A Practical Attack on the MIFARE Classic

The MIFARE Classic is the most widely used contactless smart card in the market. Its design and implementation details are kept secret by its manufacturer. This paper studies the architecture of the card and the communication protocol between card and reader. Then it gives a practical, low-cost, attack that recovers secret information from the memory of the card. Due to a weakness in the pseudo-random generator, we are able to recover the keystream generated by the CRYPTO1 stream cipher. We exploit the malleability of the stream cipher to read all memory blocks of the first sector of the card. Moreover, we are able to read any sector of the memory of the card, provided that we know one memory block within this sector. Finally, and perhaps more damaging, the same holds for modifying memory blocks

Best Effort and Practice Activation Codes

Activation Codes are used in many different digital services and known by many different names including voucher, e-coupon and discount code. In this paper we focus on a specific class of ACs that are short, human-readable, fixed-length and represent value. Even though this class of codes is extensively used there are no general guidelines for the design of Activation Code schemes. We discuss different methods that are used in practice and propose BEPAC, a new Activation Code scheme that provides both authenticity and confidentiality. The small message space of activation codes introduces some problems that are illustrated by an adaptive chosen-plaintext attack (CPA-2) on a general 3-round Feis- tel network of size 2^(2n) . This attack recovers the complete permutation from at most 2^(n+2) plaintext-ciphertext pairs. For this reason, BEPAC is designed in such a way that authenticity and confidentiality are in- dependent properties, i.e. loss of confidentiality does not imply loss of authenticity.Comment: 15 pages, 3 figures, TrustBus 201

Pelargonidin-3-O-glucoside and its metabolites have modest anti-inflammatory effects in human whole blood cultures

This study hypothesized that the predominant strawberry anthocyanin, pelargonidin-3-O-glucoside (Pg-3-glc), and three of its plasma metabolites (4-hydroxybenzoic acid, protocatechuic acid and phloroglucinaldehyde [PGA]) would affect phagocytosis, oxidative burst and the production of selected pro- and anti-inflammatory cytokines in a whole blood culture model. For the assessment of phagocytosis and oxidative burst activity of monocytes and neutrophils, whole blood was pre-incubated in the presence or absence of the test compounds at concentrations up to 5 μM, followed by analysis of phagocytic and oxidative burst activity using commercially available test kits. For the cytokine analysis, diluted whole blood was stimulated with lipopolysaccharide in the presence or absence of the test compounds at concentrations up to 5 μM. Concentrations of selected cytokines (tumor necrosis factor-α [TNF-α], interleukin [IL]-1β, IL-6, IL-8 and IL-10) were determined using a cytometric bead array kit. There were no effects of any of the test compounds on phagocytosis of opsonized or non-opsonized E. coli or on oxidative burst activity. Pg-3-glc and PGA at 0.08 μM increased the concentration of IL-10 (P<0.01 and P<0.001, respectively), but there was no effect on TNF-α, IL-1β, IL-6 and IL-8 and there were no effects of the other compounds. In conclusion, this study demonstrated a lack of effect of these compounds on the opsonization, engulfment and subsequent destruction of bacteria. Pg-3-glc and PGA, at physiologically relevant concentrations, had anti-inflammatory properties; however, effects were modest, only observed at the lowest dose tested and limited to IL-10

Heterozygous missense variants of LMX1A lead to nonsyndromic hearing impairment and vestibular dysfunction

Unraveling the causes and pathomechanisms of progressive disorders is essential for the development of therapeutic strategies. Here, we identified heterozygous pathogenic missense variants of LMX1A in two families of Dutch origin with progressive nonsyndromic hearing impairment (HI), using whole exome sequencing. One variant, c.721G > C (p.Val241Leu), occurred de novo and is predicted to affect the homeodomain of LMX1A, which is essential for DNA binding. The second variant, c.290G > C (p.Cys97Ser), predicted to affect a zinc-binding residue of the second LIM domain that is involved in protein–protein interactions. Bi-allelic deleterious variants of Lmx1a are associated with a complex phenotype in mice, including deafness and vestibular defects, due to arrest of inner ear development. Although Lmx1a mouse mutants demonstrate neurological, skeletal, pigmentation and reproductive system abnormalities, no syndromic features were present in the participating subjects of either family. LMX1A has previously been suggested as a candidate gene for intellectual disability, but our data do not support this, as affected subjects displayed normal cognition. Large variability was observed in the age of onset (a)symmetry, severity and progression rate of HI. About half of the affected individuals displayed vestibular dysfunction and experienced symptoms thereof. The late-onset progressive phenotype and the absence of cochleovestibular malformations on computed tomography scans indicate that heterozygous defects of LMX1A do not result in severe developmental abnormalities in humans. We propose that a single LMX1A wild-type copy is sufficient for normal development but insufficient for maintenance of cochleovestibular function. Alternatively, minor cochleovestibular developmental abnormalities could eventually lead to the progressive phenotype seen in the families

