How's everyone doing today?
Good.
So now, let's come to our talk.
And so MIFARE ULTRALIGHT system and ULTRALIGHT chips are used
for communication.
And in our country, they have been used especially
for the transportation system like busses, Metro, and
in the past there has been people who discovered some hacked the system
of the communication between those chips.
And so in 2008 the MIFARE classic which is a type
of chip classic in 2011 two American made
to exploit and to see ULTRALIGHT one which
is the one I will be speaking about.
In my country, so in Italy, it has been used
for transportation systems.
So, if you take a bus, you will take a ticket,
multiple ride ticket which has MIFARE inside.
So what is it?
RFID chips are designed to work at target frequency 1356 megahertz
frequency and a lot of times as I told you before.
There is a MIFARE classic ULTRALIGHT a lot of types.
And the ULTRALIGHT is cheap.
But it has a problem.
It is not it has no hardware encryption.
So how we came to this hack?
Well, we started studying NFC chips when from January
the local transportation system in Turin updated their stamping
machines and so it was possible to use those tickets to ride the bus
or Metro or what else.
And it had the same vulnerability I was telling you about before.
But the point is we didn't know anything
about the structure of this ticket.
So we tried with that vulnerability but we failed.
That was the point, we failed.
We tried to and so you know, if you don't know what are you dealing
with, it is, let's say it's tricky to solve it.
So we decided to study better the kind of technology
in case we discovered that we tried to make some little experiments
and so we decided to stamp one ticket after the other
and comparing the results we have an NFC reader and we read
the dumps of those tickets.
And we were comparing them to find if there were some similarities
something similar to compare it and to find for example how does
the data saved on the ticket.
So we managed to get in empiric results of this.
So assume that you know we're exactly the last time of the stamp
of your ticket is being stored.
If you have an NFC form with an NFC reader and writer,
you can actually change the field where the time
of your last stamp is stored.
And so that in this way, you can easily bypass the system
of stamping, the stamping machine, you can stamp by yourself your ticket.
And this is where we wanted to wanted to get.
The point we were looking for.
The problem is it is not so reliable the kind of thing, you have a reader
and things to deal with.
It is not the point.
If you want to add something about that the point
is that we managed to solve our problem
because when we looked more in we pay more attention about how
the ticket was made.
We came to a solution and we found that
the answer to hack the ticket and find a way to make it limited was
in the log bites.
Log bytes are a sector of the ticket and he will speak about that now.
This is the ticket of my city.
The 5 rides ticket so you can stamp it until five times and then it expires.
We will look at the log bytes and OTP is the only security function
in the ULTRALIGHT tickets.
There are four bytes and by that four they are all set to zero.
When you stamp the ticket, there is an operation that
to turn one bit to one.
So you can turn it back to zero.
That's the only way you can stamp the ticket without any fraud.
There are a number of possible rights on each ticket
and we'll speak about later.
The data sector.
(Applause.) I saw one of your slides coming in,
it's not going to be funny.
(Laughter) We have decided to brand this spot the fed, this
is now shot the n00b.
Are you even 18?
No, we're not.
He's of legal drinking age in Italy.
And this stage is actually technically part
of Italy audience, raise your hand if it's your first DEF CON.
You, sir, get up here.
On stage somehow.
To all the new people at DEF CON.
Cheers!
Okay.
Where was I?
Okay.
They were strong.
The data sector was used in the past attack, 2011 attack for rights.
But the sector is readable, writable so you just swipe it
and get a new ticket.
But in they fixed it so in Turin it doesn't work any more.
So for about just code time time stamp from the machine and reproduce it
without touching the OTP sector.
So the rides remain the same but we can stamp it ourselves.
We're not getting the point because of lack of NFC.
We're poor.
If you want stamps of our ticket, we'll give you at the Q&A session.
No problem.
These are some empirical results we can speak more later.
Doesn't matter.
Okay, lock ak sector, this is the most important part of our talk.
This is the point we found solution.
There are two bytes.
First is red and second is orange.
Okay, each bit of bytes can lock
a sector and make it read only.
So what we did is just lock the bit or lock bit sector that made read only
the OTP data.
Machine tries to do it but read only and I cannot.
When we first made our test on the road.
We found a little problem because it's not good
by that your 5 rides ticket and then have always 5 rides when
they test it.
You forgot to took one of the rides.
And so it was Not good.
What are you going to say to the man who is going
to check your ticket.
Okay.
How to fix it.
The lock attack is quite easy to be fixed.
Because you just need to check if the OTP bits is read only or not.
And if it's read only refuse to validate.
But the name problem is the time attack Yeah, the point
is there are two vulnerabilities we found but we exploit just one
because of lack of time and hardware
as he explained before.
