Where more than 20 million transport cards in Russia are vulnerable: disassemble and develop MIFARE Classic
The MIFARE Classic contactless card standard was created more than 20 years ago and, despite a number of vulnerabilities found since then, is still widely used (particularly in Moscow and St. Petersburg). In this article, we recall what vulnerabilities were found, and tell you how to fix them.
Source: Instagram @ pro.ticketing
Traditionally for such articles, we remind you that in Russia fake and ticket sales are prosecuted (Art. 327 and 165 of the Criminal Code of the Russian Federation), and urge readers to remain on the bright side of power.
The NIFP MIFARE Classics Standard is a whole family of cards. It includes MIFARE Classic 1K, 4K, EV1 1K, EV1 4K, MIFARE ID, MIFARE Mini. Also this standard can be emulated by other, newer NXP cards (MIFARE Plus, JCOP and others).
The card with a reader is based on the ISO 14443A standard, frequency 13.56 MHz.
MIFARE Classic 1K cards provide a memory area organized into sectors of 64 bytes. Each sector is divided into 4 blocks of 16 bytes:
For 4K cards, the first 2048 bytes are organized into 32 sectors of 64 bytes, and the rest into 8 sectors of 256 bytes (or 16 blocks). The last block of each sector is called the sector trailer, it contains the keys and parameters of access to the sector. Zero sector zero block is a special block that is locked for writing; it contains the identifier and information of the card manufacturer. In order for one card to have several different applications - for example, a social card with information about benefits, tickets for the metro and train - in the remaining blocks of the zero sector it is recorded how each sector is used - MIFARE Application Directory (MAD) .
Before accessing the sector for reading or writing, it is necessary to perform authorization using a 6-byte key. Authorization takes place according to a three-stage protocol, close to that described in chapter 5.2.2. ISO / IEC 9798-2: 1999. It uses the proprietary stream encryption algorithm CRYPTO1:
Further transfer of the contents of the sectors is carried out in an encrypted form. If you need to authorize to another sector (the so-called secondary authorization), then re-authorization is performed. The main difference is that the entire exchange is encrypted first with the old and then with the new key.
Cryptography cards are well researched. The vulnerability of the implementation of the pseudo-random number generator (PRNG) card and the vulnerability of the CRYPTO1 algorithm is found. In practice, these vulnerabilities are used in the following attacks:
All this in practice allows you to get access keys to all sectors of the map, having only the map, initialized with access keys. Then a replay attack on the contents of the card can be carried out or a clone of the card can be made on special blanks with a rewritable card identifier.
In addition, there is a vulnerability of access key infrastructure. Since cryptography on CRYPTO1 is implemented on the side of the card reader (CRYPTO1 is implemented only in hardware), it follows from this that the access keys:
And if in special equipment such as information terminals or turnstiles, you can use secure hardware key storage, in the case of an Android application, only the option of transferring keys and storage in the device’s memory remains. This makes it possible to intercept these keys by hacking the application or analyzing the application traffic. What was demonstrated in the article "The study of the security of the Troika card."
Diversification is the process of obtaining access keys on a master key using some unique input data for the card. The process of obtaining keys can be implemented in the application software that works with readers, or using the SAM-module.
For example, this might work like this:
As a result, each card receives its unique sector access keys. Even if the keys for some specific cards are compromised, it will not lead to the massive use of these keys. But we must understand that diversification is a half-measure and does not protect against hacking single cards and the possibility of modifying an Android application in order to intercept and use diversified keys.
To solve the CRYPTO1 vulnerability issues, the MIFARE Plus family of cards has been developed. The cards are similar in structure to MIFARE Classic, only the cryptography of cards has been updated. They can work in two modes:
These cards have eliminated the PRNG vulnerability and, therefore, in SL1 mode, these cards are still vulnerable to attacks on CRYPTO1, and in SL3 mode there are currently no known attacks.
Unlike SL1, in SL3 authorization and encryption can be implemented in software. Thanks to this, you can protect yourself from key interception through the Android client. To do this, the server must perform authentication and encryption. Then the keys do not leave the server, and the Android client simply proxies requests and responses from the card. This will require that the application be connected to the Internet, which can be inconvenient, so you can configure the card so that the sector is read with one key and write with another key. Then the user will be able to view information about the card while being offline, and can only replenish the balance or buy tickets for it online.
Do not forget that for AES keys you can make diversification by modifying the algorithm on the keys with a length of 16 bytes.
Existing transport cards based on MIFARE Plus SL1 cards can be transferred to SL3 mode in two stages:
Cryptography of the MIFARE DESFire card is similar to MIFARE Plus - before working with the application, a three-step authorization is performed using one of the algorithms to choose a card issuer: DES, 3DES, AES. Further exchange with the card is in encrypted form with optional imitations.
The card is functionally different from MIFARE Classic. Memory card is organized into a file system. There may be several applications on the map, each application may have several files.
Work with the card begins with the choice of the application by its identifier and authorization to it. Next comes the work with files - create, delete, read, write. Files can be of different types, for example, a flat area of memory, a purse balance, a cyclically rewritable file.
The main difficulty of the transition is that you need to upgrade software that works with maps. It is necessary to switch from the use of memory, divided into sectors, to applications and files, and, accordingly, to change the authorization order from sectors to authorization to the application and / or files. From a hardware point of view, the cards impose the same restrictions on the reader infrastructure as MIFARE Plus.
The advantage over MIFARE Plus is that, based on MIFARE DESFire, it is easier to implement multi-brand cards - different combinations of cards on one carrier: Troika-Arrow, Troika-Plantain, social cards with the ability to record tickets for transport). On MIFARE Plus, this is achieved through administrative allocation of sectors on the map for different applications. Here, each system can work with the application that it needs, and may not know that there are some other applications on the card. The second advantage is that additional file types allow you to implement some special scenarios - for example, replenish the wallet balance with one access key, and spend money from the balance with another access key or return the amount within the spent one.
Today, SIM card manufacturers (STM, Gemalto, G & D, Oberthur) have commercially available SIM cards and embedded security features with MIFARE DESFire emulation.
The Oyster Card (London Public Transport Transport Card) was transferred to MIFARE DESFire in 2009; since 2010, MIFARE Classic cards have not been used. The SUBE (Argentina) transport card is in the process of transition to MIFARE Plus SL3. In Dublin public transport, 3 types of cards: Luas (trams), Dublin Bus and DART (suburban rail) - were built on the basis of the MIFARE Classic and were replaced by one Leap card already on the basis of the MIFARE DESFire. Modern transport solutions are often initially built on protected media.
From a security point of view, these cards are similar to MIFARE Plus and DESFire cards — AES-based cryptography, three-step authorization, working with simulators, secure hardware storage ( Secure Access Module (SAM)) , a number of cards can emulate MIFARE Classic. They also work on the basis of the ISO / IEC 14443A standard.
ABI Research Q1 2017
The share of MIFARE cards in world transport in 2017 was 75% and, according to forecasts, by 2021 it will not fall below 70%.
The share of MIFARE in the world is reduced mainly due to the growth of Other cards, which, first of all, include bank cards (EMV) and card virtualization (switching to smartphones) to replace the function of the ticket carrier. Bank cards are better protected than transport cards - but you have to pay for it. Bank card servicing requires online, reading devices cost more due to banking certification requirements, the transport operator loses cash flow from replenishing its transport cards. All this creates a certain balance of power, thanks to which both standards (MIFARE and EMV) find and occupy their niches.
