Feeds

'Thiefproof' car key cracked

Grand Theft RFID

  • alert
  • submit to reddit

SANS - Survey on application security programs

Researchers have discovered cryptographic vulnerabilities in the RFID technology used in high-security car keys and petrol pump payment systems. The attack against Texas Instruments DST tags used in vehicle immobilisers and ExxonMobil's SpeedPass system was identified by experts at Johns Hopkins University and RSA Laboratories.

The algorithm used in TI's DST tags is an unpublished, proprietary cipher that uses a 40-bit key. Using a black-box reverse-engineering method, the team was able to unravel the algorithm used in the DST tags. This information allowed them to programme a commercial microchip costing less than $200 to find the secret key of a gasoline purchase tag owned by one of the researchers. Using 16 of these FPGAs (Field Programmable Gate Array) devices in parallel allowed researchers to reduce search time from 10 hours to around 15 minutes.

The vulnerable technology is used in more than six million key chain tags used for wireless gasoline purchases and in an estimated 150 million keys for newer vehicles built by at least three leading manufacturers. The researchers warn that tech-savvy criminals could wirelessly probe a car key tag or payment tag in close proximity, and process this data using the code breaking techniques to crack secret keys and circumvent cryptographic security safeguards. This might allow crooks to charge their own gasoline purchases to the tag owner's account or to get around electronic vehicle immobilisation techniques. Crooks would still need to defeat physical locks to steal cars.

"We've found that the security measures built into these devices are inadequate," said Avi Rubin, technical director of the Johns Hopkins Information Security Institute and an author of the study. "Millions of tags that are currently in use by consumers have an encryption function that can be cracked without requiring direct contact. An attacker who cracks the secret key in an RFID tag can then bypass security measures and fool tag readers in cars or at gas stations."

The researchers have alerted Texas Instruments about the initial findings of their research, which continues. The team recommends a program of distributing free metallic sheaths to cover its RFID devices when they are not being used in order to make attacks more difficult.

The company that markets ExxonMobil's SpeedPass system has said it has no knowledge that any fraudulent purchases have ever been made with a cloned version of its device. ®

Related stories

RFID Chips Are Here
RSA shows RFID tag blocker
German revolt against RFID
Munich faces RFID-controlled congestion charge
Number crunching boffins unearth crypto flaws

External links

Analysis of the Texas Instruments DST RFID

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.