The time for vulnerability is easy to exploit
if we can actually decode the data.
And what if if you know exactly how the data was encoded and where it
is exactly located inside your ticket, it will be really easy
to exploit this because if you have NFC reader, writer,
you can write the data etch ooh team you want.
You can put your ticket on your NFC phone and just stamp
the actual data so the actual time if it is 5:15 then the you put your ticket
over your phone and then you can write 5:15 each time you want.
So you can bypass the validating system so you can still
have four rides left and you're just adjusting the time.
And that will be really hard to be fixed.
Because all the data written inside the ticket
is not encrypted hardware speaking so, if you're able to decode this, it
will be hard to fix it while the lack attack so the exploit
he was thinking about will be easy to be fixed
because if the stamp machine checks if the lock bit is on or off, and then
with feedback way, that stamp machine can immediately
know if your ticket is fake or not.
So now we are going to study more about those kind
of tickets and try to decode data and if you'd like to help us,
we are open minded we will give you
the dumps and any help will be developed very well.
Is that is the point.
So we also thought about a solution for the time attack
but it should require fine upgrade that enabled software encryption
on the ticket because if you encrypt the ticket, you can just time stamp your
ticket with your phone.
But we spoke of that with our transport company and
they say yeah, yeah, and never did anything.
We're still waiting that our vulnerability is fixed on the ground we don't really
know about that.
Okay.
We are working about tool that should do it
everything automatically.
And actually, it is written in Python and works on Linux computer.
You need NFC, that is the tool we used for encoding
and writing the tickets.
It is a meter you can find anywhere cheap for $10
on eBay or something like that and get free rides for your life.
(Laughter) We started selling these.
We're open for donation of the set but we have lack of money.
So I think that's it.
If you have questions about how we got into it
but I think I don't know if you got the meaning
of what we're speaking about.
You know, it is a little difficult to speak
in another language when you're outside and but we tried.
And I think it has been a very good experience, I think,
I hope you enjoyed this talk and I hope well, you got the clue for us,
it was a very big not surprise but we were happy
to fine something about this and to have been accepted here
to explain you what we found.
If you want to test the vulnerability on your city,
we're glad to receive feedback and also invitation for lunch, dinner,
coffee, everything.
(Laughter) (Applause) I think speaking
about things wouldn't be so appreciated by you.
I don't know if you will appreciate to speak about the very detail
of if you want in the Q&A, you can ask for further information
and details about those tickets.
So you have any questions?
Or?
AUDIENCE: How do you find out what technology your mass transit
system was using.
Yeah, the advertising on the Web site.
(Laughter) Google.
AUDIENCE: That's convenient.
There's a similar system in use the Bay Area.
I'm interested in what you were talking
about with the time stamp because the San Francisco system,
the way it works is you swipe to get on the bus the first time
and you have 90 minutes to be able to Like in Turin.
AUDIENCE: So you have the same system there.
So it just amounts to changing the time stamp
on that and you change it to now and you get 90 minutes from now
to be able to ride and you can do that.
That's your free for life system.
Is that correct?
Yeah, there's the work in progress because just a second.
Okay.
If you're see, we are just guessing where
the realtime stamp is stored because we didn't have an NFC phone.
So going on the train with a computer five tickets and then
an this, it's not so good.
But -- There's nothing suspicious about that at all.
It happens all the time.
In San Francisco anyway, you see that stuff all the time.
Okay.
So, if you have invitation for San Francisco.
AUDIENCE: Love to have you.
We sent a mail to the company explaining that we
found this vulnerability.
Yesterday.
(Laughter) (Applause) They are not geeks so they can't reply very fast.
So we're waiting now for a reply.
No.
We are publishing a white paper about that and we send it to them.
But I hope they won't fix on this.
Because I take some ground very often.
If you want to read our white paper, it will be available.
We will share with you.
Very bad written but it works.
Anyone else?
No invitation?
(Laughter) Thank you.
Thank you very much.
There is information.
If you won't send us invitation after the talk
because our talk I don't know.
Twitter mine is @ bughardy This is his.
If you want to find us on Twitter, just thank you very much.
If you have a question, just raise your hand.
Don't come here so everyone can -- So I totally missed your talk,
you ended earlier.
We got another 20 minutes so we're going to do Q&A.
I missed the talk so I don't have any questions but I hear it has to do
with NFC technology.
You?
Maybe?
It's okay.
So what's your talk about?
Again, okay.
It was about NFC.
Use the microphone.
Sorry.
We have another drink.
Another drink.
Yes!
Yes.
This is your first DEF CON, isn't it?
Yes!
So, if you do have any questions, you can feel to come in and get
in line here because I didn't see the talk.
Okay.
So we are waiting for some questions if you have.
