How they hacked it: The MiFare RFID crack explained

Top Stories

Related

• Clues point to Jan. 13 release of Windows 7 beta
• Microsoft releases Vista SP2 beta
• Obama's DHS pick may find support for raising H-1B cap at confirmation hearing
• IBM wants info from Apple execs in Papermaster case
• License server glitch exposes SonicWall users to e-mail security threats
• Report: Former AOL chief exec tries to raise funds to buy Yahoo

• RFID chipmaker loses suit; says users must take "urgent" action
• Chipmaker sues to quash research on RFID smart card security flaws
• MiFare RFID crack more extensive than previously thought
• RFID hack could crack open 2 billion smart cards
• U.S. agency sees robots replacing humans in service jobs by 2025

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

March 19, 2008 (Computerworld) Last month, the Dutch government issued a warning about the security of access keys based on the ubiquitous MiFare Classic RFID chip. The warning comes on the heels of an ingenious hack, spearheaded by Henryk Plotz, a German researcher, and Karsten Nohl, a doctoral candidate in computer science at the University of Virginia, that demonstrated a way to crack the encryption on the chip.

Millions upon millions of MiFare Classic chips are used worldwide in contexts such as payment cards for public transportation networks throughout Asia, Europe and the U.S. and in building-access passes.

The report asserts that systems employing MiFare will likely be secure for another two years, since hacking the chip seems to be an involved and expensive process. But in a recent report published by Nohl, titled "Cryptanalysis of Crypto-1," he presents an attack that recovers secret keys in mere minutes on an average desktop PC.

In December, Nohl and Plotz gave a presentation on MiFare's security vulnerabilities at the 24th Chaos Communications Congress (24C3), the annual four-day conference organized by Germany's notorious hacking collective, the Chaos Computer Club (CCC). Thousands of hackers from far-flung locales converged on Berlin between Christmas and New Year's for a raft of talks and project demonstrations.

In their popular talk at 24C3, punctuated by bursts of raucous applause, Nohl presented an overview of radio frequency identification security vulnerabilities and the process of hacking the MiFare chip's means of encryption, known as the Crypto-1 cipher. "This is the first public announcement that the Crypto-1 cipher on the MiFare tag is known," said Nohl in December at the 24C3 talk. "We will give out further details next year."

Get out the microscopes

To hack the chip, Nohl and Plotz reverse-engineered the cryptography on the MiFare chip through a painstaking process. They examined the actual MiFare Classic chip in exacting detail using a microscope and the open-source OpenPCD RFID reader and snapped several in-depth photographs of the chip's architecture. The chip is tiny -- about a 1-millimeter-square shred of silicon -- and is composed sed of several layers.

The researchers sliced off the minuscule layers of the chip and took photos of each layer. There are thousands of tiny blocks on the chip -- about 10,000 in all -- each encoding something such as an AND gate or an OR gate or a flip-flop.

Analyzing all of the blocks on the chip would have taken forever, but there was a shortcut. "We couldn't actually look at all 10,000 of these small building blocks, so we wanted to categorize them a bit before we started analyzing," said Nohl at 24C3. "We observed that there aren't actually 10,000 different ones. They're all taken from a library of cells. There are only about 70 different types of gates; we ended up writing MATLAB scripts that once we select one instance of a gate finds all the other ones."