Feeds

'Thiefproof' car key cracked

Grand Theft RFID

  • alert
  • submit to reddit

Protecting users from Firesheep and other Sidejacking attacks with SSL

Researchers have discovered cryptographic vulnerabilities in the RFID technology used in high-security car keys and petrol pump payment systems. The attack against Texas Instruments DST tags used in vehicle immobilisers and ExxonMobil's SpeedPass system was identified by experts at Johns Hopkins University and RSA Laboratories.

The algorithm used in TI's DST tags is an unpublished, proprietary cipher that uses a 40-bit key. Using a black-box reverse-engineering method, the team was able to unravel the algorithm used in the DST tags. This information allowed them to programme a commercial microchip costing less than $200 to find the secret key of a gasoline purchase tag owned by one of the researchers. Using 16 of these FPGAs (Field Programmable Gate Array) devices in parallel allowed researchers to reduce search time from 10 hours to around 15 minutes.

The vulnerable technology is used in more than six million key chain tags used for wireless gasoline purchases and in an estimated 150 million keys for newer vehicles built by at least three leading manufacturers. The researchers warn that tech-savvy criminals could wirelessly probe a car key tag or payment tag in close proximity, and process this data using the code breaking techniques to crack secret keys and circumvent cryptographic security safeguards. This might allow crooks to charge their own gasoline purchases to the tag owner's account or to get around electronic vehicle immobilisation techniques. Crooks would still need to defeat physical locks to steal cars.

"We've found that the security measures built into these devices are inadequate," said Avi Rubin, technical director of the Johns Hopkins Information Security Institute and an author of the study. "Millions of tags that are currently in use by consumers have an encryption function that can be cracked without requiring direct contact. An attacker who cracks the secret key in an RFID tag can then bypass security measures and fool tag readers in cars or at gas stations."

The researchers have alerted Texas Instruments about the initial findings of their research, which continues. The team recommends a program of distributing free metallic sheaths to cover its RFID devices when they are not being used in order to make attacks more difficult.

The company that markets ExxonMobil's SpeedPass system has said it has no knowledge that any fraudulent purchases have ever been made with a cloned version of its device. ®

Related stories

RFID Chips Are Here
RSA shows RFID tag blocker
German revolt against RFID
Munich faces RFID-controlled congestion charge
Number crunching boffins unearth crypto flaws

External links

Analysis of the Texas Instruments DST RFID

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.