DutchNews.nl - Transport smart card hacked again (update)

Transport users watchdog Rover and the government’s privacy council both again criticised the introduction of a transport smart card on Tuesday following news that hackers had broken into the disposable card system.

Rover spokesman Rikus Spithorst told BNR radio that trials should be halted immediately. ‘One skeleton after another is coming out of the cupboard,’ Spithorst said. He urged central government to intervene and take over the development process.

On Monday evening it emerged that students from Radboud university in Nijmegen had succeeded in hacking into the disposable version of the new transport smart card (ov-chipkaart).

Smart cards are due to replace paper tickets on all trams, buses and trains in 2009 and are currently being trialed in Rotterdam and Amsterdam.

Last week it emerged that German hackers had broken into part of the system used to protect the permanent smart card. That incident is currently being investigated by researchers from the TNO institute.

The privacy watchdog CBP said its research showed the cards broke privacy regulations. Information on passenger behaviour is being stored for almost seven years and personal details are too easy to read, the CBP said.

It is not surprising that the these disposable cards can be hacked. They do not have any “buried secret”, so they are wide open to cloning and data reading, no better than bank credit cards.

Regarding the mifare Standard cards, as used in the Netherlands transit system,, what has not been published is the major risk or replay attacks, where a purse transaction can be easily be replayed to “top-up” a card ePurse. This is because the random number generator on the card, used for security operations, has many weaknesses which have now been exposed.

OK, so a well-designed transit system has other security checks to stop this, but what happens if everybody is able to easily hack their transit cards?

In any case, the mifare Standard card was a very poor choice for a large multi-modal, multi-operator transit such as proposed for Netherlands. While this card is suitable for small transit systems, it old design and lack of on-card transaction “anti-tear” mechanism makes it totally unsuitable for large-scale transit systems. There were far better cards available, such as the mifare DESFire, for very little extra cost.

By Graeme Grieve | January 17, 2008 11:48 AM