Mifare, Oyster and ITSO Cards Hacked Smart Card & Identity News

More documents

Recommendations

Info

Smart Card & Identity News Is published monthly by Smart Card News Ltd Head Office: Smart Card Group, Columbia House, Columbia Drive, Worthing, BN13 3HD, UK. Telephone: +44 (0) 1903 691779 Fax: +44 (0) 1903 692616 Website: www.smartcard.co.uk Email: info@smartcard.co.uk Managing Director – Patsy Everett Subscriptions & Administrator – Lesley Dann Editor –John Owen Contributors to this Issue – Tom Tainton, Remy De Tonnac, Carl-Otto Künnecke, David Everett, Eustace Asanghanwa, Legic Printers – Hastings Printing Company Limited, UK ISSN – 1755-1021 Editorial Disclaimer Smart Card News Ltd shall not be liable for inaccuracies in its published text. We would like to make it clear that views expressed in the articles are those of the individual authors and in no way reflect our views on a particular issue. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means – including photocopying – without prior written permission from Smart Card News Ltd. © Smart Card News Ltd Smart Card & Identity News • January 2008 Well the Xmas holiday season is well and truly over but not without a flurry of activity at the Chaos Communication Congress held in Berlin at the end of December. Researchers Karsten Nohl (University of Virginia), Starbug and Henryk Plötz from the Chaos Computer Club Patsy Everett reported their reverse engineering attacks on the Mifare Crypto-1 security algorithm. It looks to be just a matter of time before they prove their results with a practical demonstration. I leave the more technical discussions to others which you will find reported in our lead story and also with an update on Mifare security from David Everett which we originally reported in 2004. So what does all this mean to you and me? Should we stop using our Oyster card or write to the Major of London, Ken Livingstone, to warn him of the dangers? Well we don’t need to stop using our cards because the loser here is the service provider who has the risk of providing the service to hackers for free. This was also my differentiation between a hacker and a researcher, the former sets out to abuse the commercial service upon which the technology is unraveled by the researcher. Clumsy perhaps but one just seems much nicer than the other. The problem for the user would be if the Mifare card is used as any form of identifier to an account such as an epurse or what have you, then you stand to lose by having the hacker empty your account. It’s a bit like payment cards today, the banks usually try to make you prove that you didn’t use the card rather than them prove you did. That’s not so good in a scenario full of copied or emulated cards. However significant as this may be, my memory of 2007 is all about data loss. This culminated in the HMRC’s loss of CDs containing the records of 25 million people. It’s a classic example of the failure of government departments to manage people’s privacy a point made by many security experts in their concerns about the National ID register. Worse still concerns have also been raised about the NHS national records service and other large scale public data bases. Just before Xmas we also heard about the Post Office sending out account records to the wrong people. Stolen laptops were also high on the list of data loss in 2007 and it just seems inconceivable to me that this data is not encrypted. There must be hundreds of commercial products available to protect this sort of data, why isn’t it being used? Encryption of data and smart cards for access control are fundamental security controls yet the organisations you would most expect to be using such techniques are seemingly falling down on the most basic principles. The banks through Mastercard and Visa have been progressively enhancing the security of cardholder data most recently with the Payment Card Industry (PCI) Data Security Standard (DSS) that must be adopted by all organisations storing or processing card holder data. Is the government really that far behind? Let’s hope that in 2008 we see evidence of a more credible security approach. Patsy. Our Comments Dear Subscribers, 2
Contents Regular Features Lead Story - Mifare, Oyster and ITSO Cards Hacked …...……………..1 Events Diary …………………………………………………………3 World News In Brief .…………………………………...…………. 4,7 Industry Articles Interview with Remy De Tonnac – CEO of Inside Contactless ……… 6 Growing market for PIN applications ..………………………………. 9 Versatile Hardware Security With Cryptographic RF Smartcards …….. 11 Mifare (In)security Update January 2008….………………………….. 14 LEGIC embeds badge and purse into NFC mobile phones ...………... 17 Buying into Contactless Payment …………………………………….. 19 Events Diary January 2008 16-18 Omnicard 2008 - Berlin, Germany 13-15 Intersec Middle East - Dubai, UAE 22-23 Global Payments Strategies - Brussels, Belgium 22-23 Nordic Card Markets - Stockholm, Sweden 29-30 Global RFID ROI 2008 - Munich, Germany 29-30 2nd Annual Card & Payment Developments in CEE - Vienna, Austria February 2008 5-6 Cards & Payments Innovation Summit 2008 - Barcelona, Spain 11-14 GMSA MobileWorld Congress 2008 - Barcelona, Spain Smart Card & Identity News • January 2008 3
Page 1: dentity News • Smart Card & Ident
Page 5 and 6: Payzone To Target The 'Unbanked' Wi
Page 7 and 8: What are the changes or differences
Page 9 and 10: Carl-Otto Künnecke Growing market
Page 11 and 12: Versatile Hardware Security With Cr
Page 13 and 14: True Hardware-based Security Crypto
Page 15 and 16: It is important to note that the cr
Page 17 and 18: attacks. The Mifare card because it
Page 19 and 20: Buying into Contactless Payment By

Mifare, Oyster and ITSO Cards Hacked Smart Card & Identity News

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?