Clone my Oyster!!!!

Its not the reverse engineering that's the issue here.... its the revealing of information how to bypass the system (clone/copy cards) and therefore enabling them commit criminal activity.

Just because there's a weakness (show me a computer programme/application or system that doesn't have a weakness be that IE, Firefox or any other), doesn't mean that LU are responsible or should suffer the consequences - if the report is accurate (an important question in itself) by sharing the information with the world, you are consequently giving it to those who will want and be motivated to use it to commit criminal activity (fraud).

Why not share that information with the customers of the system (LU/TfL) so that they can exert pressure on the manufacturers to deal with the issue - surely that's the right way to go

I've got a mate that works in Sheffield - his oyster and office access cards are interchangeable for opening his office door!

Sorry Chris I don't agree. Full Disclosure, as long as it is done responsibly, improves the security of systems - not reduces it. From what I can see from the article Professor Jacobs was responsible, and has been trying to work with the Dutch Government and NXP to make the system secure - but NXP decided launching legal action to cover up the flaw was the best way forward.

If the Oyster infrastructure has been implemented correctly then this will have little to no impact on TfL. Why? Because the system should know what validity and prepay topups should be on each card, and once a discrepancy is spotted the card should be hotlisted. Depending on how quickly the processing is done, it could happen between you touching in and touching out. The worst scanario I can see is someone using the card only with offline readers (bus ticket machines, handheld scanners on DLR and NR etc.) then the card getting hotlisted overnight once the units get docked and download their transaction logs. The TfL spokesperson is confident a dodgy card will be spotted in 24 hours, which pretty much backs up what I'm saying.

All the cards have a unique serial number permanently burnt into them at manufacture, the only way this fraud could be worthwhile was if this unique serial could be changed, which would negate the card getting hotlisted. Otherwise it is a lot of effort to get upto 24 hours free travel on buses and other ungated parts of the DLR, Tube and Rail network. I reckon when they talk about copying cards in the article, they didn't actually fully copy the card. They were just able to copy the 'entitlement' from one card to another. We will have to wait for the report to be published to get the full story though.

You'll have to take my word that I work on some very high profile internet projects. And I would rather know of any security flaw in our systems so that I can work on fixing it rather than having an open, unknown flaw that could be exploited without my knowledge.

bowchurch

I've heard via the media that LU/TfL could track and stop a card fairly quickly via tracking movement/transactions etc. etc. Good - perhaps TfL aren't as idiotic and stupid and the press hope they are!

Yes I agree that NXP seem to have over-reacted (assuming more didn't happen behind the scenes that we are not aware of/hasn't been reported), but if they have been made aware of the flaw and are probably investigating a solution, the only motivation I can see for releasing information to the general public is to force NXP to resolve the defect quicker - please correct me if you disagree.

IMO knowingly releasing the information to the world at large in an effort to try to force NXP's hand, you are doing so in the expectation that they will be worried about fraudulent activity/loss of money etc. Following that train of thought through, the person releasing the information expects criminals to take advantage of their research and as a result aren't they therefore an accomplice by association (they are the source of the leak,without which no fraud or attempt to defraud would take place).

Its an opinion - that's all

Chris it might be helpful to read this interview with the researchers.

The researchers want to engage with system integrators worldwide to help them assess the vulnerabilities in their systems, as they have already done with the Government and transport operators in Holland. I've not seen any evidence that they have, or want to disclose the full set of algorithms they have obtained when they publish their report.

Don't be under any illusion that the research not being published makes MiFare more secure, it doesn't. The Dutch team are not the only people who have been investigating MiFare security, and the fact that they have announced a successful hack will be sufficient for others on both sides of the legal fence to try and emulate their work. So IMHO NXP were going to court to try and protect their reputation and sales of the product not the security of their customers.

It ceratinly disabled mine! Mayhap because I'm a priv Oyster, but I'm not utterly sure of this.

When I suspect someone is trying to do that with me, I pause suddenly after I get past the gates and trap the other person behind them as they slam shut.