University students in Virginia crack smartcard chips (corrected)

by Steve Ragan - Mar 4 2008, 18:00

Just days after Cambridge researchers broke Chip & PIN in the U.K., across the pond, a graduate student at the University of Virginia along with two friends have cracked the code used for the chips inside smartcards.

The cards are a common sight in the U.S., subway passes, door badges, and car keypads all use the RFID technology that was cracked. The results of the code being decrypted means attackers can clone them, and use the cloned cards for nefarious means. Karsten Nohl, age 26, and his two German partners dismantled the chip found inside the smartcards, and mapped out the security algorithm. They ran the formula through a computer program and broke the encryption after a few hours."I don't want to help attackers, but I want to inform people about the vulnerabilities of these cards," said Nohl, a Ph.D. candidate in computer engineering to the Associated Press.The research was disclosed at Chaos Communications Congress (CCC) in Berlin. However, they will not discuss the methods used to defeat the chips. The chips that were targeted are from NXP Semiconductors, based out of the Netherlands. In a statement to the AP, NXP disputed the claims made by Nohl and his partners, arguing that they only had part of the security algorithm.Taking the same stance as the chip makers in the U.K., NXP is downplaying the fact that someone was able to crack the algorithm, even if only in part. Nohl would not say exactly what was decrypted; the only proof was in the presentation at CCC. All of the code or some of the code, the fact is Nohl and his friends got something. That alone should give NXP pause, and make them consider upgrading security.

Edit:

This story was corrected to remove references to credit cards. The correction was made after an email from NXP.

"Karsten’s claims regarding cracking the security surrounding credit card and car keys are not accurate. Their work is restricted to obtaining only part of the cryptographic algorithm found primarily in contactless transportation systems (but not credit cards nor automobile key systems), leaving the overall end-to-end security of the whole system functioning as intended. The chip level security in these contactless transportation systems is just one part of a multi-layered system," NXP said.

In 2007 at the CCC, Karsten Nohl presented problems with RFID and mentioned credit systems, keyless entry, and ignition for autos. This recent research centered on NXP made chips, and rehashed some of the earlier concerns.

Source: http://events.ccc.de/congress/2007/Fahrplan/events/2378.en.html

-Steve

Comment on this Story

Interested in a more interactive TTH? Join our Facebook Group
Want regular updates from The Tech Herald? Follow us on Twitter

Comment on this Story

Note our older Talkback system is still running below. We hope to import existing comments into the new system shortly. Guest posting is still allowed, however, you can now login with any number of social network accounts.

Talkback

Add your comment (no registration required)

page: 1

WaltMar 5th, 2008 - 15:57:06

If someone cracks the code for credit cards they likely won't tell anyone and use the hack to gain access to the contactless credit card or subway card in your wallet.

Why not spend a couple of bucks and make sure they can't read your cards. Put them in a shielded card sleeve. Identity Stronghold sells a Secure Sleeve at www.idstronghold.com

In the UK you can buy a SkimStopper sleeve from www.smartcardfocus.com/skimstopper

Report this comment

Brevy CannonMar 5th, 2008 - 18:37:33

Steve,
I wrote the story that formed the basis for this report. There are several juicy issues raised by this research that weren't addressed in the AP report. I think your readers might appreciate a fuller version of this story. Please contact me to discuss. Thanks.

Brevy Cannon
brevy@virginia.edu
434-243-0368

Report this comment

page: 1

Add your comment (no registration required)

Security

University students in Virginia crack smartcard chips (corrected)

Comment on this Story

Talkback

Latest

Latest Articles on Monsters&Critics

In The Tech Herald

Site

The Fine Print