Feeds

Dutch boffins clone Oyster card

And DDoS a ticket barrier

Internet Security Threat Report 2014

Researchers of Radboud University in Nijmegen in the Netherlands managed to crack and clone London's Oyster travel card. They were able to take free rides on the Underground and even perpetrated a DDoS attack on a Tube gate.

Researchers Wouter Teepe and Bart Jacobs used a regular laptop to put credit back on their Oyster card. They plan to publish their research in October. Wouter Teepe promised they will not release software to manipulate the cards.

The Oyster Card is based on the Mifare chip of Philips spinoff NXP semiconductors. About ten million Mifare smartcards are sold in Britain each year, some of which provide access to public buildings or cashless payment systems for transport systems and colleges.

However, according to Transport for London Londoners can have total confidence in the security of their Oyster cards. "We run daily tests for cloned or fraudulent cards and any found would be stopped within 24 hours of being discovered. Therefore the most anyone could gain from a rogue card is one day's travel."

In a later statement TfL added it was not a hack of the Oyster system, but a single instance of a card being manipulated.

Earlier this year the researchers cloned the new Dutch Mifare travel card. As a result, the introduction of the €1bn transport payment system in the Netherlands has now been postponed. They also managed to clone a swipe access card to a public building in the Netherlands. According to some reports, the Dutch government immediately posted armed guards outside all its buildings and now plans to spend millions of euros upgrading its system.

According to Jacobs, the biggest vulnerability stems from the fact that the Mifare chip was developed in the 90s, when there was little computing power and no strong encryption on those chips.

Dutch charity NLnet Foundation this week annouced it will give €150,000 to Radboud University to launch a open-source smart card software project which will run through 2010. The initiative is funded by private charity money to ensure that “there are technical guarantees for maintaining the privacy of passengers”. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
The Heartbleed Bug: how to protect your business with Symantec
What happens when the next Heartbleed (or worse) comes along, and what can you do to weather another chapter in an all-too-familiar string of debilitating attacks?
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.