Skip to navigation
Latest News

Osyter hack details released

By Matthew Sparkes

Posted on 7 Oct 2008 at 10:47

Researchers have released information on an Oyster card security vulnerability that could leave the London Underground open to abuse by hackers.

The researchers from Radboud University in Holland announced in June that they had altered the information stored on a MIFARE RFID chip, the basis of the Oyster card system, giving them a day's free travel on the London Underground.

The chip, made by NXP, is also used in a variety of office security systems, which could also be vulnerable. Over half a billion of the RFID chips have been sold worldwide.

"Once we knew how the system worked and what the vulnerabilities were, it turned out to be very simple to actually clone cards, steal someone's identity and enter a building as someone else", said Professor Bart Jacobs, one of the research team, speaking to the BBC about an experiment with an office security system.

The researchers announced their intention to reveal the technical details behind the hack, but were delayed by a court injunction from NXP attempting to stop the release of the details.

The company has now admitted that it does not recommend the ageing MIFARE classic chip for use in new installations, and is working with existing customers to review their security infrastructure.

The paper was given yesterday at the European Symposium on Research in Computer Security in Spain, although the exact source code used by the group will not be publicly revealed.

"The illegal cloning of cards is complex, risks physical detection and is of limited value as we'll block any fraudulent card within 24 hours," says a Transport for London spokesperson.

"Ticketing fraud is a criminal offence and TfL will prosecute wherever possible. There is CCTV across the Tube, bus and DLR networks and our staff and the Police will remain vigilant."

Subscribe to PC Pro magazine. We'll give you 3 issues for £1 plus a free gift - click here

From around the web

Be the first to comment this article

You need to Login or Register to comment.

(optional)

advertisement

Most Commented News Stories
More From PC Pro
Latest Blog Posts Subscribe to our RSS Feeds
Latest ReviewsSubscribe to our RSS Feeds
Latest Real World Computing

advertisement

Sponsored Links
 
SEARCH
SIGN UP

Your email:

Your password:

remember me

advertisement


Hitwise Top 10 Website 2010
 
 

PCPro-Computing in the Real World Printed from www.pcpro.co.uk

Register to receive our regular email newsletter at http://www.pcpro.co.uk/registration.

The newsletter contains links to our latest PC news, product reviews, features and how-to guides, plus special offers and competitions.