Search /
Advanced search  |  Help  |  Site map
Click for Layer 8! No, really, click NOW!
Networking for Small Business
FCC defends new net neutrality proposal
New iPad rumor rollup for week ending April 23
Dell adds Big Switch to its SDN mix
Google Plus now minus chief Vic Gundotra
Heartbleed prompts joint vendor effort to boost OpenSSL, security
Microsoft Surface Mini seems likely to ship soon
China working on Linux replacement for Windows XP
FCC adds $9 billion to broadband subsidy fund
Raspberry Pi alternatives emerge to fill need for speed
It's now possible to wirelessly charge 40 smartphones from 16 feet away
Ex-FCC commissioner to head CTIA in latest Washington shuffle
Go time traveling with Google Maps
While Heartbleed distracts, hackers hit US universities
Survey respondents shun much-hyped mobile shopping technologies
7 Ways to Advance Your Project Management Career
How Apple's billion dollar sapphire bet will pay off
US to vote on sharp increase in broadband subsidies
iPhone 6 rumor rollup for the week ending April 18
NSA spying revelations have tired out China's Huawei
Arista co-founder may have switch maker by its jewels
Open source pitfalls – and how to avoid them
AT&T's expanded 1 Gbps fiber rollout could go head to head with Google
Verizon: Web apps are the security punching bag of the Internet

Upgrade to smart card security needed

Today's breaking news
Send to a friendFeedback

Researchers at the University of Cambridge in England have invalidated the security systems in many smart card systems by developing a way of attacking and causing faults in cards using common tools such as a photographer's flash gun and a microscope.

Ross Anderson of Cambridge University's Computer Laboratory Monday described the discovery, by doctoral candidate Sergei Skorobogatov, at the IEEE Symposium on Security and Privacy in Oakland, Calif.

This method is much simpler and more effective than the techniques used in the past, the researchers said in a statement. While many security processors can stop the more basic attacks, they will now have to be upgraded, it said.

Simply shielding the processor by adding, for example, a top metal layer to the chip is no longer enough, because silicon becomes transparent to the light in an infrared flash and the chip can therefore be attacked from the rear. Electromagnetic pulses and X-rays could also be used, the researchers said in their statement.

The attack technique was kept under wraps for a year until defensive technologies could be developed. A new silicon technology has now been discovered that can block this and many of the previously known attacks, they said.

Cambridge Laboratory's team has to look at both sides of the smart card security battle, said Simon Moore, another of the team's researchers, on Tuesday. "(We try) to design better smart cards using better techniques and circuit designs, but we also look at how to break them. It's like being a good locksmith - you have to know how to pick locks," he said.

Cambridge Laboratory has been working with the European smart card industry to improve security, Moore said.

The idea for the new attacks came from reading reports about work on older chips and wondering how sensitive the new opaque plastic packaging used on most current smart cards would be, he said.

"We want the public to be wary of these technologies because while they have appropriate uses, such as for [Subscriber Identity Module] cards, (there is talk of using them) as national identity cards. That's of great concern because there is then the potential to clone these cards and create fake ones. A fake SIM card may not cause a great personal cost to the person who loses it, but a fake passport could almost ruin their life."

The IDG News Service is a Network World affiliate.


Error 404--Not Found

Error 404--Not Found

From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:

10.4.5 404 Not Found

The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent.

If the server does not wish to make this information available to the client, the status code 403 (Forbidden) can be used instead. The 410 (Gone) status code SHOULD be used if the server knows, through some internally configurable mechanism, that an old resource is permanently unavailable and has no forwarding address.

NWFusion offers more than 40 FREE technology-specific email newsletters in key network technology areas such as NSM, VPNs, Convergence, Security and more.
Click here to sign up!
New Event - WANs: Optimizing Your Network Now.
Hear from the experts about the innovations that are already starting to shake up the WAN world. Free Network World Technology Tour and Expo in Dallas, San Francisco, Washington DC, and New York.
Attend FREE
Your FREE Network World subscription will also include breaking news and information on wireless, storage, infrastructure, carriers and SPs, enterprise applications, videoconferencing, plus product reviews, technology insiders, management surveys and technology updates - GET IT NOW.