Oyster card ‘free travel’ hack to be released

Details of an Oyster Card hack, which enabled a group of scientists to ride free on the London Underground can be released to the public, a judge has ruled.

The verdict overturns an injunction made by Oyster makers NXP to keeping the weaknesses behind the ‘MIFARE Classic’ chip quiet. The researchers are reportedly planning to publish the results in October.

The hack involved researchers from Radboud University using a laptop and RFID reader to crack the algorithm used by the Oyster cards, enabling users to put credit back on it and therefore get free access.

PC Pro had previously reported that the vulnerability in question would not work for long because the data was stored on the Oyster card and a central database. Transport for London claimed that tests were done to look for clones and stopped within 24 hours.

However as these tests were done only periodically, a hacker would still be able to receive 24 hours free travel with a compromised card.

The hack could compromise more than just the Oyster card, as the MIFARE smartcard is used to access thousands of British schools and other keyless systems around the world.

NXP said that the decision meant that affected parties such as system integrators and operators using MIFARE chips would likely want to review their systems, but that October was not long enough to deal with the problem properly.

It said in a statement: “Different installations have different security requirements, however it is not conceivable that they all will have their security upgraded to the necessary level in a period of months until this paper is published; these upgrades will take up to a number of years.”

However, security expert Bruce Schneier told the BBC that the damage caused by publishing was much less than not disclosing, and said it was a dangerous assumption that criminals were not already aware of the hack.

He said: “Assume organised crime knows about this, assume they will be selling it anyway.”

Email to a friend

Print this page