Smart-card hackers expose dumb flaws

College students crack a relatively simple code in frequently used access technology to expose major security weakness.

08/26/2008


Three Massachusetts Institute of Technology (MIT) students hacked into Boston’s mass transit system earlier this year. Once in the system, they cracked the flimsy code guarding the data, enabling users to add money to fare cards without paying a penny. The act adds up to more than a prank—it exposes the inherent weakness in a security technology used in door-swipe badges, fare cards, and other security and access systems worldwide.

In 2006, the Massachusetts Bay Transportation Authority (MBTA) spent nearly $200 million upgrading its fare collection system. Because the Mifare Classic chip the new system uses a quickly crackable cipher (as demonstrated by the MIT students), MBTA officials are faced with the possibility of having to scrap that system and spend yet more revenue on a new, better-guarded technology.

Other departments have responded to the exposed security flaw. In the United Kingdom, London Underground officials installed a stopgap measure to secure the system while a permanent upgrade is being developed. In the Netherlands, government officials have placed security guards at doorways once guarded only by smart cards.





No comments
Consulting-Specifying Engineer's Product of the Year (POY) contest is the premier award for new products in the HVAC, fire, electrical, and...
Consulting-Specifying Engineer magazine is dedicated to encouraging and recognizing the most talented young individuals...
The MEP Giants program lists the top mechanical, electrical, plumbing, and fire protection engineering firms in the United States.
integrated building networks, NFPA 99, recover waste heat, chilled water systems, Internet of Things, BAS controls
40 Under 40; Performance-based design; Clean agent fire suppression; NFPA 92; Future of commissioning; Successful project management principles
BIM coordination; MEP projects; NFPA 13; Data center Q&A; Networked lighting controls; 2017 Product of the Year finalists
Transformers; Electrical system design; Selecting and sizing transformers; Grounded and ungrounded system design, Paralleling generator systems
Commissioning electrical systems; Designing emergency and standby generator systems; VFDs in high-performance buildings
Tying a microgrid to the smart grid; Paralleling generator systems; Previewing NEC 2017 changes
As brand protection manager for Eaton’s Electrical Sector, Tom Grace oversees counterfeit awareness...
Amara Rozgus is chief editor and content manager of Consulting-Specifier Engineer magazine.
IEEE power industry experts bring their combined experience in the electrical power industry...
Michael Heinsdorf, P.E., LEED AP, CDT is an Engineering Specification Writer at ARCOM MasterSpec.
Automation Engineer; Wood Group
System Integrator; Cross Integrated Systems Group
Fire & Life Safety Engineer; Technip USA Inc.
This course focuses on climate analysis, appropriateness of cooling system selection, and combining cooling systems.
This course will help identify and reveal electrical hazards and identify the solutions to implementing and maintaining a safe work environment.
This course explains how maintaining power and communication systems through emergency power-generation systems is critical.
click me