Feeds

'Thiefproof' car key cracked

Grand Theft RFID

  • alert
  • submit to reddit

Combat fraud and increase customer satisfaction

Researchers have discovered cryptographic vulnerabilities in the RFID technology used in high-security car keys and petrol pump payment systems. The attack against Texas Instruments DST tags used in vehicle immobilisers and ExxonMobil's SpeedPass system was identified by experts at Johns Hopkins University and RSA Laboratories.

The algorithm used in TI's DST tags is an unpublished, proprietary cipher that uses a 40-bit key. Using a black-box reverse-engineering method, the team was able to unravel the algorithm used in the DST tags. This information allowed them to programme a commercial microchip costing less than $200 to find the secret key of a gasoline purchase tag owned by one of the researchers. Using 16 of these FPGAs (Field Programmable Gate Array) devices in parallel allowed researchers to reduce search time from 10 hours to around 15 minutes.

The vulnerable technology is used in more than six million key chain tags used for wireless gasoline purchases and in an estimated 150 million keys for newer vehicles built by at least three leading manufacturers. The researchers warn that tech-savvy criminals could wirelessly probe a car key tag or payment tag in close proximity, and process this data using the code breaking techniques to crack secret keys and circumvent cryptographic security safeguards. This might allow crooks to charge their own gasoline purchases to the tag owner's account or to get around electronic vehicle immobilisation techniques. Crooks would still need to defeat physical locks to steal cars.

"We've found that the security measures built into these devices are inadequate," said Avi Rubin, technical director of the Johns Hopkins Information Security Institute and an author of the study. "Millions of tags that are currently in use by consumers have an encryption function that can be cracked without requiring direct contact. An attacker who cracks the secret key in an RFID tag can then bypass security measures and fool tag readers in cars or at gas stations."

The researchers have alerted Texas Instruments about the initial findings of their research, which continues. The team recommends a program of distributing free metallic sheaths to cover its RFID devices when they are not being used in order to make attacks more difficult.

The company that markets ExxonMobil's SpeedPass system has said it has no knowledge that any fraudulent purchases have ever been made with a cloned version of its device. ®

Related stories

RFID Chips Are Here
RSA shows RFID tag blocker
German revolt against RFID
Munich faces RFID-controlled congestion charge
Number crunching boffins unearth crypto flaws

External links

Analysis of the Texas Instruments DST RFID

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.