6

Several systems rely on using UID of smart card for identification/authorization. For example database stores list of smart card UIDs and corresponding privileges.

Given that today there exist cards where you can write any UID you want and thus emulate say Mifare classic UID for example, what are practices of using smart card UID for authorization?

In other word fear is if I use Mifare Classic UID for authorization, someone may purchase some Chinese card, where you can assign any UID you want - and hence holder of such card, can impersonate original holder of my Mifare Classic.

Are there ways to overcome this? How (or do at all?) people use smart card UID for authorization?

5
+100

The Mifare Classic has been broken several years ago (their weak, obscure and proprietary encryption got broken) and so was the Mifare DESfire v1. You should rely on stronger algorithms (preferentially open strong ones) and also have a monitoring system that detects abnormal behavior to detect cloning or tampering. It just depends on the level of security you need.

We have at work an RFID payment system for the coffee machines. Setting up a bio metric+code+network scrutiny on those cards would be overkill. Since they rely on Mifare classic, it's possible with the Proxmark device (i personally never tested, but others did, just google cloning mifare classic proxmark) to set whatever amount of money on the card and get unlimited coffee. But the Proxmark device costs around 300$ so it's not cost-effective if you are not a coffee addict (and it's morally wrong, but perfectly doable).

But if you are talking access authorization, this card is a big no-no. (you could use Mifare DESfire v2 if you want to stay with Mifare for example, but again, look for the level of security each offers, and if it fits your needs).

"We do not recommend the use of Mifare Classic for new installations. We are working with customers to review their security." source: http://news.bbc.co.uk/2/hi/programmes/click_online/7655292.stm

edit: to have a broader view of the risks you are facing by using an RFID authorization system, check http://www.oecd.org/sti/ieconomy/40892347.pdf, at "2.1.1. Typology of risks", you'll be able to confront this knowledge with the security solutions vendors propose.

  • Well yes, imagine if I use some Mifare for ecash(small amounts). I store Mifare card IDs in database next to user balance. Reader reads card UID sends UID to database, to complete transaction. But if someone buys that chip to which you can assign any UID, this system is broken. I am not sure, if all Mifare Classic UIDs can be cloned though....... (e.g., plus, etc.) - but also like noted above, implementing some more advanced Mifares maybe more tricky – user32987 May 19 '14 at 13:31
  • if you already have an infrastructure based on the Mifare Classic and you don't want to change all the cards (remember that some readers are compatible with newer & more secure cards), the only thing I could suggest is based on log surveillance, for example add a script that mails the owner of that card's ID automatically when there is activity on his account. That way you can deactivate the card when the user tells you something fishy goes on (but he still looses the money of the illegal transaction(s) ).You also have to add a limit on card uses per day to give him time check his mails. – zX8iqV May 19 '14 at 15:18
  • No, I don't have existing infrastructure based on Mifare Classic. Like I said was thinking to use UID of Mifare cards for identifying which custumer made purchase, then in database check if such customer(using UID retrieved from reader) has enough balance. Like I said ecash for little amount. I know cards exist to which you can assign any ID -then I thought maybe these cards can't emulate say Mifare Plus UID- but I think as far as UID is concerned it is dangerous even with Mifare Plus? – user32987 May 19 '14 at 18:07
2

It's generally always a bad idea to rely on any single authentication mechanism. Refer to the defence in depth for that. A biometric + smartcard, or smartcard + password or similar 2FA would be appropriate in an environment that demands higher than average security.

As for RFID Cards, do correct me if I'm mistaken but MiFare is a manufactureer of more than one RFID based "smart card" solutions. And although it is true that some of their cards such as the MiFare Classic are easily vulnerable to cloning, PoCs for some of their other products are more difficult to implement.

Secondly, cloning relies on being able to get one's hands on the original card. Physical security should be inplace to make this difficult (RFID proof wallets, etc.).

The RFID based cards are currently being used in the payment card industry, public rail networks, corporate offices with low publicly reported crime rates which leads to me to believe that for most current applications the profit outweighs the security risks.

Card tracking is an interesting policy wherein by monitoring the last used location of a card, anomalies can be detected in a central system. For example in places where people use their card twice to swipe another individual in, a card tracking policy can alert security to investigate. Depending on criticality of secured assets, an appropriate intrusion detection or prevention policy can be adopted.

Security Considerations:

  • Choose a rfid solution that is harder to clone.
  • Employee training.
  • Usage of RFID blocking sleeves.
  • Card Tracking
  • Use 2FA, instead of only relying on the smartcard.
  • Durve-Decode: Well yes, imagine if I use some Mifare for ecash(small amounts). I store Mifare card IDs in database-next to user balance. Reader reads card UID sends UID to database, to complete transaction. But if someone buys that chip to which you can assign any UID, this system is broken. I am not sure, if all Mifare Classic UIDs can be cloned though....... (e.g., plus, etc.) – user32987 May 19 '14 at 13:31
  • Everything will eventually be broken. Even if you invest in a more secure (and more expensive) RFID solution it will eventually be broken. 2FA is the only way to add good resilience. People trying to clone RFIDs for eCash are low in number not because you need a 300$ device, as there have been much cheaper solutions with successful clones from specific root'd Android phones, but rather the fact that you need the knowledge and proximity to someone's card to clone. If someone reports a erronious balance, replacing their card is cheaper than adopting more expensive solution for everyone. – Rohan Durve May 23 '14 at 13:16
  • In this case they would just have to buy this: xfpga.com/html_products/sp-mf-1k-cpu-26.html, assign ID of valid smart card, and they would be able to make purchase. Indeed, first they would need to get close to someone to get the UID. We could add detection methods like during payment users gets SMS, but still the money would be lost right??? – user32987 May 23 '14 at 13:29
  • No RFID solution is completely secure. Money will always be lost. The only equation you need to consider is if it more profitable to invest in better security or resist damage from security compromises. If you go for a more secure solution, it will cost more. Let's say it costs you 2£ more for an RFID solution that will be cracked in the next 3 years (an optimistically long time). Per 1000 customers, you're now losing 2000£. Maybe if you used the MiFare DESFire you'd have sufferred loss from theft, but would it be more than this security investment? – Rohan Durve May 23 '14 at 14:21
  • Eg. en.wikipedia.org/wiki/Oyster_card#Technology The entire London underground uses DESFire and surely if the the bussiness loss was very significant they would have switched by now. – Rohan Durve May 23 '14 at 14:22
0

its not, simly said, no encoding is bullet proof, no UID is "un-impersonatable" or however its called, spoofing UID's, MAC adresses or anything with a number, is plausible, the other one harder then the other.

so yes, in the long run, you can emulate the ID

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy