9 ms·

https://en.wikipedia.org/wiki/MIFARE#Security_of_MIFARE_Classic.2C_MIFARE_DESFire_and_MIFARE_Ultralight https://en.wikipedia.org/wiki/MIFARE#Security_of_MIFARE_

by Rafert 11y ago

https://en.wikipedia.org/wiki/MIFARE#Security_of_MIFARE_Classic.2C_MIFARE_DESFire_and_MIFARE_Ultralight https://en.wikipedia.org/wiki/MIFARE#Security_of_MIFARE_Clas... seems to be a good start.

glastra 11y ago
This reminds me of the ubiquity of insecure MIFARE Classic chips. My previous workplace (an international organization that shall remain anonymous) had vending machines where you could "buy" an RFID key that acted sort of like a "wallet". You could refill it by putting it inside the vending machine and then inserting coins, or you could use it to buy goods from the machines. It used MIFARE Classic and was trivial to break, and the cash amount was stored as cents in a short integer. Fun stuff, you could even buy deodorant and panties. Then, several towns in my country use RFID cards for public transportation payment. Guess what? Even systems implanted AFTER these cards were deemed highly insecure are using them.
- lucaspiller 11y ago
  One place I worked at while in college had a similar thing with smart cards. The vending of the product and debiting of the card wasn't an atomic operation, so if you removed the card at the right time you'd still get the product but not be charged.
  - throw91283 11y ago
    They must have changed that. At a cafeteria that uses MIFARE cards the operation is still not atomic, but the customer loses: If you remove the card at the wrong time, the card is debited but the transaction does not show up on the cashier's terminal, leading to heated arguments. The transaction does show up in the central database, so after spending 20 min writing a complaint you get your money back after a few days. I guess this is called progress.
- mitoyarzun 11y ago
  In Santiago, Chile, the public transportation system uses Mifare Classic cards, and few apps that (ilegally) refilled the cards appeared a while ago. The solution given by the government was to block the cards that were used with fraudulent refills on a weekly basis, but there is always the possibility of changing the ID or purchasing blank cards. Of course the system was chosen years after the vulnerabilities were discovered, too. My guess is that the only way to stop this is to replace all the scanners, which will be far more expensive than losing a few thousand paying customers per day.

by Rafert 11y ago

https://en.wikipedia.org/wiki/MIFARE#Security_of_MIFARE_Classic.2C_MIFARE_DESFire_and_MIFARE_Ultralight https://en.wikipedia.org/wiki/MIFARE#Security_of_MIFARE_Clas... seems to be a good start.

glastra 11y ago

This reminds me of the ubiquity of insecure MIFARE Classic chips. My previous workplace (an international organization that shall remain anonymous) had vending machines where you could "buy" an RFID key that acted sort of like a "wallet". You could refill it by putting it inside the vending machine and then inserting coins, or you could use it to buy goods from the machines. It used MIFARE Classic and was trivial to break, and the cash amount was stored as cents in a short integer. Fun stuff, you could even buy deodorant and panties. Then, several towns in my country use RFID cards for public transportation payment. Guess what? Even systems implanted AFTER these cards were deemed highly insecure are using them.

lucaspiller 11y ago
One place I worked at while in college had a similar thing with smart cards. The vending of the product and debiting of the card wasn't an atomic operation, so if you removed the card at the right time you'd still get the product but not be charged.
- throw91283 11y ago
  They must have changed that. At a cafeteria that uses MIFARE cards the operation is still not atomic, but the customer loses: If you remove the card at the wrong time, the card is debited but the transaction does not show up on the cashier's terminal, leading to heated arguments. The transaction does show up in the central database, so after spending 20 min writing a complaint you get your money back after a few days. I guess this is called progress.
mitoyarzun 11y ago
In Santiago, Chile, the public transportation system uses Mifare Classic cards, and few apps that (ilegally) refilled the cards appeared a while ago. The solution given by the government was to block the cards that were used with fraudulent refills on a weekly basis, but there is always the possibility of changing the ID or purchasing blank cards. Of course the system was chosen years after the vulnerabilities were discovered, too. My guess is that the only way to stop this is to replace all the scanners, which will be far more expensive than losing a few thousand paying customers per day.