MiFare RFID crack more extensive than previously thought

Comments

Related

Active Comments

OP Dave says: It's always been obvious to those of us who worked in systems design for years that you can't bolt on...

Read the rest | Reply

stuartdenley says: I think the company would should make the card cloning more difficult by connecting it's card's serial number to the...

Read the rest | Reply

All Comments (4) | Post New

• RFID chipmaker loses suit; says users must take "urgent" action
• Chipmaker sues to quash research on RFID smart card security flaws
• How they hacked it: The MiFare RFID crack explained
• RFID hack could crack open 2 billion smart cards
• U.S. agency sees robots replacing humans in service jobs by 2025

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

April 15, 2008 (Computerworld) The ubiquitous MiFare Classic RFID chip -- used daily by millions worldwide in access control keys, subway passes and other applications -- is even easier to crack than previously thought, according to security researchers who announced the development Tuesday at EuroCrypt, an international cryptography conference in Istanbul.

Mere seconds are all that is required to crack the chip's security -- not a few hours, as estimated last month. Karsten Nohl, a computer science graduate student and one of the masterminds behind reverse-engineering MiFare security, said in an interview that it now takes only 12 seconds to recover the key on a MiFare Classic card on an ordinary laptop.

On Monday, the Dutch government issued a final report arriving at the decisive conclusion that the chips, used by millions of citizens in the Netherlands, must be replaced. An earlier Dutch report had stated that a security breach on the MiFare cards was possible, but would be too unwieldy for the average attacker to accomplish.

"The attack is really, really cheap," Nohl said. "Before they [the Dutch government] argued that you would need expensive equipment; now we're talking a few seconds on any laptop, so anyone could do it."

Equally worrisome is that there is no need for the attacker to interact actively with the physical card itself. Passive eavesdropping suffices; the attack can take place from a distance. A passive attack from 10 meters away would take a little bit longer than an active attack, Nohl said -- about 200 seconds.

The attack works for any random number generator; it also works against the Crypto-1 cipher in the beefed-up MiFare Plus card.

Many major public transit systems around the world have made the switch from swipe cards to RFID-enabled "tap and go" cards. Switching to these RFID chips for subway passes means that anyone can potentially read a card -- even when the subway rider keeps it hidden in his pocket.

"It seems that all these wireless technologies are hyped for comfort, mostly," said Nohl. "Swiping a card is presented as cumbersome, whereas tapping a card is considered fancy and new. At the same time, these technologies are not really understood in terms of threat models."

The original announcement of the MiFare Classic chip security compromise was presented in December by Nohl and fellow researcher Henryk Plotz at the 24th Chaos Communication Congress hacker conference in Berlin.