The volume of transport cards on standards other than NXP (Calypso, CIPURSE) is now less than 5%. Basically, these technologies are concentrated in countries where maps have historically developed - Japan and France - and so far do not go beyond them. This is understandable - the creation of a local ecosystem of production and support of maps is not always economically viable and must be supported by a sales market. It is possible that Russia will join a number of countries that have supported these standards. To do this, first of all you need a political solution.
The links below provide additional information about Mifare Classic:
We will be happy to answer questions in the comments to the article and instagram @ pro.ticketing . In January 2019, our company opened a number of vacancies for a new project in the transport area in Moscow, including the ability to attract teams of 3-4 people . The accelerator of start-ups in the field of new technologies on payment and validation of travel in public transport has been opened .
Source: Instagram @ pro.ticketing
Traditionally for such articles, we remind you that in Russia fake and ticket sales are prosecuted (Art. 327 and 165 of the Criminal Code of the Russian Federation), and urge readers to remain on the bright side of power.
MIFARE Classic structure
The NIFP MIFARE Classics Standard is a whole family of cards. It includes MIFARE Classic 1K, 4K, EV1 1K, EV1 4K, MIFARE ID, MIFARE Mini. Also this standard can be emulated by other, newer NXP cards (MIFARE Plus, JCOP and others).
The card with a reader is based on the ISO 14443A standard, frequency 13.56 MHz.
MIFARE Classic 1K cards provide a memory area organized into sectors of 64 bytes. Each sector is divided into 4 blocks of 16 bytes:
For 4K cards, the first 2048 bytes are organized into 32 sectors of 64 bytes, and the rest into 8 sectors of 256 bytes (or 16 blocks). The last block of each sector is called the sector trailer, it contains the keys and parameters of access to the sector. Zero sector zero block is a special block that is locked for writing; it contains the identifier and information of the card manufacturer. In order for one card to have several different applications - for example, a social card with information about benefits, tickets for the metro and train - in the remaining blocks of the zero sector it is recorded how each sector is used - MIFARE Application Directory (MAD) .
Before accessing the sector for reading or writing, it is necessary to perform authorization using a 6-byte key. Authorization takes place according to a three-stage protocol, close to that described in chapter 5.2.2. ISO / IEC 9798-2: 1999. It uses the proprietary stream encryption algorithm CRYPTO1:
- The reader sends an authorization request, indicating the sector number to which authorization occurs.
- The card reads the access key from the internal memory, generates a random sequence and returns it to the reader.
- The reader calculates the response using the sector access key and the CRYPTO1 encryption algorithm, then sends it with a newly generated random sequence.
- The card checks the response calculated by the reader. It then computes the answer to the read device call and returns it.
- The reader checks the response from the card.
Further transfer of the contents of the sectors is carried out in an encrypted form. If you need to authorize to another sector (the so-called secondary authorization), then re-authorization is performed. The main difference is that the entire exchange is encrypted first with the old and then with the new key.
MIFARE Classic Known Vulnerabilities
Cryptography cards are well researched. The vulnerability of the implementation of the pseudo-random number generator (PRNG) card and the vulnerability of the CRYPTO1 algorithm is found. In practice, these vulnerabilities are used in the following attacks:
- Dark side - the attack exploits the PRNG vulnerability. Works on MIFARE Classic cards of the generation up to EV1 (in EV1 the PRNG vulnerability has been eliminated). To attack you need only a map, you do not need to know the keys.
- Nested - the attack exploits the CRYPTO1 vulnerability. The attack is made on secondary authorizations, so for an attack you need to know one valid card key. In practice, for the zero sector, standard keys for the operation of the MAD are often used — they begin with it. Works for any cards on CRYPTO1 (MIFARE Classic and its emulation). The attack was demonstrated in the article “The vulnerability of the Plantain map: free trips in St. Petersburg ground transportation.”
- Attack listening exchange - the attack uses a vulnerability CRYPTO1. To attack, you need to overhear the primary authorization between the reader and the card. For this you need special equipment. Works for any cards on CRYPTO1 (MIFARE Classic and its emulation). The attack is demonstrated in the article "Hacking transport cards" Citycard "(Nizhny Novgorod)."
All this in practice allows you to get access keys to all sectors of the map, having only the map, initialized with access keys. Then a replay attack on the contents of the card can be carried out or a clone of the card can be made on special blanks with a rewritable card identifier.
In addition, there is a vulnerability of access key infrastructure. Since cryptography on CRYPTO1 is implemented on the side of the card reader (CRYPTO1 is implemented only in hardware), it follows from this that the access keys:
- either transferred to the reader before working with the card,
- either stored on the reader itself in secure hardware storage (for example, MIFARE SAM ),
- or stored in read-only memory.
And if in special equipment such as information terminals or turnstiles, you can use secure hardware key storage, in the case of an Android application, only the option of transferring keys and storage in the device’s memory remains. This makes it possible to intercept these keys by hacking the application or analyzing the application traffic. What was demonstrated in the article "The study of the security of the Troika card."
Methods of dealing with vulnerabilities MIFARE Classic
Key diversification
Diversification is the process of obtaining access keys on a master key using some unique input data for the card. The process of obtaining keys can be implemented in the application software that works with readers, or using the SAM-module.
For example, this might work like this:
- As input for diversification, the card identifier and sector number, the key to which we want to get, is used;
- This data is encrypted (in the SAM module or application software) by the master key, the result is truncated to 6 bytes and used as the access key to the corresponding sector.
As a result, each card receives its unique sector access keys. Even if the keys for some specific cards are compromised, it will not lead to the massive use of these keys. But we must understand that diversification is a half-measure and does not protect against hacking single cards and the possibility of modifying an Android application in order to intercept and use diversified keys.
Transition to MIFARE Plus and SL3 security level
To solve the CRYPTO1 vulnerability issues, the MIFARE Plus family of cards has been developed. The cards are similar in structure to MIFARE Classic, only the cryptography of cards has been updated. They can work in two modes:
- MIFARE Classic emulation mode (this mode of operation is called Security level 1 or SL1), which allows them to be used on the existing infrastructure of card reader devices and does not require modifications to the software that works with the cards;
- Security level 3 (SL3) mode, which requires authorization to the sectors and encryption of data exchange using the AES algorithm with the optional addition of imitations.
These cards have eliminated the PRNG vulnerability and, therefore, in SL1 mode, these cards are still vulnerable to attacks on CRYPTO1, and in SL3 mode there are currently no known attacks.
Unlike SL1, in SL3 authorization and encryption can be implemented in software. Thanks to this, you can protect yourself from key interception through the Android client. To do this, the server must perform authentication and encryption. Then the keys do not leave the server, and the Android client simply proxies requests and responses from the card. This will require that the application be connected to the Internet, which can be inconvenient, so you can configure the card so that the sector is read with one key and write with another key. Then the user will be able to view information about the card while being offline, and can only replenish the balance or buy tickets for it online.
Do not forget that for AES keys you can make diversification by modifying the algorithm on the keys with a length of 16 bytes.
Existing transport cards based on MIFARE Plus SL1 cards can be transferred to SL3 mode in two stages:
- The infrastructure of devices that work with cards (turnstiles, ticket booths, vending machines, terminals) is being prepared for use with MIFARE Plus. The software of reading devices in the work with maps is being finalized.
- Already issued transport cards based on MIFARE Plus are transferred to SL3 mode - this can occur during normal use of a card, for example, passing through a turnstile or attaching a card to an information terminal. The process of transferring the card is invisible to the passenger and takes about 100 ms.
Transition to MIFARE DESFire
Cryptography of the MIFARE DESFire card is similar to MIFARE Plus - before working with the application, a three-step authorization is performed using one of the algorithms to choose a card issuer: DES, 3DES, AES. Further exchange with the card is in encrypted form with optional imitations.
