A researcher has claimed to have created exploit code to crack the cryptography on a chip used in travel smartcards, including in London's Oyster card.
The exploit code can supposedly be used to undermine the cryptography on smartcards which use NXP's Mifare Classic chip, such as the Oyster card and the Dutch OV-Chipkaart.
The researcher, known as "Bla", is developing the open source software on the Google Code platform. The exploit code, entitled "Crapto-1", attempts to exploit NXP's proprietary Crypto1 algorithm. The exploit code builds on work by Dutch researchers from Radboud University in Nijmegen, who published a mathematical explanation of the algorithm and possible attack methods earlier this month.
"This project provides an implementation of the Crypto1 cipher, as well as an implementation of the attack specified by the folks in Nijmegen," wrote Bla on the Crapto1 landing page. "I'm not aware of any other public implementations at this time, I decided to write my own."
The researcher claimed that the code implements the cryptography needed to decrypt captured communications between Crypto1-based RFID tags and card readers. Bla claimed the code can "even recover the shared secret" used to verify the cryptographic process. The researcher also claimed that the code does not interfere with the hardware layer of the card readers.
A spokesperson from Radboud University said that the university was aware of the exploit code, but declined to comment further until Wednesday, when there would be "an update".
Transport for London had not responded to a request for comment at the time of writing.
Dutch freelance security journalist Brenno de Winter, who broke the story for Webwereld in the Netherlands on Monday, told ZDNet Asia sister site ZDNet UK that he had "verified the code".
"The code does work; I verified it by reading the source," said de Winter.
Attack code against Mifare Classic chips was published earlier this month by German researcher Henryk Plötz, in his doctoral thesis.
Play video
There are currently no comments for this post.