Forum for Science, Industry and Business

Sponsored by:     3M 
Search our Site:

 

RFID chips in car keys and gas pump pay tags carry security risks

01.02.2005


Thieves could exploit encryption vulnerabilities, computer scientists warn



A popular radio-frequency ID system that is used to deter car thefts and as a convenience device for the purchase of gasoline can be defeated with low-cost technology, computer scientists from The Johns Hopkins University and RSA Laboratories have determined.
Their findings, described in a new research paper, indicate that the encryption in RFID microchips in some newer car keys and wireless payment tags may not keep thieves at bay. Using a relatively inexpensive electronic device, criminals could wirelessly probe a car key tag or payment tag in close proximity, and then use the information obtained from the probe to crack the secret cryptographic key on the tag, the scientists said. By obtaining this key, lawbreakers could more easily circumvent the auto theft prevention system in that person’s car or potentially charge their own gasoline purchases to the tag owner’s account.

The researchers uncovered the vulnerability while studying the Texas Instruments Registration and Identification System, a low-power radio-frequency security system used worldwide. The researchers said that more than 150 million of these transponders are embedded in keys for newer vehicles built by at least three leading manufacturers. The transponders are also inside more than 6 million key chain tags used for wireless gasoline purchases. The computer security researchers discovered a way that tech-savvy thieves can get around the encryption safeguards in these systems.



The research paper has been posted online at: http://rfid-analysis.org/

"We’ve found that the security measures built into these devices are inadequate," said Avi Rubin, technical director of the Johns Hopkins Information Security Institute and an author of the study. "Millions of tags that are currently in use by consumers have an encryption function that can be cracked without requiring direct contact. An attacker who cracks the secret key in an RFID tag can then bypass security measures and fool tag readers in cars or at gas stations."

"In cars as in commerce, RFID is becoming a lynchpin for security in day-to-day life," said Ari Juels, principal research scientist of RSA Laboratories. "It is important that RFID devices offer a level of security commensurate with the value of the assets they protect. Our aim is to help the industry achieve this standard."

The radio-frequency ID system studied by the research team was designed to thwart car thieves, provide fast and convenient contactless payments and safeguard wireless transactions. In vehicles, it uses a passive, unpowered transponder chip embedded in the key and a reader inside the car, connected to the fuel injection system. If the reader does not recognize the transponder, the car will not start, even if the physical key inserted in the ignition is the correct one. This innovation has greatly reduced auto theft. In the gasoline purchase system studied by the researchers, a reader inside the gas pump must recognize a small key-chain tag that is waved in front of it. Upon system approval, the transaction is then charged to the tag owner’s credit card.

Security verification takes place through a procedure called a challenge/response protocol. When the key or tag is nearby, the reader transmits a random string of ones and zeroes to it. The transponder in the key or tag then processes these numbers in a specific way and sends a numeric message back to the reader for authentication.

The researchers from Johns Hopkins and RSA Laboratories were able to unravel the mathematical process used in this verification. They then purchased a commercial microchip costing less than $200 and programmed it to find the secret key for a gasoline purchase tag owned by one of the researchers. By linking 16 such chips together, the group cracked the secret key in about 15 minutes. (In this system, an owner’s credit card information is not carried on the chip and is not revealed by breaking the pass’s security. In addition, this system possesses other security safeguards designed to protect customers from repeated fraudulent purchases made with a contactless device. The company that markets this system has said it has no knowledge that any fraudulent purchases have ever been made with a cloned version of its device.)

The researchers had similar success with a chip-equipped car key. With the secret key in hand, the team was able to simulate the RFID tag and disarm the car’s anti-theft system without the built-in tag present. (Keyless remote control systems to lock and unlock car doors do not use RFID chips).

The researchers alerted Texas Instruments, manufacturer of the radio frequency systems, about the security vulnerabilities they had detected and demonstrated them to Texas Instruments in the lab. The Johns Hopkins-RSA team recommended a program of distributing free metallic sheaths to cover its radio frequency devices when they are not being used. This could make it more difficult for thieves to electronically steal the secret keys in the tags when they were not in use.

