Büttner, Victor

Frilund Hensel, Marius

Melgaard, Magnus

Olsen, Rasmus Løvenstein

Teule, Julian Jørgensen

Velgaard Sørensen, Jonathan

English

As smart cards have become increasingly prevalent in electronic access control systems, this paper investigates an implementation at a national institution, which uses a smart card with publicly known weaknesses. The main outcome is a set of recommendations which can be used for securing electronic access control systems against the discovered flaws of this work: The implementation did notfollow guidelines from the manufacturer of the cards, the content of the restricted sector was printed onto each card, and in-house services with inherent security flaws were built around the cards, but not maintained. These flaws meant that the civil registration number of any employee at the institution could be revealed. Additionally, the flaws allowed for changing the PIN code of any card in the system

Examining the Cyber Security of a Real WorldAccess Control ImplementationJulian Jørgensen TeuleDepartment of Electronic SystemsAalborg UniversityAalborg, Denmarkjteule18@student.aau.dkMarius Frilund HenselDepartment of Electronic SystemsAalborg UniversityAalborg, Denmarkmhense15@student.aau.dkVictor BüttnerDepartment of Electronic SystemsAalborg UniversityAalborg, Denmarkvbattn18@student.aau.dkJonathan Velgaard SørensenDepartment of Electronic SystemsAalborg UniversityAalborg, Denmarkjvsa16@student.aau.dkMagnus MelgaardDepartment of Electronic SystemsAalborg UniversityAalborg, Denmarkmmelga16@student.aau.dkRasmus Løvenstein OlsenDepartment of Electronic SystemsAalborg UniversityAalborg, Denmarkrlo@es.aau.dkAbstract—As smart cards have become increasingly prevalentin electronic access control systems, this paper investigates animplementation at a national institution, which uses a smart cardwith publicly known weaknesses.The main outcome is a set of recommendations which canbe used for securing electronic access control systems againstthe discovered flaws of this work: The implementation did notfollow guidelines from the manufacturer of the cards, the contentof the restricted sector was printed onto each card, and in-houseservices with inherent security flaws were built around the cards,but not maintained.These flaws meant that the civil registration number of anyemployee at the institution could be revealed. Additionally, theflaws allowed for changing the PIN code of any card in thesystem.Index Terms—MIFARE Classic 1K, Crypto1, Smart Cards,Electronic Access ControlI. INTRODUCTIONElectronic access control in enterprises and institutions iswidely used. In 2019, 49% of companies with more than 250employees in Denmark used sensors for security and accesscontrol [1].These systems often utilise the MIFARE Classic SmartCards, which have had known weaknesses since 2008 [2]. Thishas been seen in the Dutch OV-chipkaart (Public Transportchipcard) used for public transport, where TNO (NetherlandsOrganisation for Applied Scientific Research) predicted thatthe weaknesses enable abuse and fraud [3].More than 10 years later and MIFARE Classic is still beingused, which prompted this work. This work will examine towhat extent the smart card access control implementation ata national institution (from now on referred to as NI) can beexploited and the outcome will be a set of recommendationsthat secures the system against the shown attacks.The implementation at NI was created in collaboration witha security company operating in Denmark and it allows for theuse of smart cards and terminals to grant access to a buildingor room.MasterdatabaseLocaldatabasecopyData centerControl box nBuilding nPCD m1 2 34 5 67 8 9* 0 #Card holderFig. 1. Simplified representation of the smart card access control implemen-tation at NI.Section II will cover the known exploits in the MIFAREClassic smart cards, which allow reading and writing of thelocked cards. In section III and IV the specific implementationat NI will be examined.This practical insight will form the basis of the recommen-dations in section V.II. BACKGROUNDThe model used at NI is Role-Based Access Control(RBAC) in order for the cards to have different permissions.The smart cards used are MIFARE Classic 1K which aremanufactured by NXP and issued by the security company.The MIFARE Classic 1K has 1 kB of storage which issplit between 16 sectors (0 through 15), each containing four16 byte blocks [4]. The last sector of each block, called thesector trailer, is dedicated to two 48 bit authentication keys,key A and key B, alongside permission bits for each block ofthat sector. These bits control the read