[MLUG] Practical Attack on the MIFARE Classic.

[Jeremy]

Andy Pintar wrote:
> I thought the cards used to ride the london tube for free were the 
> unecrypted single use mifare light or some such cards (no encryption)? And 
> that since then they have fixed that problem?
>
> I'm not too sure about building access, but I'm specifically interested in 
> cloning of the MIFARE Classic cards, is this currently feasible?  Are 
> people doing it?
> So far I can just find tech-news wishy-washy articles that don't hold any 
> value for me.  There was some talk earlier about cloning the STM cards and 
> I was just curious if this has been accomplished.  As far as I can see 
> this is not possible, but does anyone else know for sure otherwise?
>
> On Tue, 2 Dec 2008, Jeremy wrote:
>   
>> Lots more stuff just by googling mifare clone or similar keywords.
>> Apparently, according to first link, Dutch hackers already demo'd the hack.
>>
>> Jeremy
Have you seen http://www.youtube.com/watch?v=NW3RGbQTLhE and 
http://www.ru.nl/ds/research/rfid/. Looks do-able to me. The unencrypted 
cards were the single use cards, not the passes as far as I know, and 
the dutch guys did it on another system, but definitely with mifare 
classic cards.

"On March 7, 2008, research by the Digital Security group has revealed a 
security vulnerability in Mifare Classic RFID chips, the most commonly 
used type of RFID chip worldwide, that affects many applications using 
Mifare Classic. We have demonstrated that the proprietary CRYPTO1 
encryption algorithm used on these cards allows the (48 bit) 
cryptographic keys to be relatively easily retrieved."

Jeremy

PS: this is offlisted...