UPDATE: Hacker trio finds a way to crack popular smartcard in minutes

People are starting to wake up to the fact that some RFID-enabled smartcards now can be far more easily, and cheaply, cracked than ever before, as a trio of young computer experts recently showed.

These are a particular type of processor-embedded cards, and are different from credit cards. The actual decryption work by the researchers was done on the widely deployed Mifare Classic wireless smartcard, now manufactured by a Philips spinoff, NXP Semiconductors. It’s deployed for contactless payments, such as the nationwide public transit ticketing system in The Netherlands. If decrypted, the card could be rewritten to access additional services, certain limited personal data such as a birth date could be recovered, and the dollar value of the card’s electronic “purse” could be changed.

A recently de-classified study, by a nonprofit Dutch research group, of the claims by the decryption researchers concluded that it is likely they will succeed in recovering the entire encryption algorithm, and eventually build a key cracker. But that will take about six months, the study estimates, and concludes that there are no immediate risks to the Dutch system or its users, and that additional, existing security mechanisms may offer adequate protection.

The earlier version of this story said that the card can be used in debit/credit transactions with the user’s bank account. This is false. The earlier version also said a user’s bank data is exposed in this decryption. But according to NXP and the research group’s assessment, banking transactions and data are unaffected.

That MiFare Classic card is the basis of such new systems as the Dutch OV-Chipkaart, being rolled out in The Netherlands as part of a multibillion-dollar nationwide transportation ticketing system, and the so-called CharlieCard, used in the Boston, Mass., subway system. The decryption breach triggered a firestorm of controversy in The Netherlands. 

The card uses a proprietary encryption scheme, known as the Crypto1 algorithm, to scramble the data exchanged between the card and the card reader, and to securely authenticate the card and reader to each other.