale and persistence.
• Comprehensive Reforms are Essential: Addressing this requires a multi-faceted approach, including modernizing payment security, implementing robust key management, establishing centralized real-time revocation, upgrading control infrastructure, and enforcing stronger regulatory and contractual accountability.

About the Speaker(s)

Q Misell is a researcher whose work focuses on security and public transport systems. He is affiliated with the Max Planck Gesellschaft zur Förderung der Wissenschaften e.V., as mentioned in the disclaimer at the beginning of the talk, indicating a background in academic research. Q Misell previously developed the platform Tixly (now Zugly), a tool for analyzing and storing ticket data, which played an incidental but crucial role in identifying the patterns of fraudulent Deutschlandtickets discussed in this presentation.

551724 / maya boeckh is also a researcher and co-presenter of this detailed technical talk. While specific affiliations or titles beyond "researcher" are not explicitly stated in the provided transcript or metadata, their contribution to the in-depth analysis of the fraud mechanisms, particularly the payment processing vulnerabilities and the broader institutional challenges, demonstrates expertise in security analysis and public transport systems. Both speakers are clearly deeply involved in uncovering and understanding the technical and systemic issues plaguing digital ticketing.