Hackers find a way to crack popular smartcard in minutes

RFID-enabled smartcards now can be far more easily, and cheaply, cracked than ever before

People are starting to wake up to the fact that RFID-enabled smartcards now can be far more easily, and cheaply, cracked than ever before, as a trio of young computer experts recently showed.

These are a particular type of processor-embedded cards, and are different from credit cards. The actual decryption work by the researchers was done on the widely deployed Mifare Classic wireless smartcard, now manufactured by a Philips spinoff, NXP Semiconductors. Decrypted, the cards can be counterfeited, and users' personal and bank data is exposed.

That card is the basis of such new systems as the Dutch OV-Chipkaart, being rolled out in The Netherlands as part of a multi-billion dollar nationwide transportation ticketing system, and the so-called CharlieCard, used in the Boston subway system. The decryption breach triggered a firestorm of controversy, and Dutch authorities apparently have halted the rollout and are investigating the vulnerabilities.

The card can be used in debit/credit transactions with the user's bank account. This personal and important data is encrypted on the Mifare Classic with a proprietary encryption scheme.

The newest attack was demonstrated at the 24th Congress of the Chaos Computer Club in Berlin last December. Interest in the study has been spreading steadily from the arcane world of security hackers. One of the researchers is Karsten Nohl, a graduate student in the University of Virginia's Computer Science Department, in Charlottesville, the other two are Henryk Plotz and "Starbug." The trio apparently demonstrated a practical and effective way to break the Mifare encryption key, confirming what many cryptographers had suspected.

The team used an inexpensive RFID reader to collect encrypted data, and then reverse-engineered the chip to figure out the encryption key to decipher that data. They examined the chip under an optical microscope and used micro-polishing sandpaper to remove a few microns of the surface at time, photographing each of the five layers of circuitry. Nohl wrote his own optical recognition software to refine and clarify the images, and then patiently worked through the arrangement of the logic gates to deduce the encryption algorithm, a task made possible by the fact that the Mifare Classic relies on a secret key of no more than 48 bits.

"Regardless of the cryptographic strength of the cipher, the small key space therefore permits counterfeiting of any card that is read wirelessly," the team wrote in a follow-up statement issued on January 8. "Knowing the details of the cipher would permit anyone to try all possible keys in a matter of days," the researchers noted. "Given basic knowledge of cryptographic trade-offs and sufficient storage, the secret keys of cards can be found in a matter of minutes."

The Dutch transit system actually uses two other types of tickets or cards, and both have been successfully attacked by other researchers.

Nohl and his colleagues noted that other types of Phillips RFID tags, such as the Hitag2+ and Mifare DESfire, are not affected by their findings.

RFID security concerns have become pronounced over the past year or so, as hackers and researchers make more concerted efforts to understand the vulnerabilities. In mid-2007, one team used readily available RFID gear to read the Electronic Product Code data on tagged boxes loaded on a tractor-trailer. A year earlier, another group raised the specter that RFID tags could be infected with computer viruses.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

John Cox

Network World
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?