mifare
Latest
Apple could make the iPhone's NFC more useful at WWDC
Apple has a lot in the cards for WWDC, and that might include improvements for... well, cards. The 9to5Mac team and Steve Troughton-Smith claim to have details of developer-friendly updates that will be unveiled in early June, and NFC support would be in line for a serious upgrade. App developers will finally have the option to read NFC tags based on ISO 7816 (usually ID and access cards), FeliCa (Japan's tap-based system) and MiFare (a popular mass transit format). In other words, you might use your iPhone to enter your office or hop aboard a bus in many cities.
Samsung Galaxy S 4 drops original TecTile support, requires new TecTile 2
Don't get too attached to that collection of TecTiles if you're upgrading to a Galaxy S 4. AnandTech has discovered that Samsung's newer phone includes an NFC chipset that can't read the older TecTiles, which rely on a less common tag type to register our taps instead of the NFC Forum's standards. Customers aren't being left in a bind, however. Samsung has confirmed that it's about to release a follow-up, TecTile 2, which adheres to the official format while supporting the company's older NFC-equipped phones. The fully modernized tags will be ready sometime in the "coming weeks." That doesn't offer much immediate relief for GS3-to-GS4 upgraders whose TecTile layouts have suddenly been reduced to decorations, but those buyers should at least get the replacements they seek before long.
Security researchers identify transit system exploit in San Fran and New Jersey, create app to prove it
Mobile security company Intrepidus Group presented evidence during the EUSecWest security conference potentially identifying a major flaw in at least two US transit systems. Creating an Android app named "UltraReset" and using it in tandem with an NFC-enabled Android phone (a Nexus S, in this case), security researchers Corey Benninger and Max Sobell were able to reset and reuse -- free of charge -- transit access cards in both San Francisco's MUNI system and New Jersey's PATH system. Before you go getting any bad ideas, know that Benninger and Sobell haven't released the app for public use, and warned both transit systems in late 2011 (though neither region has fixed the exploit, the duo claim). PATH and MUNI share a common chip access card -- the Mifare Ultralight -- which can apparently be reset for 10 extra rides (as demonstrated on video below) via Android phones with NFC, an OS newer than 2.3.3 (Gingerbread). Starting to sound familiar? Intrepidus is, however, releasing a modified version of the app, named "UltraCardTester." The modified app functions just like its nefarious progenitor, except it can't add time to cards (see it in action below). The app can tell you how many rides you have left, and if a system is open to exploit, but it won't assist you in the act of exploiting. We reached out to both New Jersey's PATH and San Francisco MUNI on the issue, but have yet to hear back as of publishing.
Oyster Card RFID hack gets detailed
The vulnerability of cards based on the Mifare Classic RFID chip (like the Oyster Card used for the London Underground) has been known for some time now but, unsurprisingly, some pesky legal business has prevented the complete details from being published. That has now finally been cleared up, however, and Professor Bart Jacobs and his colleagues from Radboud University have promptly published their complete paper online. What's more, NXP Semiconductors, makers of the Mifare chip, are also now commenting on the matter, and saying that it never intended to completely stop publication of the research, but rather that it simply wanted to give customers time to update their systems. NXP's Steve Owen also adds that the company now doesn't "recommend the use of Mifare Classic for new installations," and that it's "working with customers to review their security." Those looking to dig in can find the paper at the link below and, in case you missed it the first time around, there's a video explaining the basics after the break.[Via BBC Click]
Oyster Cards vulnerable to RFID hack, lots of other systems too
Sure, it's fun to say that one billion RFID cards are now at risk due to the Mifare Classic's broken encryption, but it's another thing to comprehend how widespread the fallout could potentially be -- the London Underground's Oyster Card is based on the chip, for example. And that's just the tip of the iceberg: a new report says that the system can be broken in minutes using a typical PC -- check the video after the break for a demonstration. We've also listed all the other now-potentially-vulnerable Mifare RFID implementations we could find, but there's got to be more -- put 'em in comments!
Sony, NXP get official with Moversa joint venture
Chances are, you had forgotten all about Sony and NXP's little initiative to cooperate on a NFC (near-field communications) standard, but the two seem to have finally worked out all the kinks and are ready to move forward. The joint venture, dubbed Moversa, will seek to "drive global adoption of contactless smart card applications in mobile phones," and it's already planning to develop, produce and market a Universal Secure Access Module (U-SAM) that "incorporates both MIFARE and FeliCa operating systems and applications." Essentially, the duo is hoping to accelerate the adoption of integrated contactless support, which would enable users to make payments (among other things) easily via their handset. If you're curious about availability, we're hearing that samples should be shipped out in mid-2008, but commercial deployments aren't scheduled to happen until the end of next year.[Via Yahoo / Reuters]
GSM Association gets everyone together for phone e-wallets
With services like NTT DoCoMo's FeliCa-based Osaifu-Keitai in Japan and Mifare deployed through much of Europe, perhaps one of the last great hurdles to widespread acceptance of phone-based e-wallets is a lack of standardization. Either that, or most people don't feel the need to pay for things by tapping their phone on various devices, but we digress; the point is that the GSM Association has now taken up the cause of getting everyone on the same page with its global "Pay-Buy Mobile" initiative. We really mean global, too -- among a slew of carriers, AT&T, NTT DoCoMo, Vodafone, and KTF are on board, representing the US, Japan, Europe, and South Korea, respectively, and the manufacturer camp counts Nokia, Samsung, and LG as its members. The first Pay-Buy Mobile trials are schedule to kick off this October, a schedule that is probably helped along by the availability of existing software and chips from Sony and NXP and the GSMA's pledge to build off financial institutions' existing NFC initiatives. We can't promise we'll use it -- but yeah, if it's secure, go ahead and build it into our phones, folks.[Via Phone Scoop]
Sony, NXP to cooperate on NFC standard
Using cellphones to pay for stuff via NFC (near-field communications) is certainly nothing new; Sony, for one, has been doing it for years with its FeliCa system in Japan. Regardless of how dominant FeliCa or NXP's Mifare are, though, standardization is always a welcome move in an industry that hasn't quite taken off yet on a global scale. Sony and NXP have committed to putting their noggins together to come up with a unified standard for NFC payments that will ultimately support both FeliCa and Mifare-based equipment, while also bringing together two of the most widely-deployed systems to date. Given that both Sony and NXP parent Philips are members of the NFC Forum, we have hope that this announcement lines up nicely with that group's efforts, too, rather than going against the grain with a parallel effort. Not to say we'd put that kind of buffoonery past Sony, of course.