The Texas Instruments system is only one of a number of RFID systems on the market. The Johns Hopkins-RSA team has also been examining another system, not produced by Texas Instruments, that uses an active, battery-powered transponder chip. The team expects to prepare a paper soon on that work.

Phil Sneiderman | EurekAlert!
Further information:
http://rfid-analysis.org
http://jhu.edu
http://www.jhuisi.jhu.edu

More articles from Power and Electrical Engineering:

nachricht Researchers take next step toward fusion energy
16.11.2017 | Texas A&M University

nachricht Desert solar to fuel centuries of air travel
16.11.2017 | SolarPACES

All articles from Power and Electrical Engineering >>>

The most recent press releases about innovation >>>

Die letzten 5 Focus-News des innovations-reports im Überblick:

Im Focus: A “cosmic snake” reveals the structure of remote galaxies

The formation of stars in distant galaxies is still largely unexplored. For the first time, astron-omers at the University of Geneva have now been able to closely observe a star system six billion light-years away. In doing so, they are confirming earlier simulations made by the University of Zurich. One special effect is made possible by the multiple reflections of images that run through the cosmos like a snake.

Today, astronomers have a pretty accurate idea of how stars were formed in the recent cosmic past. But do these laws also apply to older galaxies? For around a...

Im Focus: Visual intelligence is not the same as IQ

Just because someone is smart and well-motivated doesn't mean he or she can learn the visual skills needed to excel at tasks like matching fingerprints, interpreting medical X-rays, keeping track of aircraft on radar displays or forensic face matching.

That is the implication of a new study which shows for the first time that there is a broad range of differences in people's visual ability and that these...

Im Focus: Novel Nano-CT device creates high-resolution 3D-X-rays of tiny velvet worm legs

Computer Tomography (CT) is a standard procedure in hospitals, but so far, the technology has not been suitable for imaging extremely small objects. In PNAS, a team from the Technical University of Munich (TUM) describes a Nano-CT device that creates three-dimensional x-ray images at resolutions up to 100 nanometers. The first test application: Together with colleagues from the University of Kassel and Helmholtz-Zentrum Geesthacht the researchers analyzed the locomotory system of a velvet worm.

During a CT analysis, the object under investigation is x-rayed and a detector measures the respective amount of radiation absorbed from various angles....

Im Focus: Researchers Develop Data Bus for Quantum Computer

The quantum world is fragile; error correction codes are needed to protect the information stored in a quantum object from the deteriorating effects of noise. Quantum physicists in Innsbruck have developed a protocol to pass quantum information between differently encoded building blocks of a future quantum computer, such as processors and memories. Scientists may use this protocol in the future to build a data bus for quantum computers. The researchers have published their work in the journal Nature Communications.

Future quantum computers will be able to solve problems where conventional computers fail today. We are still far away from any large-scale implementation,...

Im Focus: Wrinkles give heat a jolt in pillared graphene

Rice University researchers test 3-D carbon nanostructures' thermal transport abilities

Pillared graphene would transfer heat better if the theoretical material had a few asymmetric junctions that caused wrinkles, according to Rice University...

All Focus news of the innovation-report >>>

Anzeige

Anzeige

Event News

Ecology Across Borders: International conference brings together 1,500 ecologists

15.11.2017 | Event News

Road into laboratory: Users discuss biaxial fatigue-testing for car and truck wheel

15.11.2017 | Event News

#Berlin5GWeek: The right network for Industry 4.0

30.10.2017 | Event News

 
Latest News

NASA detects solar flare pulses at Sun and Earth

17.11.2017 | Physics and Astronomy

NIST scientists discover how to switch liver cancer cell growth from 2-D to 3-D structures

17.11.2017 | Health and Medicine

The importance of biodiversity in forests could increase due to climate change

17.11.2017 | Studies and Analyses

VideoLinks
B2B-VideoLinks
More VideoLinks >>>