Feeds

Microscope-wielding boffins crack Tube smartcard

The keys to London Underground, and plenty more

Protecting users from Firesheep and other Sidejacking attacks with SSL

Security researchers say they've found a way to crack the encryption used to protect a widely-used smartcard in a matter of minutes, making it possible for them to quickly and cheaply clone the cards that are used to secure office buildings and automate the collection of mass transportation fares.

The attack works against the Mifare Classic, a wireless card made by Netherlands-based NXP Semiconductors. It is used by transit operators in London, Boston and the Netherlands and by organizations in the public and private sectors to control access to sensitive areas, according to Karsten Nohl, a PhD candidate at the University of Virginia and one of the cryptographers who discovered the weakness. NXP says it's sold 1 billion to 2 billion of the cards.

The wireless devices are growing in popularity because of their low cost - about 50 cents apiece - and they offer many of the advantages of radio frequency identification (RFID) technology. Specifically, smartcards don't require contact with the mechanical readers used by transit agencies, which lowers operators' costs and are quicker and more convenient for users.

The research team was able to obtain the card's proprietary encryption scheme by physically dissecting its chip and examining it under a microscope. They then photographed various levels of its circuitry and used optical recognition software to produce a 3D representation of the entire chip. By examining the logic gates in great detail, they were able to deduce the proprietary algorithm, which NXP dubs Crypto1.

Under normal circumstances, knowing the encryption algorithm allows a hacker to perform a brute-force attack in which every possible key is entered until the correct combination unlocks the scrambled code. But that would have taken days, given Mifare Classic's key length of 48 bits.

The research team, which also included Henryk Plötz and an individual who goes by the moniker Starbug, soon found out that Cypto1 has a flaw that causes it to produce cryptographically weak outputs. The weakness allows them to make intelligent guesses about the possible key by swiping the smartcard against an RFID reader and observing the data that reader sends back.

"It only takes a few minutes to break any card in particular," Nohl said in an interview. He said the modest amount of time and equipment required to crack any Mifare Classic card - in many cases less than 10 minutes on a typical PC - makes the attack ripe for criminals to carry out in the real-world attacks.

"If you want to get into a high-security building, spending a matter of days is OK," he said. "Now, it doesn't take days; it takes minutes for subways and military installations alike."

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.