Feeds

Dutch boffins clone Oyster card

And DDoS a ticket barrier

Security for virtualized datacentres

Researchers of Radboud University in Nijmegen in the Netherlands managed to crack and clone London's Oyster travel card. They were able to take free rides on the Underground and even perpetrated a DDoS attack on a Tube gate.

Researchers Wouter Teepe and Bart Jacobs used a regular laptop to put credit back on their Oyster card. They plan to publish their research in October. Wouter Teepe promised they will not release software to manipulate the cards.

The Oyster Card is based on the Mifare chip of Philips spinoff NXP semiconductors. About ten million Mifare smartcards are sold in Britain each year, some of which provide access to public buildings or cashless payment systems for transport systems and colleges.

However, according to Transport for London Londoners can have total confidence in the security of their Oyster cards. "We run daily tests for cloned or fraudulent cards and any found would be stopped within 24 hours of being discovered. Therefore the most anyone could gain from a rogue card is one day's travel."

In a later statement TfL added it was not a hack of the Oyster system, but a single instance of a card being manipulated.

Earlier this year the researchers cloned the new Dutch Mifare travel card. As a result, the introduction of the €1bn transport payment system in the Netherlands has now been postponed. They also managed to clone a swipe access card to a public building in the Netherlands. According to some reports, the Dutch government immediately posted armed guards outside all its buildings and now plans to spend millions of euros upgrading its system.

According to Jacobs, the biggest vulnerability stems from the fact that the Mifare chip was developed in the 90s, when there was little computing power and no strong encryption on those chips.

Dutch charity NLnet Foundation this week annouced it will give €150,000 to Radboud University to launch a open-source smart card software project which will run through 2010. The initiative is funded by private charity money to ensure that “there are technical guarantees for maintaining the privacy of passengers”. ®

Secure remote control for conventional and virtual desktops

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.