and write permissionsof the sector blocks, alongside which keys are needed to havethese permissions.In principle an adversary can not get access to the blocksthat are restricted by the permission bits without a correct key[4].However, these permission restrictions do not quite sufficein practice:In 2007 Nohl et al. published weaknesses of Crypto1, theproprietary cryptographic algorithm used by the smart cards.These weaknesses were later used to fully reverse engineer thecryptographic algorithm [2].The main weaknesses revolve around the insufficient sizeof the keys, the insufficient randomness provided by the 16bit Linear Feedback Shift Register (LFSR) and the propertiesof the 48 bit LSFR [2]. Therefore, adversaries can extract thekey used to encrypt secret data on a card.III. DISSECTING SMART CARDSNI utilises the content of sector 15 for authentication andsector 15 is the only sector restricted by a non-zero 48 bit key.Sector 15 will be referred to as the restricted sector.A. Accessing the restricted sectorAfter investigating the known weaknesses, it became appar-ent that all of the tested smart cards from NI share the samekey. This means if the key to a single smart card is cracked,the key to all the smart cards is cracked, and thus the contentsof the restricted sector can be accessed.B. Contents of the restricted SectorUsing a cracked key revealed that sector 15 is used to storesome data. An example of this can be seen in fig. 2.Fig. 2. A cropped screen shot of MIFARE Classic Tool [5] reading a smartcard with card number 123456. This requires the sector key which has beenremoved from the screenshot.The following pattern appeared when decoding the contentsof 12 cards as American Standard Code for InformationInterchange (ASCII).GROUP 4 ;0033310000XXXXXX0?Y0000Where XXXXXX is the users’ card number and Y seemed tovary between 0x30 and 0x3F. In this pattern, it is speculatedthat this is a check digit determined by formula 1.Y10 = 48 +((6∑n=1dn − 1)mod 16)(1)Where dn is the n’th digit of the card number, 6 is thelength of the card number, Y10 is the decimal representationof the ASCII character Y and 48 is the decimal representationof 0x30.C. Card numbersSince the content of sector 15 depends solely on the cardnumber, the security of the card is reduced to this number.This means that an adversary with access to the global keycan duplicate cards using only a users card number.The six digit card number might provide adequate security ifit is kept secret. However several flaws in the implementationand usage of this number were found.1) Card numbers are printed on the outside of cards,making scanning unnecessary to reveal the data on thelocked sector.2) Card numbers are used for identification, meaning theyare not kept secret by employees. For instance, cardnumbers are written on pieces of paper when requestingpermission to access a room.3) Card numbers are sequential, meaning employees canguess other card numbers by counting up or down fromtheir own.Even though these flaws allow for remote duplication ofcards, many rooms still require PIN code authentication whichgreatly limits the extent to which the mentioned flaws can beutilised. Section IV will cover these PIN codes and the servicesbuilt around them.IV. PIN CODESPIN codes are implemented separately from the card itself,meaning compromising a smart card will not yield the PINcode. The PIN code is instead fetched from a central databaseevery time one tries to enter. This PIN code is cached at eachbuilding, in the case the central database is offline (see fig. 1).It was discovered that PIN codes are four digit numbersand must not start with a 0, which allows for 9000 differentcombinations.NI provided a number of services that made use of- ormanipulated PIN codes. As shown in the following sections,flaws in these services could enable an adversary to extractand/or change PIN codes. NI has addressed these flaws as aresult of this work.A. Library Login PageThe library at NI provided a login page where employeescould login using their card number and PIN code. No ratelimiting was employed meaning PIN codes could be brute-forced if the card number is known. Even though the serverdid not employ rate limiting, it was very slow. As such, allpossible PIN code combinations could be tested in 7.5 hoursat a rate of one password every 3 seconds.B. Set PIN Code PageNI provided a page where employees could set their PINcodes. To log in on this page, one had to provide a matchingDanish Civil Registration Number (CPR number) and cardnumber. The CPR number consists of one’s birth date with afour digit number. The parity of the four digits represents sex.If a person’s birth date is known, that person’s CPR numberhas 540 different remaining combinations and half that if theFig. 