U.VA. researchers crack smartcard chips – Mifare Classic security proven weak

Last week, I reported about the University students who cracked the encryption used in several common types of smartcard. I had the chance to hold a phone conversation and a brief email exchange with Karsten Nohl recently. This is a follow-up to that article, offering better information, as well as final confirmation; the Mifare from NXP is cracked.

Last week, I reported about the University students who cracked the encryption used in several common types of smartcard. I had the chance to hold a phone conversation and a brief email exchange with Karsten Nohl, who conducted the research with two others. This is a follow-up to that article, offering better information, as well as final confirmation; the Mifare from NXP is cracked.

The cards that use the Mifare Classic chip are a common sight in the U.S., some examples include subway passes or door badges. The results of the code being decrypted means attackers can clone them, and use the cloned cards for nefarious means.

Karsten Nohl, age 26, and his two German partners dismantled the Mifare chip found inside the smartcards, and mapped out the security algorithm. They ran the formula through a computer program and broke the encryption after a few hours.

"I don't want to help attackers, but I want to inform people about the vulnerabilities of these cards," said Nohl, a Ph.D. candidate in computer engineering to the Associated Press.

The story starts long before you read about it last week. So what captured Karsten’s attention? “RFIDs fascinate me for the challenges they bring about; in particular for security. Optimally, RFIDs would be as secure as alternative ways of authentication, also resistant against new attacks that are specific to wireless technologies, and finally cheap enough to secure low-value items. This obvious contradiction and the trade-offs it requires is what fascinates me,” he said in his interview.

“Our group got started on Mifare when we wanted to know how well the millions of its users are protected. Personally, I also draw motivation from Mifare's weaknesses for my research in which I try to build stronger cryptography and first had to show that stronger crypto is indeed needed,” he added.

In fact, long before the American press caught wind of the story, the research team from U. VA. had already gained press attention in the Netherlands, where there was an investigation into their research.

The Mifare Classic chip is developed and sold by NXP Semiconductors, based out of the Netherlands.  NXP has disputed the claims, calling the Mifare secure as only one layer of security was potentially cracked, and that only part of the algorithm was recovered.

“I am not exactly following NXP's rhetoric in this point. They have different products, many of which are very secure. The security of the particular card we analyzed, however, relies entirely on its cryptography which we found to be weak,” Nohl said when asked about NXP’s claim to multi layers of security and the claim that only part of the algorithm was recovered.

Another defense that has been offered allegedly by NXP and directly by a Dutch government investigation, is that it would be difficult and expensive to replicate Nohl’s research.

“The Mifare stream cipher is simple and its key is short. This alone should tell anybody that secret keys can be found cheaply. To finally end the discussion about how cheaply exactly, we made public a new attack on the cipher today that exploits its weak structure. Bottom-line: The computer you are reading this e-mail on can find secret keys in at most an hour,” Nohl told The Tech Herald in his interview.

However, once and for all, was the Mifare cracked, and a complete algorithm obtained? “We have the complete cryptographic algorithm,” Nohl said.

It is important to note that the Mifare is only one chip that NXP sells. Nohl himself says that there is no doubt the other two NXP chips are likely very secure. The problem is that this chip is on the low end of the price scale, thus it is an attractive item for companies who want security and want to keep costs down.

The trade between security and cost is a common one. All too often companies will save on the bottom line, shorting security in the process. Take the CharlieCard used in Boston, this card uses the Mifare Classic, and is used to grant access to Boston’s transit system called T. Currently, Boston is looking into using the CharlieCard to grant access to bank accounts in order to allow commuters to pay Mass Pike tolls and park in government owned areas.

With so many people using the CharlieCard, naturally the cost had to be low for Boston to pick NXP as their vendor to supply the RFID technology. The problem is that with the low cost came proven low security. Boston, like any other company, would trust the vendor, and naturally pick the lowest solution available.

Nohl, agrees. “If the manufacturer assures you that even the cheapest alternative has proven secure for more than a decade and provides "advanced security levels" wouldn't you go with it? This is yet another reason why the security of these systems has to be evaluated independently.”

What happens is that the sales reps often meet with buyers who have no knowledge or need to ask about security beyond a simple “Is it secure?” Often security planning and policy are introduced after the product is already deployed.

Some of the early reports state that the Mifare is used in credit cards, I asked Karsten if this was accurate, and if the media has reported his work fairly. “For the most part, the coverage was accurate, the only exception being the connection between our work and credit cards. We haven't compromised anything about credit cards as there is nothing to compromise,” he said.

So while credit cards might be simple to copy, serious crime using the copies obtained with RFID cracking would be difficult. “Systems in which the cards are used might still have other layers of security that potentially mitigate attacks. Credit cards are an example where the cards can easily be copied but fraud is often detected in the backend system.”

