I am working on evaluating the security of my University's student id card. The ID card contains both a magnetic stripe and a RFID component and is used to make payments as well as to provide access to buildings. When I tried to read it using a Arduino based Magnetic Card Reader , I could see the data in plain text. As there is no Keyboard based PIN entered during any payment transactions from the card, my question is what all security risks are involved with this setup. I am a complete noob at security so pardon my ignorance here but I think we can use a Magnetic Card Writer to clone this card and use it in the same way as the original card. Will this be possible ?
1
-
Its worth pointing out that if the amount of money in your account is contained in the data, that could in theory, be used to duplicate state the data is in. It depends what is contained within the data. If all you have is data pointing to an account that is more secure then unencrypted currency data. Its still insecure since the data isn't encrypted and doesn't require a pin.– RamhoundApr 22, 2013 at 16:38
Add a comment
|
2 Answers
In short: yes, it is very likely possible.
If the magnetic strip and the RFID are not related, then even if the data were encrypted the setup would not be secure. It would be too easy to slip the data off the original card (you can do that with a tape recorder head, and there are even iPhone apps to do that, by interfacing with the audio jack), clean them and record them back on any ISO2 card.
If the RFID and the magnetic strip are both needed, then it is much more expensive, but not difficult: you just need a RFID reader/writer.
Passive PIN-less cards are not secure, that's all there's to it. Their information can be cloned in several ways; for example I've witnessed a test on a variation of Van Eck 'phreaking', in which a sensor placed near the original card swiper was able to "hear" the chatter from the card reading head. Once you know the data on the strip, just pass near the cardholder with a RFID terminal and query the card for its data payload. Passive cards will always respond in the same way. Once you have both strip and RFID information, all you need is a blank on which to store the information.
If the magnetic strip alone is needed, things can become even worse: one could erase the magnetic strip on his own card and re-record it with someone else's information, thereby appearing to have a legitimate and authentic card that would pass a cursory examination, but actually logging accesses and debting sums to someone else.
If the target scenario doesn't involve human interaction, it is not even needed a good blank - you can demagnetize and recycle any old ISO2 card, and swipe it while wearing a RFID fob on a bracelet. The strip will supply the correct data, the fob will fool the reader into thinking there's a RFID chip on the card, and the reader will be tricked.
I am quite surprised that nowadays someone may still be considering accepting payments using a stealable card without the need of two-factor authentication (such as a PIN). I would try to warn the University - but anonymously, since this kind of setups usually practice shoot the messenger, and are too likely to pull a Feynman on you.
-
Talking about the magnetic strip alone scenario, If the data is stored and sent over the magnetic reader in encrypted form and decrypted by the reader itself and then used , will that help ? Also as the card is used by many different independent vendors across the campus , will there be any sort of conflict on agreeing upon a shared mutual key for data transfer in this case ? Apr 20, 2013 at 14:47
-
1I don't think it would help, in that the problem is the physical security of the card itself. Almost anyone could clone the card with the owner none the wiser (with an iPhone/Android and $20 of hardware); and then, there's always good ol' theft.– LSerniApr 20, 2013 at 14:55
-
@user1952143 - How is the reader going to decrypt something it doesn't have a key for?– RamhoundApr 22, 2013 at 16:40
-
That's what I was asking in the latter part of my comment. Decryption at the readers will require them to be modified. For so many readers across the campus , this wont be possible I guess. Apr 22, 2013 at 16:49
As a first remark, if there is no PIN during a transaction, then the card has no way of being sure that it is the real "you" who is currently holding it. So, if someone steals your card, he can go in full shopping-orgy mode at your expense.
A magnetic strip is no different from a few letters inked on the card, except that the strip is read by a magnetic reader instead of human eyes. Cloning a magnetic strip is as simple as reading it with a magnetic reader, and then writing it back on another card with the same reader (this time used as writer).
The RFID component can potentially be more robust. Initially, RFID was just a port of the magnetic strip technology to a wireless world: the reader emits an oscillating magnetic field, which the RFID antenna converts into some power sufficient for the component to send, over radio (through the same antenna) some static data in it. Later on, technology became better, and a RFID component can be a full-fledge small computer, able to exchange data with the reader and perform computations. At least theoretically, the component could be a tamper-resistant smart card which can store private data and do cryptography, even verifying and computing digital signatures. In that case, it is possible that the RFID component cannot be cloned, making your card "safe" (except for the lack of PIN, as explained above).
Of course, the RFID antenna does not pick up a lot of power, and the price of each card is usually low, so it is rather improbable that your student card really contains a chip able to perform signatures. However, many people are working on it. They also work on breaking it; due to the fact that the power is, by design, provided by the reader, this makes it quite challenging to protect the device from power analysis.
answered Apr 20, 2013 at 14:12
