MiFare RFID crack more extensive than previously thought
Seconds, not hours, to effect; plus version tappable too
Computerworld - The ubiquitous MiFare Classic RFID chip -- used daily by millions worldwide in access control keys, subway passes and other applications -- is even easier to crack than previously thought, according to security researchers who announced the development Tuesday at EuroCrypt, an international cryptography conference in Istanbul.
Mere seconds are all that is required to crack the chip's security -- not a few hours, as estimated last month. Karsten Nohl, a computer science graduate student and one of the masterminds behind reverse-engineering MiFare security, said in an interview that it now takes only 12 seconds to recover the key on a MiFare Classic card on an ordinary laptop.
On Monday, the Dutch government issued a final report arriving at the decisive conclusion that the chips, used by millions of citizens in the Netherlands, must be replaced. An earlier Dutch report had stated that a security breach on the MiFare cards was possible, but would be too unwieldy for the average attacker to accomplish.
"The attack is really, really cheap," Nohl said. "Before they [the Dutch government] argued that you would need expensive equipment; now we're talking a few seconds on any laptop, so anyone could do it."
Equally worrisome is that there is no need for the attacker to interact actively with the physical card itself. Passive eavesdropping suffices; the attack can take place from a distance. A passive attack from 10 meters away would take a little bit longer than an active attack, Nohl said -- about 200 seconds.
The attack works for any random number generator; it also works against the Crypto-1 cipher in the beefed-up MiFare Plus card.
Many major public transit systems around the world have made the switch from swipe cards to RFID-enabled "tap and go" cards. Switching to these RFID chips for subway passes means that anyone can potentially read a card -- even when the subway rider keeps it hidden in his pocket.
"It seems that all these wireless technologies are hyped for comfort, mostly," said Nohl. "Swiping a card is presented as cumbersome, whereas tapping a card is considered fancy and new. At the same time, these technologies are not really understood in terms of threat models."
The original announcement of the MiFare Classic chip security compromise was presented in December by Nohl and fellow researcher Henryk Plotz at the 24th Chaos Communication Congress hacker conference in Berlin.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Malware and Vulnerabilities White Papers | Webcasts