Be Excellent To Each Other

It's hard to find the original stuff, as the new news has eclipsed the old news when googling.

This is a basically what I saw though:


http://www.engadget.com/2008/03/14/oyster-cards-vulnerable-to-rfid-hack-lots-of-other-systems-too/

From March.

I don't know the ins and outs of it all, because the thesis means I can't spend all hours of the day reading up on some geeky topic. For the next 42 days at least. Then I'll be all over it.

OK, looks like they do have the secret key there (you can see them replacing the default one in the PC app).

If, as they claim, they got that by talking to the card reader on the door, then they must also have a working copy of the algorithm on the PC, and probably brute-force decrypted to get the key (I think that's what the laptop was doing at the start?).

The actual card cloning part is then straight forward, no hackery needed.

So, if you're determined you can do that, but if it was a building that was supposed to be properly secure then they wouldn't be relying on a single, weak method of verification anyway.

It's pretty much all my University uses. But then they are idiots and whenever there is a power cut they have to hire a guards to cover each door!

I've haven't really read about it, so I'm not sure what the new problem is thats greater than this one from back in march.

I think it was that they showed you how to get the algo out of the card, or actually physically published it (which would be a bit naughty tbh). Haven't actually seen the article myself either though.

Ah that makes sense.

But I suppose if they have got it and they didn't publish, then the oyster card is only secure through (minimal) obscurity, so it's just as fucked pretty much.

Cheers!