Which method is best for the induction of labour?: A systematic review, network meta-analysis and cost-effectiveness analysis

Background: More than 150,000 pregnant women in England and Wales have their labour induced each year. Multiple pharmacological, mechanical and complementary methods are available to induce labour. Objective: To assess the relative effectiveness, safety and cost-effectiveness of labour induction methods and, data permitting, effects in different clinical subgroups. Methods: We carried out a systematic review using Cochrane methods. The Cochrane Pregnancy and Childbirth Group’s Trials Register was searched (March 2014). This contains over 22,000 reports of controlled trials (published from 1923 onwards) retrieved from weekly searches of OVID MEDLINE (1966 to current); Cochrane Central Register of Controlled Trials (The Cochrane Library); EMBASE (1982 to current); Cumulative Index to Nursing and Allied Health Literature (1984 to current); ClinicalTrials.gov; the World Health Organization International Clinical Trials Registry Portal; and hand-searching of relevant conference proceedings and journals. We included randomised controlled trials examining interventions to induce labour compared with placebo, no treatment or other interventions in women eligible for third-trimester induction. We included outcomes relating to efficacy, safety and acceptability to women. In addition, for the economic analysis we searched the Database of Abstracts of Reviews of Effects, and Economic Evaluations Databases, NHS Economic Evaluation Database and the Health Technology Assessment database. We carried out a network meta-analysis (NMA) using all of the available evidence, both direct and indirect, to produce estimates of the relative effects of each treatment compared with others in a network. We developed a de novo decision tree model to estimate the cost-effectiveness of various methods. The costs included were the intervention and other hospital costs incurred (price year 2012–13). We reviewed the literature to identify preference-based utilities for the health-related outcomes in the model. We calculated incremental cost-effectiveness ratios, expected costs, utilities and net benefit. We represent uncertainty in the optimal intervention using cost-effectiveness acceptability curves. Results: We identified 1190 studies; 611 were eligible for inclusion. The interventions most likely to achieve vaginal delivery (VD) within 24 hours were intravenous oxytocin with amniotomy [posterior rank 2; 95% credible intervals (CrIs) 1 to 9] and higher-dose (≥ 50 μg) vaginal misoprostol (rank 3; 95% CrI 1 to 6). Compared with placebo, several treatments reduced the odds of caesarean section, but we observed considerable uncertainty in treatment rankings. For uterine hyperstimulation, double-balloon catheter had the highest probability of being among the best three treatments, whereas vaginal misoprostol (≥ 50 μg) was most likely to increase the odds of excessive uterine activity. For other safety outcomes there were insufficient data or there was too much uncertainty to identify which treatments performed ‘best’. Few studies collected information on women’s views. Owing to incomplete reporting of the VD within 24 hours outcome, the cost-effectiveness analysis could compare only 20 interventions. The analysis suggested that most interventions have similar utility and differ mainly in cost. With a caveat of considerable uncertainty, titrated (low-dose) misoprostol solution and buccal/sublingual misoprostol had the highest likelihood of being cost-effective. Limitations: There was considerable uncertainty in findings and there were insufficient data for some planned subgroup analyses. Conclusions: Overall, misoprostol and oxytocin with amniotomy (for women with favourable cervix) is more successful than other agents in achieving VD within 24 hours. The ranking according to safety of different methods was less clear. The cost-effectiveness analysis suggested that titrated (low-dose) oral misoprostol solution resulted in the highest utility, whereas buccal/sublingual misoprostol had the lowest cost. There was a high degree of uncertainty as to the most cost-effective intervention

The SmartLogic Tool: Analysing and Testing Smart Card Protocols

Contains fulltext : 94132.pdf (preprint version ) (Open Access)ICST 2012 : IEEE Fifth International Conference on Software Testing, Verification and Validation (ICST), SECTEST 2012, 17 april 201

Outsmarting smart cards

Contains fulltext : 106920.pdf (publisher's version ) (Open Access)Radboud Universiteit Nijmegen, 11 april 2013Promotor : Jacobs, B.P.F. Co-promotor : Garcia, F. D.180 p

Tutorial: Proxmark, the Swiss Army Knife for RFID Security Research : Tutorial at 8th Workshop on RFID Security and Privacy (RFIDSec 2012)

Contains fulltext : 94153.pdf (preprint version ) (Open Access)9 p

Exposing iClass key diversification

Contains fulltext : 91798.pdf (author's version ) (Open Access)WOOT'11 Proceedings of the 5th USENIX conference on Offensive technologie