Oyster cards cloned

[yorkie]

A group of scientists from Radbound University in the Netherlands has discovered that Oyster cards can be cloned by connecting a Mifare card reader to a computer.

After successfully cloning the card, they travelled around the London uynderground using the cloned card in order to demonstrate their points.

Oyster uses a basic version of the Mifare system, 'Mifare Classic'. Secure versions of Mifare are available, but TfL chose an unsecured version in order to reduce costs. ATOC have refused to embrase Oyster due to the lack of ITSO compliance which includes the lack of security. ITSO is the standard for smartcards specified by the DfT which TfL chose to ignore.

The unsecure nature of the system has been known by industry insiders since it's inception, but only recently has it been publicly announced.

Oyster cards hold the data themselves, rather than reading from a central database. This means that it is possible to clone cards. Some IT experts even claim they could easily 'top up' legitimate cards.

TfL responded by announcing that they can detect fraudulent use and that the most anyone could get is a single day's travel, however many in the industry are sceptical about this claim. A TfL spokesman warned "Using a fraudulent card for free travel is subject to prosecution." Whether TfL bosses will face any disciplinary action for not complying with Government standards remains to be seen.

Some links for information about the flaw:-

http://www.itpro.co.uk/603912/oyster-cards-at-risk-from-cloning

http://www.theregister.co.uk/2008/06/23/dutch_clone_oyster_card/

http://www.ru.nl/english/general/radboud_university/vm/security_flaw_in/ (Video)

 

[paul1609]

They must hold top up records elsewhere than on the card. My original oyster became wiped and wouldnt work at all. When i took it to London Bridge Station they looked up my credit on a computer screen and issued a new card with £13.65 on it.

 

[yorkie]

Yes, that is correct.

But Oyster is asyncronous, meaning that it does not have to have a live connection to work. Every so often the amount on the card is read and updated in the system.

Jordy, Max, David and myself were on a HST from London to Leeds and between Sheffield and Wakefield a football fan boarded who said he worked in IT and he said Oyster was not secure. We were told that it is possible to add any amount to your card using a Mifare reader, then when you use it the system would read that amount on the card and update the database as it assumes you have topped up legitimately.

The IT worker told us he had successfully topped up an Oyster card but had not used it. I cannot say how true his claims are, but it does seem to be consistent with what the Dutch researchers found.

 

[Andrew Tiffin]

That is really wierd.

 

[Max]

That is really wierd.

Not particularly - just demonstrates how ill thought out the whole Oyster sytem is.

 

[D306]

just the same as credit card cloning really

 

[yorkie]

just the same as credit card cloning really

No it isn't.:???:

 

[D306]

it is in a way, if you think about it

 

[metrocammel]

it is in a way, if you think about it

Not at all really, Credit Cards aren't smartcards for a start :P

 

[Jordy]

Jordy, Max, David and myself were on a HST from London to Leeds and between Sheffield and Wakefield a football fan boarded who said he worked in IT and he said Oyster was not secure. We were told that it is possible to add any amount to your card using a Mifare reader, then when you use it the system would read that amount on the card and update the database as it assumes you have topped up legitimately.

I wasn't there, probably got off at Sheffield if I was even there that day!

 

[Donny Dave]

You were there, although I think you were leaning out of a window.

it was very revealing, and makes me glad I don't have an oyster card.

Another note, it's note even similar to credit card cloning, as they use totally different systems. That's why you can get a call from your credit card provider almost instantly when they think there is a dubious transaction going through.

With Oyster, there is no way to tell who is using the card, that's why it's not blocked at all.

 

[5872]

My Oyster Card can't be cloned, it has my face on it

 

[RJ]

The data can, so someone else can benefit from your free travel and discount travel prices.

 

[yorkie]

My Oyster Card can't be cloned, it has my face on it

you are joking, right?

 

[RJ]

you are joking, right?

I don't think he's heard of a printer or photocopier before.

 

[Jordy]

You were there, although I think you were leaning out of a window.

I haven't been on a MML HST beyond Doncaster so I probably wasnt!

 

[Coxster]

To further back-up and fuel Yorkie's anti-Oyster attitude, the whole Oyster system went down at around 08:30. The barriers were opened up and everyone could access the tube network, regardless of how much money was on their card. Many people who went through the barriers after touching in on the defective Oyster readers found that it currupted their cards. It was later confirmed that it was also affecting the buses. By 09:40 the tube system was back up and running but the problem was still ongoing on the buses. I was at the Waterloo bus stops enroute to work at about 13:25 when a 172 pulled up, with a handwritten note from the driver stuck on the reader that read simply 'Not working!'. Right behind was another 172 so I thought that maybe the ticket machine wasn't working so upon arrival at St Paul's, the second bus would take over so the faulty bus could go back to the garage. Seemed reasonable enough.

Then my 4 pulled up and that too had a handwritten note on the reader that said 'No card or cash fares', as if a driver's reader is broken they cannot force you to pay for a £2 single. After taking in excess of fifteen minutes to cross Waterloo Bridge (only the bus lane was open for ALL traffic, which meant VERY slow traffic as buses at bus stops blocked the entire road, and the lights at Lancaster Place give priority to the Strand) we got further delayed by a cyclist who rode into the side of the bus, making a dent in the Metroline logo. Another thing I thought odd at the time was a bus on Fleet Street that had a bit of a queue for it (a 23 to Ladbroke Grove IIRC) and rather than sitting staring forward waiting for pax to touch in, he was looking at the passengers and rushing them all on by doing that 'come here' hand movement.

Anyway, I'm rambling now. The point in this story is that the Oyster system totally went down and six hour later the buses were still unable to take any fares whatsover, be it cash or Oyster.

 

[RJ]

I went on a few buses today, none of the reader were working. One had a note saying "Not working, free travel today!" Charmed, but travel is already free for me 8)

 

[Daniel]

I'm quite surprised no-one mentioned this...

RJ, everyone in London had free trouble today. Was speaking to a friend who is a bus driver, apparently the oyster system wasn't working, all passengers being passed, those wishing to pay cash were being allowed on.

However, the last couple of busses I got, (within around an hour) seemed to have the system working.

 

[91101]

I was one one bus this morning that the first driver refused to take any payments, oyster or cash, hurrying people on saying that TFL had made too much profit and were giving people a free day, he was releived half way through by another driver who was taking payments, both cash and oyster and all was working fine, and this was at 10:30ish.

I was in Central London all day, hoping between Kings Cross and my office in Old Street several times, and having no bother.

 

[33056]

The system must have gone down more or less from the start of service this morning. Watched a bloke vainly trying to swipe his card on a reader at Harrow & Wealdstone about ten past six this morning until one of the staff shouted across that it wasn't working.

 

[RJ]

I got on a bus at 0615 today, my card was fine but a number of people's were busted with a "Oystercard stopped" message showing - more free travel then.

 

[saeybia]

Oyster cards can be cloned in a way, basicly if you was to clone a card you could use it, however if you updated the cloned card or the original card, with say, money travel card, used it etc the system would see it and get confused and place a block automaticly on both cards So yes they can be cloned, but would only work for a day or 2

 

[A60K]

Why resurrect such an old thread?

 

[me123]

I have no idea :roll: