Unencrypted data over Magnetic Card Reader. What are the security risks?

Question

I am working on evaluating the security of my University's student id card. The ID card contains both a magnetic stripe and a RFID component and is used to make payments as well as to provide access to buildings. When I tried to read it using a Arduino based Magnetic Card Reader , I could see the data in plain text. As there is no Keyboard based PIN entered during any payment transactions from the card, my question is what all security risks are involved with this setup. I am a complete noob at security so pardon my ignorance here but I think we can use a Magnetic Card Writer to clone this card and use it in the same way as the original card. Will this be possible ?

Answer 1

In short: yes, it is very likely possible.

If the magnetic strip and the RFID are not related, then even if the data were encrypted the setup would not be secure. It would be too easy to slip the data off the original card (you can do that with a tape recorder head, and there are even iPhone apps to do that, by interfacing with the audio jack), clean them and record them back on any ISO2 card.

If the RFID and the magnetic strip are both needed, then it is much more expensive, but not difficult: you just need a RFID reader/writer.

Passive PIN-less cards are not secure, that's all there's to it. Their information can be cloned in several ways; for example I've witnessed a test on a variation of Van Eck 'phreaking', in which a sensor placed near the original card swiper was able to "hear" the chatter from the card reading head. Once you know the data on the strip, just pass near the cardholder with a RFID terminal and query the card for its data payload. Passive cards will always respond in the same way. Once you have both strip and RFID information, all you need is a blank on which to store the information.

If the magnetic strip alone is needed, things can become even worse: one could erase the magnetic strip on his own card and re-record it with someone else's information, thereby appearing to have a legitimate and authentic card that would pass a cursory examination, but actually logging accesses and debting sums to someone else.

If the target scenario doesn't involve human interaction, it is not even needed a good blank - you can demagnetize and recycle any old ISO2 card, and swipe it while wearing a RFID fob on a bracelet. The strip will supply the correct data, the fob will fool the reader into thinking there's a RFID chip on the card, and the reader will be tricked.

I am quite surprised that nowadays someone may still be considering accepting payments using a stealable card without the need of two-factor authentication (such as a PIN). I would try to warn the University - but anonymously, since this kind of setups usually practice shoot the messenger, and are too likely to pull a Feynman on you.

Answer 2

As a first remark, if there is no PIN during a transaction, then the card has no way of being sure that it is the real "you" who is currently holding it. So, if someone steals your card, he can go in full shopping-orgy mode at your expense.

A magnetic strip is no different from a few letters inked on the card, except that the strip is read by a magnetic reader instead of human eyes. Cloning a magnetic strip is as simple as reading it with a magnetic reader, and then writing it back on another card with the same reader (this time used as writer).

The RFID component can potentially be more robust. Initially, RFID was just a port of the magnetic strip technology to a wireless world: the reader emits an oscillating magnetic field, which the RFID antenna converts into some power sufficient for the component to send, over radio (through the same antenna) some static data in it. Later on, technology became better, and a RFID component can be a full-fledge small computer, able to exchange data with the reader and perform computations. At least theoretically, the component could be a tamper-resistant smart card which can store private data and do cryptography, even verifying and computing digital signatures. In that case, it is possible that the RFID component cannot be cloned, making your card "safe" (except for the lack of PIN, as explained above).

Of course, the RFID antenna does not pick up a lot of power, and the price of each card is usually low, so it is rather improbable that your student card really contains a chip able to perform signatures. However, many people are working on it. They also work on breaking it; due to the fact that the power is, by design, provided by the reader, this makes it quite challenging to protect the device from power analysis.