Mifare, Oyster and ITSO Cards Hacked Smart Card & Identity News

Smart Card & Identity News
Is published monthly by
Smart Card News Ltd
Head Office: Smart Card Group,
Columbia House, Columbia Drive,
Worthing, BN13 3HD, UK.
Telephone: +44 (0) 1903 691779
Fax: +44 (0) 1903 692616
Website: www.smartcard.co.uk
Email: info@smartcard.co.uk
Managing Director – Patsy Everett
Subscriptions & Administrator –
Lesley Dann
Editor –John Owen
Contributors to this Issue – Tom
Tainton, Remy De Tonnac, Carl-Otto
Künnecke, David Everett, Eustace
Asanghanwa, Legic
Printers – Hastings Printing Company
Limited, UK
ISSN – 1755-1021
Editorial
Disclaimer
Smart Card News Ltd shall not be liable
for inaccuracies in its published text.
We would like to make it clear that
views expressed in the articles are those
of the individual authors and in no way
reflect our views on a particular issue.
All rights reserved. No part of this
publication may be reproduced or
transmitted in any form or by any
means – including photocopying –
without prior written permission from
Smart Card News Ltd.
© Smart Card News Ltd
Smart Card & Identity News • January 2008
Well the Xmas holiday season is well and truly
over but not without a flurry of activity at the
Chaos Communication Congress held in Berlin
at the end of December. Researchers Karsten
Nohl (University of Virginia), Starbug and
Henryk Plötz from the Chaos Computer Club
Patsy Everett reported their reverse engineering attacks on the
Mifare Crypto-1 security algorithm. It looks to
be just a matter of time before they prove their
results with a practical demonstration. I leave the more technical
discussions to others which you will find reported in our lead story
and also with an update on Mifare security from David Everett which
we originally reported in 2004.
So what does all this mean to you and me? Should we stop
using our Oyster card or write to the Major of London, Ken
Livingstone, to warn him of the dangers? Well we don’t need to stop
using our cards because the loser here is the service provider who has
the risk of providing the service to hackers for free. This was also my
differentiation between a hacker and a researcher, the former sets out
to abuse the commercial service upon which the technology is
unraveled by the researcher. Clumsy perhaps but one just seems
much nicer than the other.
The problem for the user would be if the Mifare card is used
as any form of identifier to an account such as an epurse or what
have you, then you stand to lose by having the hacker empty your
account. It’s a bit like payment cards today, the banks usually try to
make you prove that you didn’t use the card rather than them prove
you did. That’s not so good in a scenario full of copied or emulated
cards.
However significant as this may be, my memory of 2007 is
all about data loss. This culminated in the HMRC’s loss of CDs
containing the records of 25 million people. It’s a classic example of
the failure of government departments to manage people’s privacy a
point made by many security experts in their concerns about the
National ID register. Worse still concerns have also been raised
about the NHS national records service and other large scale public
data bases. Just before Xmas we also heard about the Post Office
sending out account records to the wrong people.
Stolen laptops were also high on the list of data loss in 2007
and it just seems inconceivable to me that this data is not encrypted.
There must be hundreds of commercial products available to protect
this sort of data, why isn’t it being used? Encryption of data and
smart cards for access control are fundamental security controls yet
the organisations you would most expect to be using such techniques
are seemingly falling down on the most basic principles.
The banks through Mastercard and Visa have been
progressively enhancing the security of cardholder data most recently
with the Payment Card Industry (PCI) Data Security Standard (DSS)
that must be adopted by all organisations storing or processing card
holder data. Is the government really that far behind? Let’s hope that
in 2008 we see evidence of a more credible security approach.
Patsy.
Our Comments
Dear Subscribers,
2