Home / vulnerabilities NXP Hitag S Transponder Weak Authentication
Posted on 04 January 2016
Source : packetstormsecurity.org Link
OS-S Security Advisory 2016-02
Date: January 1st, 2016
Updated: January 1st, 2016
Authors: Oguzhan Cicek, Hendrik Schwartke, Ralf Spenneberg
CVE: Not yet assigned
CVSS: 6.2 (AV:L/AC:L/Au:S/C:C/I:C/A:N)
Title: Weak authentication in NXP Hitag S transponder allows an attacker to
read, write and clone any tag
Severity: Critical. All applications relying only on the Hitag S security are
broken.
Ease of Exploitation: Trivial
Vulnerability: Weak authentication using 48 bit key and 24 bit password
Product: NXP Hitag S transponder
Abstract
The Hitag S transponder supports a crypto mode. In crypto mode the transponder
requires a bilateral authentication before the transponder may be read or
written. This authentication uses a 48 bit key and a 24 bit password. The
underlying algorithm is not publicly documented. We determined that the Hitag
S transponder uses the same crypto algorithm as the Hitag 2 which was
published already in 2006 by Wiener [1]. The algorithm may be broken using a
crypto-analytic attack published at Usenix 2012 [2] and using SAT-Solvers. The
cryptoanalytic attack requires 150 sniffed authentication challenges between a
valid reader and a corresponding transponder. The attack using SAT solver
requires 2 such challenges because every authentication challenge provides
only 40 bits encrypted data with known plaintext. To deduct the 48 bits of the
used key more data is required.
Using SAT solvers the key can usually be retrieved within 5 days.
The Hitag S may read-protect the areas where the key and a password is stored.
While the key may be broken and is thus known to the attacker the password
send by the transponder during the authentication. Although the password is
send encrypted the attacker may decrypt the password using the broken key.
Impact
The attacker may read and write all not-protected areas of the transponder.
The applications using the transponder need to implement there own mechanisms
to protect the integrity and confidentiality of the stored information.
The attacker may emulate the transponder (using for example the proxmark 3)
since the protocol and crypto algorithm is now known and the attacker has
access to the full content of the transponder to be emulated.
Vendor Contact
The vendor NXP was first contacted July 17th 2015 using [info|security|
abuse]@nxp.com. We did not receive any response. We contacted NXP a second
time using psirt@nxp.com on November 17th 2015. This time we received a
response and communicated the vulnerability to the vendor.
[1]
https://web.archive.org/web/20120127012528/http://cryptolib.com/ciphers/hitag2
[2] https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/verdult
--
OpenSource Security Ralf Spenneberg http://www.os-s.de
Am Bahnhof 3-5 48565 Steinfurt Germany
Fon: +49(0)2552 638 755 Fax: +49(0)2552 638 757
