Oyster Cracked Open:
Popular Smartcard Platform Is Insecure
by Simon Magus

chipkaart.jpgResearchers have revealed that smartcards using Mifare Classic chips can be easily cloned -- threatening the security of hundreds of buildings that use the cards, as well as allowing Oyster users to top-up their cards fraudulently.

Dr Bart Jacobs of Radboud University in the Netherlands used a laptop to clone a smartcard used to enter a public building in the country.

"An employee can be cloned by bumping into that person with a portable card reader," said Dr Jacobs.

"The person whose identity is being stolen may then be completely unaware that anything has happened."

"At the technical level there are currently no known countermeasures."

The Dutch government was so alarmed to hear of the breach that they posted armed guards at all buildings using the smartcards -- the guards will remain until the Mifare smartcards are replaced.

"We take this extremely seriously," said a spokesperson for the Dutch Interior Ministry.

"It's a national security issue."

"We're in the process of replacing the cards of all 120,000 civil servants at central government level at a cost of about €5 (£4) for each card."

Jacobs also travelled to London, where he used the same technique to ride around the city's public transport system for free -- the Oyster smartcard used in London also features Mifare chips.

He again used a laptop to reverse-engineer the algorithm used in the Mifare chip.

Transport for London (TfL) played down the significance of the discovery.

"This was not a hack of the Oyster system," said a spokesman for TfL.

"It was a single instance of a card being manipulated."

The manufacturers of the Mifare chip, NXP Semiconductors (a spin-off from Royal Dutch Philips), confirmed that they are fully aware of the issues around the compromised platform.

"We are aware that the Dutch researchers have reverse engineered the algorithm and we are taking this issue very seriously," said a spokesperson for the company.

"We've informed all of our system integrators and advised them to closely assess their systems."

"We're talking to the guys at Radboud University and have identified various counter measures."

Experts are unambiguous about the steps that now need to be taken.

"You only have to walk down the street to see contactless access control systems everywhere," said Adam Laurie, a computer security researcher.

"It used to be a magnetic strip, now it's a card held up to a reader on the wall."

"A large percentage of these will have Mifare technology and are very vulnerable to attack."

"They should all be replaced."

Posted in: Science by bubblejam at 10:09 PM | Comments (0) | Email This Entry

Comments

Post a comment




Remember Me?