Court rules Oyster hack can be revealed

chris

A Dutch judge has ruled that researchers can publish details of how to crack the oyster card used on London’s public transport system.

NXP, which makes the oyster card, had taken out an injunction to stop Professor Bart Jacobs and colleagues from Radboud University in Nijmegen from publishing their research into the security flaws in the Oyster card.

The university welcomed the ruling, saying "...in a democratic society it is of great importance that the results of scientific research can be published".

NXP is arguing that it will take months before it finds out a way to fix the flaw that allows the cards to be cloned. It has reportedly said that publishing the detailed research will serve no useful purpose.

A spokesman for Transport For London told the BBC: "Transport for London remains confident in the security of the Oyster card system. We take fraud and the security of personal data extremely seriously and constantly review our security procedures."

"Any fraudulent card would be identified within 24 hours of being used and blocked. Using a fraudulent card for free travel is subject to prosecution and we would seek to enforce this wherever possible."

The researchers studied the card ahead of its proposed implementation in the Netherlands. They found that it was possible to clone the cards, add credit to them and even jam up entry gates, although it is unlikely that cloned cards cause last week’s problems on the Underground.

The Dutch government has now halted the deployment of the cards after the researchers showed that they could be used to gain unauthorised access to government buildings.


Source: vnunet

__________________