Oyster card ‘free travel’ hack to be released

Research behind a hack of the Oyster card will be released which has serious implications for cards using the same MIFARE chip around the world

Details of an Oyster Card hack, which enabled a group of scientists to ride free on the London Underground can be released to the public, a judge has ruled.

The verdict overturns an injunction made by Oyster makers NXP to keeping the weaknesses behind the MIFARE Classic' chip quiet. The researchers are reportedly planning to publish the results in October.

The hack involved researchers from Radboud University using a laptop and RFID reader to crack the algorithm used by the Oyster cards, enabling users to put credit back on it and therefore get free access.

PC Pro had previously reported that the vulnerability in question would not work for long because the data was stored on the Oyster card and a central database. Transport for London claimed that tests were done to look for clones and stopped within 24 hours.

However as these tests were done only periodically, a hacker would still be able to receive 24 hours free travel with a compromised card.

The hack could compromise more than just the Oyster card, as the MIFARE smartcard is used to access thousands of British schools and other keyless systems around the world.

NXP said that the decision meant that affected parties such as system integrators and operators using MIFARE chips would likely want to review their systems, but that October was not long enough to deal with the problem properly.

It said in a statement: "Different installations have different security requirements, however it is not conceivable that they all will have their security upgraded to the necessary level in a period of months until this paper is published; these upgrades will take up to a number of years."

However, security expert Bruce Schneier told the BBC that the damage caused by publishing was much less than not disclosing, and said it was a dangerous assumption that criminals were not already aware of the hack.

He said: "Assume organised crime knows about this, assume they will be selling it anyway."

Featured Resources

How to be an MSP: Seven steps to success

Building your business from the ground up

Download now

The smart buyer’s guide to flash

Find out whether flash storage is right for your business

Download now

How MSPs build outperforming sales teams

The definitive guide to sales

Download now

The business guide to ransomware

Everything you need to know to keep your company afloat

Download now

Recommended

Cyber attacks on manufacturing up 300% in a year
Security

Cyber attacks on manufacturing up 300% in a year

11 May 2021
US fuel pipeline hackers reveal their motive
ransomware

US fuel pipeline hackers reveal their motive

11 May 2021
Apple's AirTag tracker has already been hacked
hacking

Apple's AirTag tracker has already been hacked

10 May 2021
Trend Micro and Snyk team up to combat open source flaws
vulnerability

Trend Micro and Snyk team up to combat open source flaws

10 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021