The card is functionally different from MIFARE Classic. Memory card is organized into a file system. There may be several applications on the map, each application may have several files.
Work with the card begins with the choice of the application by its identifier and authorization to it. Next comes the work with files - create, delete, read, write. Files can be of different types, for example, a flat area of memory, a purse balance, a cyclically rewritable file.
The main difficulty of the transition is that you need to upgrade software that works with maps. It is necessary to switch from the use of memory, divided into sectors, to applications and files, and, accordingly, to change the authorization order from sectors to authorization to the application and / or files. From a hardware point of view, the cards impose the same restrictions on the reader infrastructure as MIFARE Plus.
The advantage over MIFARE Plus is that, based on MIFARE DESFire, it is easier to implement multi-brand cards - different combinations of cards on one carrier: Troika-Arrow, Troika-Plantain, social cards with the ability to record tickets for transport). On MIFARE Plus, this is achieved through administrative allocation of sectors on the map for different applications. Here, each system can work with the application that it needs, and may not know that there are some other applications on the card. The second advantage is that additional file types allow you to implement some special scenarios - for example, replenish the wallet balance with one access key, and spend money from the balance with another access key or return the amount within the spent one.
Today, SIM card manufacturers (STM, Gemalto, G & D, Oberthur) have commercially available SIM cards and embedded security features with MIFARE DESFire emulation.
The Oyster Card (London Public Transport Transport Card) was transferred to MIFARE DESFire in 2009; since 2010, MIFARE Classic cards have not been used. The SUBE (Argentina) transport card is in the process of transition to MIFARE Plus SL3. In Dublin public transport, 3 types of cards: Luas (trams), Dublin Bus and DART (suburban rail) - were built on the basis of the MIFARE Classic and were replaced by one Leap card already on the basis of the MIFARE DESFire. Modern transport solutions are often initially built on protected media.
Transition to other transport cards (CALYPSO, CIPURSE, FeliCa)
From a security point of view, these cards are similar to MIFARE Plus and DESFire cards — AES-based cryptography, three-step authorization, working with simulators, secure hardware storage ( Secure Access Module (SAM)) , a number of cards can emulate MIFARE Classic. They also work on the basis of the ISO / IEC 14443A standard.
MIFARE - champion
ABI Research Q1 2017
The share of MIFARE cards in world transport in 2017 was 75% and, according to forecasts, by 2021 it will not fall below 70%.
The share of MIFARE in the world is reduced mainly due to the growth of Other cards, which, first of all, include bank cards (EMV) and card virtualization (switching to smartphones) to replace the function of the ticket carrier. Bank cards are better protected than transport cards - but you have to pay for it. Bank card servicing requires online, reading devices cost more due to banking certification requirements, the transport operator loses cash flow from replenishing its transport cards. All this creates a certain balance of power, thanks to which both standards (MIFARE and EMV) find and occupy their niches.
The volume of transport cards on standards other than NXP (Calypso, CIPURSE) is now less than 5%. Basically, these technologies are concentrated in countries where maps have historically developed - Japan and France - and so far do not go beyond them. This is understandable - the creation of a local ecosystem of production and support of maps is not always economically viable and must be supported by a sales market. It is possible that Russia will join a number of countries that have supported these standards. To do this, first of all you need a political solution.
The links below provide additional information about Mifare Classic:
- MIFARE Classic EV1 1K short data sheet
- MIFARE Plus EV1 short data sheet
- Implementing an RFID 'Mifare Classic' Attack
- Ciphertext-only Cryptanalysis on Hardened Mifare Classic
- Symmetric key diversifications
Conclusion
We will be happy to answer questions in the comments to the article and instagram @ pro.ticketing . In January 2019, our company opened a number of vacancies for a new project in the transport area in Moscow, including the ability to attract teams of 3-4 people . The accelerator of start-ups in the field of new technologies on payment and validation of travel in public transport has been opened .