Author:
Nicolas T. Courtois
Affiliation:
University College London, United Kingdom
Keyword(s):
Access control, RFID, Contactless smart cards, MiFare Classic, London Oyster card, OV-Chipkaart, Industrial secrets, Secure hardware devices, Reverse-engineering, Electronic subversion, Covert channels, Implementation backdoors, Critical application development management, Information assurance, Crime science.
Related
Ontology
Subjects/Areas/Topics:
Cryptographic Techniques and Key Management
;
Ethical and Legal Implications of Security and Privacy
;
Information and Systems Security
;
Information Assurance
;
Information Hiding
;
Insider Threats and Countermeasures
;
Intrusion Detection & Prevention
;
Smart Card Security
Abstract:
MiFare Classic is the most popular contactless smart card with about 200 millions copies in circulation worldwide. At Esorics 2008 Dutch researchers showed that the underlying cipher Crypto-1 can be cracked in as little as 0.1 seconds if the attacker can access or eavesdrop the RF communications with the (genuine) reader. We discovered that a MiFare classic card can be cloned in a much more practical card-only scenario, where the attacker only needs to be in the proximity of the card for a number of minutes, therefore making usurpation of identity through pass cloning feasible at any moment and under any circumstances. For example, anybody sitting next to the victim on a train or on a plane is now be able to clone his/her pass. Other researchers have also (independently from us) discovered this vulnerability (Garcia et al., 2009) however our attack requires less queries to the card and does not require any precomputation. In addition, we discovered that certain versions or clones of
MiFare Classic are even weaker, and can be cloned in 1 second. The main security vulnerability that we need to address with regard to MiFare Classic is not about cryptography, RFID protocols and software vulnerabilities. It is a systemic one: we need to understand how much our economy is vulnerable to sophisticated forms of electronic subversion where potentially one smart card developer can intentionally (or not), but quite easily in fact, compromise the security of governments, businesses and financial institutions worldwide.
(More)