So what does this research mean? The research shows that a chip that is over twenty years old is not as secure today as it was when it was introduced. The research shows that there is a potential for abuse and risk to the owners of cards who use this technology. It shows that NXP has stronger encryption available, but instead chooses to sell Mifare anyway.

In a worst case scenario, speaking from the worst possible point of security, it could be possible to use this research to break security at power plants and other moderately secured areas. National security is not at risk, but that does not mean that the cloning of keycards, to gain illegal access to facilities protected by card access alone, is out of line.

RFID has always been seen as a privacy risk at the least. However, the scare is, these cards are being linked to financial businesses. So this means that fraud and other crimes will run wild, right?  False, this is a myth. Is the potential there? Yes it is, but for the most part, financial institutions have very stable and strong methods of security.  Will the financial sector use stronger encryption if the use of pay cards prevails?

“The financial sector is very inconsistent in that respect. Bank cards in Europe have, with few exceptions, always been built around strong cryptography. Credit cards that are particularly popular in the States, on the other hand, were notoriously easy to copy and this trend seems to continue for RFID-enabled credit cards,” Nohl says. “The better cryptography that is underway for credit cards will not change this in terms of privacy but rather improve the protection against financial fraud.”

Disclosure: NXP, in response to communications from Nohl and review of his research, announced on Monday they are releasing a new version of the Mifare chip. Part two of this story will cover that release.  This announcement came after this story was in the process of being written.

Like this article? Please share on Facebook and give The Tech Herald a Like too!

From our Other Sites

Awesome Stuff Made Out Of Car Parts

An awesome picture has started doing the rounds showing a bathroom with sinks made out of car tires and faucets created from gas pumps. It’s the ideal bathroom for any discerning car nut. That got us thinking — what other stuff is there made out of car parts and car paraphernalia. Here are some of the coolest […]

Range Rover Evoque Convertible Confirmed

Land Rover has officially confirmed that the Range Rover Evoque Convertible will go on sale in 2016. The company released some publicity photos showing a prototype of the Evoque Convertible driving through train tunnels under construction in London. The company says use of the Crossrail tunnels let them test the convertible in privacy. A Land […]

Mercedes-AMG GT3 Racing Car to Debut at Geneva Motor Show

The company says the standard Mercedes-AMG GT already provides the ideal base for the race model, with low centre of gravity, good weight distribution and wide track width.The driver sits on a carbon-fibre seat pan and is protected by a roll-over cage made from high-tensile steel.The engine cover, doors, front wing, sidewalls, side skirts, diffuser, […]

Man Makes Tiny Edible Pancakes with Tiny Kitchen Tools (Video)

This Japanese guy cooks up some pancakes…nothing special there right? Well he uses tiny implements to do it and makes perfect little pancakes. Kinda cool and they look tasty!

What Color is this Dress?

White and Gold or Blue and Black?
Well this one has been trending all over the web, just what color is this dress? It all started in Scotland when the mother of a bride-to-be sent a picture to her daughter asking what she thought of the dress. The bride and groom each saw the image differently, this then got posted online and picked up by some viral sites. The lighting in the photo is probably causing different people to see it as either white and gold or blue and black. Prof Stephen Westland, chair of color science and technology at a university in the UK told the BBC that it was impossible to see what other people see but that it […]

McLaren 675LT Pictures

Some great shots of the forthcoming McLaren 675LT. This coupe will get you to 60mph in less than 2.9 second and go all the way to 205mph.

McLaren 675LT Details

McLaren’s 675LT will debut at this year’s Geneva show and promises some eye-popping performance. The coupe only 675LT has a 3.8 liter V8 that will get you from 0-60mph in less than 2.9 seconds and to 124mph in less than 7.9 secondsMore than a third of the parts have been changed compared with its stable mate […]

McLaren 675LT Wallpaper

Some cool McLaren 675LT Wallpaper. The McLaren 675LT is the latest coupe to come from the supercar maker and has a top speed of 205mph.Click on an image to open a page with multiple sizes that you can download to use as wallpaper for your mobile or desktop.More McLaren Wallpaper.

Octopus hunts on land, grabs crab (Video)

This crab is minding its own business searching the rock pools for food when suddenly an octopus leaps out of the water and grabs it. The amazing thing is that the octopus does not just jump on the crab it actually pulls it all the way back to the rock pool it came from. If you check the second video you will see it is not unknown for octopus to come out of the water and the one in the second video has a crab with it, though is not hunting one! Octopus Walks on Land at Fitzgerald Marine Reserve The video was taken by Porsche Indrisie in Yallingup, Western […]

Stunning Mars Rover Selfie

This image by the Curiosity Mars rover is not exactly your typical selfie. It is made up of a bunch of images taken by the rover during January 2015 by the Mars Hand Lens Imager. This (MAHLI) camera is at the end of the robot’s arm. For a sense of scale the rover’s wheels are about 20 inches diameter and 16 inches wide. Check the annotated image below for more information on the surroundings. Also if you really want to see some detail click this very large image, 36mb, at NASA.