Dutch boffins clone Oyster card
And DDoS a ticket barrier
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Researchers of Radboud University in Nijmegen in the Netherlands managed to crack and clone London's Oyster travel card. They were able to take free rides on the Underground and even perpetrated a DDoS attack on a Tube gate.
Researchers Wouter Teepe and Bart Jacobs used a regular laptop to put credit back on their Oyster card. They plan to publish their research in October. Wouter Teepe promised they will not release software to manipulate the cards.
The Oyster Card is based on the Mifare chip of Philips spinoff NXP semiconductors. About ten million Mifare smartcards are sold in Britain each year, some of which provide access to public buildings or cashless payment systems for transport systems and colleges.
However, according to Transport for London Londoners can have total confidence in the security of their Oyster cards. "We run daily tests for cloned or fraudulent cards and any found would be stopped within 24 hours of being discovered. Therefore the most anyone could gain from a rogue card is one day's travel."
In a later statement TfL added it was not a hack of the Oyster system, but a single instance of a card being manipulated.
Earlier this year the researchers cloned the new Dutch Mifare travel card. As a result, the introduction of the €1bn transport payment system in the Netherlands has now been postponed. They also managed to clone a swipe access card to a public building in the Netherlands. According to some reports, the Dutch government immediately posted armed guards outside all its buildings and now plans to spend millions of euros upgrading its system.
According to Jacobs, the biggest vulnerability stems from the fact that the Mifare chip was developed in the 90s, when there was little computing power and no strong encryption on those chips.
Dutch charity NLnet Foundation this week annouced it will give €150,000 to Radboud University to launch a open-source smart card software project which will run through 2010. The initiative is funded by private charity money to ensure that “there are technical guarantees for maintaining the privacy of passengers”. ®
COMMENTS
DDoS
I wonder whether the DDoS attack is something along the lines of the terminals only having a limited memory for blacklisted cards or performance degrading with longer blacklists?
A large number of bad cards could do very bad things to the system.
BT Cellnet hack.
Ahhh - those were the days. Storing the credit on an eeprom in the handset was a mighty sill idea. The 'phones were specifically the Philips C12 and Diga, and the PIC chip program simply copied the credit balance (and the eeprom checksum) into unused locations on the eeprom when the handset was powered up, then restored the copies (and erased them) back to their original locations just before powering down.
BT eventually invested in the infrastructure to track misuse of these 'phones and remove both IMSI (handset) and IMEI (SIM) from their network, but it was just a classic example of expediency before common sense....
Kind of like every half-baked IT project in this country!
Paris, because I bet she thought it was a good idea at the time.....
@paul fox
But remember in this world everything is ignored unless it is demonstrated either by an academic or a TV reporter
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