3. Page enabling employees to set their PIN codes by specifying CPRnumber and card number. A flaw enabled changing of PIN codes withoutspecifying correct CPR number.sex is also known [6]. This enables brute-forcing the login ifthe card number is known, which also reveals that person’spersonal CPR number.It was discovered that this page had two visible endpointslogin and pin. Login redirects the user to pin if the CPRnumber and card number are correct, while pin enables theuser to change the pin for the specified card number.Unfortunately pin did not check if user is authenticated inlogin, meaning PIN codes can be changed without knowingthe correct CPR number.Because of the seemingly sequential card numbers an adver-sary can generate valid card numbers by counting up or downfrom an observed card number. This enabled changing PINcodes and/or extracting CPR numbers from card numbers.V. RECOMMENDATIONSNXP, the manufacturer of MIFARE Classic 1K, are awareof some vulnerabilities hereof, and as such, has given recom-mendations with regards to the implementation of the card.Following these recommendations, and keeping up to datewith them, will mitigate some of the flaws. The manufacturerrecommendations are as follows:• Avoid using MIFARE Classic – MIFARE CLASSIC 1Kcards should not be used, as it does not provide adequatecryptographic security.• Use unique keys – Keys should not be reused and shouldbe unique to each card.Additionally, as a result of this work:• Limit the number of PIN attempts – When verifyingwith PIN, the number of allowed attempts should be ratelimited to counteract brute-force attacks.• Do not print contents of the restricted sector, on the card– The data on the restricted sector should preferably berandomly generated, and not used for any other purpose.• Do not let services remain unmaintained – Keep servicesup to date with best practices and beware that these ser-vices can compromise an access control implementation.• Generate card numbers randomly – If card numbers areto be used for logging in, they should be random andmore than six digits.VI. CONCLUSIONHaving examined the implementation at NI it is concludedthat several flaws exist, aside from the ones covered in sectionII. They are rooted in implementation flaws of the smart cards,and the addition of several in-house services by NI.Collectively, these flaws allow remote duplication of smartcards, thus granting access to locked rooms on behalf ofemployees. This requires a valid card number of an employeewith access to the locked room. However, card numbers can beguessed by counting up or down from a known card number.Alongside remote duplication, these flaws also allow revealingthe civil registration number of any employee at the institution.Due to these flaws several recommendations, in addition tothe manufacturer’s recommendations, were determined.ACKNOWLEDGMENTJens Myrup Pedersen for his invaluable feedback and inspi-ration.Johan Hempel Bengtson for sharing his experience with theMIFARE Classic 1K and partially inspiring this work.NI for assistance during this work and for addressing theseflaws.Aalborg University for providing the opportunity to workon this as a semester project.Nicholas Bernth Strømgaard Hansen for his contributionsto this work as a semester project.REFERENCES[1] Statistics Denmark. (2019) Virksomhedernes brug af avanceredeteknologier (10+ ansatte) efter emner, virksomhedsstørrelse og tid.[Online]. Available: https://www.statistikbanken.dk/ITAV7[2] F. Garcia, G. Gans, R. Muijrers, P. van Rossum, R. Verdult, R. Schreur,and B. Jacobs, “Dismantling mifare classic,” Lect. Note. Comput. Sci.,vol. 5283, pp. 97–114, 10 2008.[3] TNO. (2008, Feb). [Online]. Available: https://files.gendo.ch/TNO ICT- Security Analysis OV-Chipkaart - public report.pdf[4] (2018) Mifare classic ev1 1k - mainstream contactless smart cardic for fast and easy solution development. [Online]. Available:https://www.nxp.com/docs/en/data-sheet/MF1S50YYX V1.pdf[5] G. Klostermeier. Mifareclassictool. [Online]. Available: https://github.com/ikarus23/MifareClassicTool[6] Personnummeret i cpr-systemet. [Online]. Available: https://cpr.dk/media/17534/personnummeret-i-cpr.pdf

Examining the Cyber Security of a Real World Access Control Implementation

Crossref

https://vbn.aau.dk/files/348223315/19gr352artikel.pdf

Examining the Cyber Security of a Real World Access Control Implementation

Abstract

Similar works

Full text

Available Versions

VBN

Crossref