Security researchers from Quarkslab have discovered a hardware backdoor in millions of RFID smart cards produced by Shanghai Fudan Microelectronics Group, including the FM11RF08S contactless key card [3].
Description
This backdoor allows unauthorized access to user-defined keys on the cards, compromising security [4]. The vulnerability affects the FM11RF08S cards released in 2020 and older cards from various manufacturers. The attack can crack keys five to six times faster by reverse engineering the nonce generation mechanism [1] [5]. The backdoor has also been identified in the previous generation FM11RF08 cards [1] [2] [3], potentially affecting a large number of smart cards globally. The FM11RF085 card includes a countermeasure called “static encrypted nonce” to prevent attacks [4]. These vulnerabilities could lead to widespread breaches in office buildings and hotels, with the possibility of supply chain attacks.
Conclusion
Consumers are advised to check if their cards are vulnerable [1] [2] [5], as these cards are widely used in hotels across the US [2] [5], Europe [2] [5], and India [2] [5]. This discovery highlights the importance of addressing security vulnerabilities in smart cards to prevent widespread breaches and protect user privacy. Future implications include the need for stronger security measures in RFID technology to prevent unauthorized access and potential supply chain attacks.
References
[1] https://www.ihash.eu/2024/08/hardware-backdoor-discovered-in-rfid-cards-used-in-hotels-and-offices-worldwide/
[2] https://thehackernews.com/2024/08/hardware-backdoor-discovered-in-rfid.html
[3] https://www.infosecurity-magazine.com/news/backdoor-mifare-smart-cards-open/
[4] https://securityboulevard.com/2024/08/backdoor-in-rfid-cards-for-offices-hotels-can-lead-to-instant-cloning/
[5] https://patabook.com/technology/2024/08/22/hardware-backdoor-discovered-in-rfid-cards-used-in-hotels-and-offices-worldwide/
