Mifare, Oyster and ITSO Cards Hacked Smart Card & Identity News

…. Continued from page 1
Although smart cards of the same type may be used in the ITSO environment, the risk of this kind of attack has
been recognised throughout the development of the ITSO environment and ITSO uses an internationally
recognised security system which sits over and above the proprietary security algorithm that has reportedly been
cracked.
Schemes using Customer Media of this type within the ITSO environment can be assured that, even if an
individual card can be cracked (and it reportedly took the alleged hackers a week to do so), their transport
products in the card still remain secure when the security seal is verified by the ITSO Secure Application
Module (ISAM).
ITSO, being a multi-platform Specification and environment, also offers its members the opportunity to use
other, more secure, alternative Customer Media types, should they be required.
Now maybe ITSO has come up with something revolutionary but it seems to us that if you have cracked the
crypto algorithm then you are capable of copying, emulating or counterfeiting commercial Mifare cards and
their contents without detection by the terminal. In other words you could produce a copy of a card containing
perhaps an annual first class rail ticket. No matter what cryptography has been applied to that electronic ticket if
it’s not an integral part of an authentic and verifiable smart card instrument then the terminal can’t tell one from
another. Of course you may become aware of multiple copies of such a ticket but again it’s not obvious how
you can effectively manage that process.
Just for the avoidance of doubt neither can you protect against replays but please read an updated version of
our original article on Mifare (In)security published in this month’s newsletter.
David Everett, Technical Editor.
News In Brief
US Passport Card Criticized By
Privacy Advocates
Passport cards for Americans who travel to Canada,
Mexico, Bermuda and the Caribbean will be
equipped with technology that allows information on
the card to be read from a distance. The technology
was approved Monday by the State Department and
privacy advocates were quick to criticize the
department for not doing more to protect
information on the card, which can be used by U.S.
citizens instead of a passport when travelling to other
countries in the western hemisphere.
The technology would allow the cards to be read
from up to 20 feet (6 meters) away. This process only
takes one or two seconds, said Ann Barrett, deputy
assistant secretary for passport services at the State
Department. The card would not have to be
physically swiped through a reader, as is the current
process with passports.
The technology is inherently insecure and poses
threats to personal privacy, including identity theft.
Ari Schwartz, of the Center for Democracy and
Technology, said in a statement. Schwartz said this
specific technology, called 'vicinity read', is better
suited for tracking inventory, not people.
The State Department said privacy protections would
Smart Card & Identity News • January 2008
be built into the card. The chip on the card will not
contain biographical information, Barrett said. And
the card vendor, which has yet to be decided will also
provide sleeves for the cards that will prevent them
from being read from afar, she said.
A 2004 law to strengthen border security called for a
passport card that frequent border crossers could use
that would be smaller and more convenient than the
traditional passport. Currently, officials must swipe
travellers' passports through an electronic reader at
entry points.
The technology change for passport cards was
initially proposed in October 2006, and public
comments closed on Jan. 7, 2007. The State
Department received more than 4,000 comments,
and most were about the security of the technology.
To relieve a backlog at U.S. passport offices, the
Bush administration recently delayed a requirement
that Americans present passports when crossing the
U.S. border by land or sea. The administration
wanted to begin requiring passports or passport cards
in mid-2008, but Congress mandates that the rule not
go into effect until mid-2009.
4