We just run a little bit with our talk.
Okay.
I can see we spent 32 minutes.
Yahoo So we've made this mistake before.
We'd like to apologize.
What the picture says is not what it represented.
So yes, you actually have an hour.
Bonus.
So we're going on and let's say there
is a question here.
You said OTP but I don't know what One
time programmable.
Could you get a little bit deeper into that?
Yeah, an explanation, of course.
OTP section is made up is composed by 4 bytes.
And each one of those is when the ticket is new, brand new, they are
all set to zero, all the bits are set to zero.
So when you stamp your ticket and the validator machine checks how
many zeroes are in your OTP or in target section of the OTP.
Did you say you need another drink?
Yeah, of course, we need it.
So the stamp machine checks how many zeroes are left and then
the stamp machines knows how many tickets are left
in your multiple ride ticket.
When you stamp your ticket the machine turns the bits
from zero to 1.
This operation is irreversible.
So you can't turn them back to zero again.
Because actually, when you attempt to write something on the OTP section,
you are ordering all the bits, bit wise or they are old.
So you know that an or operation will not give you back a zero if one
of the two You want another drink.
Here you go.
If one of the two bits is set to 1, it is impossible to get back to zero.
Is he still talking.
3, 2, 1, go!
(Applause) Okay.
So when all the bits when all the bits are turned to 1,
the stamp machine is aware that your ticket has run
out of rides.
And so the stamp machine says your ticket
is empty now.
So our vulnerability exploits the system because if you freeze
the actual number of rides left, the machine cannot turn those bits
from 0 to 1 and locking forever the status of your rides left.
So, if you can make this section read only, the machine won't be able any
more to turn those to one.
And so you have none, three rides, four rides, locked forever.
So your ticket will be four rides and no one will change it the number
of rides left.
And that is the point.
That is -- So, if you lock the car like that,
what effect does that have then on the time stamp.
If you verified your card, will the not it not have
a time stamp from the first time you used it?
Can you repeat the question?
Sure, you have two attacks, right?
Your attack is locking the card so you can't remove rides
from it and the other is modifying the time of th-- e but, if you lock
the card, does it not lock the time?
No.
It doesn't lock the time?
No, because the time stamp is stored in the data sector.
The rights is stored in OTP sector.
So we can lock only OTP sector and the left data sector read only
and writable.
You said that you used C and C++ to write the code and I'd
like to know which library did you use.
Actually, it's written in Python.
we plan to import it to C.
In python we're using a standard tool called NFC tool,
which is open source, you can find it on Google code or
on but remember you can compile it for Linux and totally free.
For C and C++, there is a C that is also open source, we'll use it when
in the few weeks, I hope to have a new tool.
Okay.
Could you could you tell me a good book for study the protocol
and NFC protocol or you don't know?
Well, I don't know.
Okay, just research on Internet.
Okay.
They look at first vulnerability of 2011 and then we do empirical
results and we start to study on the vertical tool.
So we didn't have book or just Google.
Okay, nice.
Next?
Any other questions?
Maybe there.
No question.
The proximal, we plan to use it for attack because if we can't,
the code data because it's somewhere encrypted,
software encrypted, we can still sniff the data
because the communication is totally clear.
And the stamp using the so we stamp only
the data sector without the OTP sector and so also,
if you encrypt the data sector we can have free rides.
So yes, the ULTRALIGHT is totally broken.
Turin, Italy.
You want to come and have a visit of Turin we offer free booth rides.
Cheap 1 with the bus.
I think Bologna but I'm not sure.
And I think Milan is going to upgrade system to NFC
but at the moment I only know of Turin and Bologna.
The point is that the I'm sorry.
The question?
The point is the transportation system is using
the MIFARE ULTRALIGHT because cheaper than other NFC chips.
It is cheaper because it is hardware encrypted and that's
the problem of the NFC MIFARE ULTRALIGHT.
But the corporation systems do not realize that and they're still using those
chips even if they are cheaper.
So that's the point.
Any other questions?
An card is different type of NFC chips, they're MIFARE plastic.
They're broken like six years ago.
They are less fun.
Anyone else?
If you want some stamps, we're just outside.
We can give them.
Thank you very much, once again.
And I hope you enjoyed this talk.
And Okay.
You made us happy to explain you all those things.
And I think it was a very good experience.
So thank you once again.
Okay.
Yeah.
The next speaker I'm going to go grab him if you're here
for what you thought was a 30 minute talk is actually an hour.
If you read your pamphlet there, you'll see in the bottom
in parens that the other starts at 1600.
So so excuse me for a second.
There we go.
That's better.
So let me go get him and we'll get him started up for you.
And we'll get him settled in and then get it going.
Okay.