Oyster card ‘free travel’ hack to be released
Research behind a hack of the Oyster card will be released which has serious implications for cards using the same MIFARE chip around the world
The verdict overturns an injunction made by Oyster makers NXP to keeping the weaknesses behind the MIFARE Classic' chip quiet. The researchers are reportedly planning to publish the results in October.
The hack involved researchers from Radboud University using a laptop and RFID reader to crack the algorithm used by the Oyster cards, enabling users to put credit back on it and therefore get free access.
PC Pro had previously reported that the vulnerability in question would not work for long because the data was stored on the Oyster card and a central database. Transport for London claimed that tests were done to look for clones and stopped within 24 hours.
However as these tests were done only periodically, a hacker would still be able to receive 24 hours free travel with a compromised card.
The hack could compromise more than just the Oyster card, as the MIFARE smartcard is used to access thousands of British schools and other keyless systems around the world.
NXP said that the decision meant that affected parties such as system integrators and operators using MIFARE chips would likely want to review their systems, but that October was not long enough to deal with the problem properly.
It said in a statement: "Different installations have different security requirements, however it is not conceivable that they all will have their security upgraded to the necessary level in a period of months until this paper is published; these upgrades will take up to a number of years."
However, security expert Bruce Schneier told the BBC that the damage caused by publishing was much less than not disclosing, and said it was a dangerous assumption that criminals were not already aware of the hack.
He said: "Assume organised crime knows about this, assume they will be selling it anyway."
How to be an MSP: Seven steps to success
Building your business from the ground upDownload now
The smart buyer’s guide to flash
Find out whether flash storage is right for your businessDownload now
How MSPs build outperforming sales teams
The definitive guide to salesDownload now
The business guide to ransomware
Everything you need to know to keep your company afloatDownload now