Hardware Security Vulnerability Unearthed in RFID Cards Utilized in Hotels and Offices Globally
A critical vulnerability has been found in a specific type of MIFARE Classic contactless cards that may permit unauthorized access to hotel rooms and office premises through manipulation of a hardware backdoor.
These exploits are targeted at FM11RF08S, a newer version of MIFARE Classic introduced by Shanghai Fudan Microelectronics in 2020.
“The presence of the FM11RF08S backdoor enables any entity with awareness of it to compromise all user-defined keys on these cards, even when fully diversified, by gaining access to the card for a brief period,” remarked Philippe Teuwen, a researcher at Quarkslab. He explained.
Not only is the secret key universally shared among existing FM11RF08S cards, the inquiry confirmed that “the attacks could be carried out immediately by an entity capable of executing a supply chain breach.”
Adding to the complexity, a similar vulnerability has been detected in the predecessor, FM11RF08, which is secured with another key. This vulnerability has been traced back to cards manufactured as early as November 2007.
A refined version of the attack could accelerate the key cracking process by five to six times by partially reverse engineering the nonce generation mechanism.
“The exploit […] enables the instantaneous duplication of RFID smart cards employed to unlock office doors and hotel rooms globally,” the company stated.
“While the backdoor only necessitates a brief physical interaction with a compromised card to launch an attack, a threat actor capable of executing a supply chain breach could carry out such attacks rapidly and on a large scale.”
End-users are advised to verify their susceptibility, especially considering the widespread use of these cards in hotels across the United States, Europe, and India.
The backdoor and its key “empowers us to execute new methods to extract and replicate these cards, even in cases where all keys have been correctly diversified,” noted Teuwen. He highlighted.
This is not the first incident where security flaws have been exposed in locking mechanisms used in hotels. Earlier this March, vulnerabilities were discovered in Dormakaba’s Saflok electronic RFID locks, indicating significant weaknesses that could be exploited by malicious actors to forge keycards and access locked doors.
About Author
