4 ms·

Wouldn't the readers be designed against this sort of attack?

EvanAnderson 9y ago
One would hope. The small amount of IT security work I've done has taught me that such hopes are quickly and frequently dashed. Even products specifically designed for security applications have silly glaring vulnerabilities.
- Moru 9y ago
  20 years ago I laughed myself silly when I realised our new big radiocontrolled doors to the factory had 8 dipswitches to set the security code for the remote. Last month I was looking for some home-alarm system for the club house. I wasnt terribly surprised to see only 4 bit security code in some of them...
Rjevski 9y ago
The high-end MIFARE-based systems would be - there's actual crypto happening between the reader and card, no way to bruteforce that. However most keycard systems in the real world use a dumb unencrypted card that broadcasts an ID. This is vulnerable to sniffing, cloning as well as bruteforce (as this project demonstrates).
- chx 9y ago
  Those interested can read more https://security.stackexchange.com/questions/158167/mifare-desfire-ev1-cloning/158168 https://security.stackexchange.com/questions/158167/mifare-d... here. Modern fare systems (Vancouver Compass for example) use the DESfire EV1 and it's as secure as it gets.
  - Rjevski 9y ago
    Assuming they're using it properly. I remember cracking a Mifare Ultralight based bus fare system. It seemed sound as the Ultralight had write-once blocks or blocks that you could decrement depending on the card's configuration, so you could make it that a block has the number of trips remaining on the card, each time you validate the card it decrements it and there was no way to increment it. The issue in their case was that 1) they didn't set the configuration of the card properly, so the blocks they were using weren't actually configured to be decrement only, and 2) the validation machines checked whether a card had enough trips and then decremented the block without checking whether the decrement was successful. I was able to make the remaining fares block read-only while the card was full, essentially making an infinite card.
    - chx 9y ago
      As far as I am aware there's nothing on the Compass cards, just an id so it's impossible to do much about it. If you lose it, you can get a new one with balance intact which is telling.

One would hope. The small amount of IT security work I've done has taught me that such hopes are quickly and frequently dashed. Even products specifically designed for security applications have silly glaring vulnerabilities.

Moru 9y ago
20 years ago I laughed myself silly when I realised our new big radiocontrolled doors to the factory had 8 dipswitches to set the security code for the remote. Last month I was looking for some home-alarm system for the club house. I wasnt terribly surprised to see only 4 bit security code in some of them...

Rjevski 9y ago

The high-end MIFARE-based systems would be - there's actual crypto happening between the reader and card, no way to bruteforce that. However most keycard systems in the real world use a dumb unencrypted card that broadcasts an ID. This is vulnerable to sniffing, cloning as well as bruteforce (as this project demonstrates).

chx 9y ago
Those interested can read more https://security.stackexchange.com/questions/158167/mifare-desfire-ev1-cloning/158168 https://security.stackexchange.com/questions/158167/mifare-d... here. Modern fare systems (Vancouver Compass for example) use the DESfire EV1 and it's as secure as it gets.
- Rjevski 9y ago
  Assuming they're using it properly. I remember cracking a Mifare Ultralight based bus fare system. It seemed sound as the Ultralight had write-once blocks or blocks that you could decrement depending on the card's configuration, so you could make it that a block has the number of trips remaining on the card, each time you validate the card it decrements it and there was no way to increment it. The issue in their case was that 1) they didn't set the configuration of the card properly, so the blocks they were using weren't actually configured to be decrement only, and 2) the validation machines checked whether a card had enough trips and then decremented the block without checking whether the decrement was successful. I was able to make the remaining fares block read-only while the card was full, essentially making an infinite card.
  - chx 9y ago
    As far as I am aware there's nothing on the Compass cards, just an id so it's impossible to do much about it. If you lose it, you can get a new one with balance intact which is telling.