Perth’s new Smartrider cracked

Perth is now among the worlds cities whose public transport payment system (“Smartrider”) has been cracked by security researchers.

The smartcard used in Perth contains a ‘Mifare’ chip supplied under a 2003 $30 Million contract with Wayfarer, that uses a weakened implementation of encryption standard ISO 9798-2 (which itself is several years old – 1999).

The weakness in random number generation used in the chip means the security implementation, that it was initially estimated would take some 44,600 years of computation to crack, can in fact be undone in around 1 hour. Current estimates are that common attacks will be possible on a massive scale within about 18 months.

And the advice from Mifare’s manufacturers?:

The security of a system must not be restricted to the individual components. It is also essential to ensure that the individual components are used in the right way to prevent some attacks on the system.

So basically they know, they can’t do anything about it, and it is down to the customers/users to mitigate the weakness (although how you use a ticketing machine the ‘right way’ remains to be seen).

The investigation into this weakness not only allowed researchers to ride public transport in London for free, but also allowed them to gain entry into buildings that use the same chips in building access systems. 

In terms of future threats we can expect similar scams that currently plague credit card use – the ability to simply brush up against the card, clone it, and then use this information to either sell the valid account details online, or create multiple clone cards that can be resold and used in the original owners name. This is worrisome, considering that many Transperth users have an automatic direct-debit from a bank account to get the maximum 25% fare discount – so could 100 cloned copies of your Smartrider suck 100 direct debit updates from your bank once their credit was exhausted?

Any evolution in the sensitivity of aerials that could read the chips from more than the current few centimetres away would also represent a nightmare scenario – a thief able to remotely clone 1000’s of travellers cards at a single station in a single day would create a denial of service attack on the transport system that would cause chaos.

The purpose of telling you this is really to increase vigilance and healthy cynicism – considering that also in recent news UK passports have been successfully cloned, and 3000 blank ones were stolen before they could be issued (Australian passports are also smart-chip based).

The hype is that these systems are smarter and safer, but as we invest so much more faith in them these small flaws can be exploited to exact much more damage that was previously possible. The real elixir of security is to have smart people making smart choices – but this is what automated systems take us farther from, instead making us unthinking automatons incapable of realising that something has gone wrong until days or even weeks later – by which time we are often financially poorer for it.

The other thing that is essentially wrong about these systems is that we are trading-in previously trusted tokens (currency issued by the government to pay for tickets) for a privatised least-effort-to-get-paid alternative where the implications of counterfeit fraud is exponentially greater.   

Take a look at the Mifare response, details of the Transperth contract in 2003,  The Times’ article on passport cloning, and the Times article on the orignal Mifare vulnerability, with a simple demonstration of the attack. Also you can see the technical details of the research into the security weakness of the system here: http://www.cs.ru.nl/~flaviog/publications/Attack.MIFARE.pdf.

Technology? Please!

For all I keep hearing about the processing of bespoke applications at work – for whatever department and procedure, I keep thinking that what we are seeking is not that complicated.

Last week I was 4 pages from end of an excellent book called “Influence”by Robert Cialdini, Ph.D., when I came across the ultimate definition of what we want. Cialdini quoted Citicorp chairman Walter Wriston who said:

‘We have tied together a data base…that is capable of telling almost anyone… almost anything, immediately.”

That’s it – Eureka! People just want to find out what is relevant to themselves, and to receive the answer instantly.

This is because the data I look after at work is mirroring the explosion of data in the real world – it has become just too much for one person to know everything about, and so we need to use shortcuts and cues (report cards/dashboards/indicators) to decide if we are ‘on track’ or not.

Cialdini summarises the problem:

“John Stuart Mill, the British economist, political thinker, and philosopher of science, died more than a hundred years ago. The year of his death (1873) is important because he is reputed to have been the last man to know everything there was to know in the world.

Today, the notion that one of us could be aware of all known facts is only laughable. After eons of slow accumulation, human knowledge has snowballed into an era of momentum-fed, multiplicative, monstrous expansion. We now live in a world where most of the information is less than fifteen years old. In certain fields of science… knowledge is said to double every eight years.”

The bottom line is that we can only expect this phenomena to be more problematic in the future – as there are more overlays of information applied to our work (maps, genealogy, cultural information), we need to be adept at sorting and displaying the information in summary form so we can start to make sense of it.

To do this we are in dire need of technological, automated assistance. We are reaching the outer limits of human performance and understanding, and we have a couple of ways we can go – either utilise the ‘wisdom of crowds’ through group membership and associations, or use technology instead to do the work of many human counterparts.

In short this is what web 2.0, RIM, or any new technology needs to be about – just store it, sort it, display it.

We need all the help we can get.