Cryptology ePrint Archive: Report 2009/137
The Dark Side of Security by Obscurity and Cloning MiFare Classic Rail and Building Passes Anywhere, Anytime
Nicolas T. Courtois
Abstract: MiFare Classic is the most popular contactless smart card with about 200 millions copies in circulation worldwide. At Esorics 2008 Dutch researchers showed that the underlying cipher Crypto-1 can be cracked in as little as 0.1 seconds if the attacker can access or eavesdrop the RF communications with the (genuine) reader. We discovered that a MiFare classic card can be cloned in a much more practical card-only scenario, where the attacker only needs to be in the proximity of the card for a number of minutes, therefore making usurpation of identity through pass cloning feasible at any moment and under any circumstances. For example, anybody sitting next to the victim on a train or on a plane is now be able to clone his/her pass. Other researchers have also (independently from us) discovered this vulnerability, however our attack requires less queries to the card and does not require any precomputation. In addition, we discovered that certain versions or clones of MiFare Classic are even weaker, and can be cloned in 1 second. The main security vulnerability that we need to address with regard to MiFare Classic is not about cryptography, RFID protocols and software vulnerabilities. It is a systemic one: we need to understand how much our economy is vulnerable to sophisticated forms of electronic subversion where potentially one smart card developer can intentionally (or not), but quite easily in fact, compromise the security of governments, businesses and financial institutions worldwide.
Category / Keywords: secret-key cryptography / stream ciphers, access control, RFID, MiFare Classic, London Oyster card, reverse-engineering, covert channels, electronic subversion, implementation backdoors, information assurance
Publication Info: SECRYPT 2009, Milan Italy
Date: received 25 Mar 2009, last revised 4 May 2009
Contact author: n courtois at cs ucl ac uk
Available format(s): PDF | BibTeX Citation
Note: Now there is a better attack with on average only about wireless 300 queries to the card, which should take only about 10 seconds with the righ hardware equipment.
Version: 20090504:200142 (All versions of this report)
Discussion forum: Show discussion | Start new discussion
[ Cryptology ePrint archive ]