August 20, 2024 at 02:24PM
Quarkslab has uncovered a significant backdoor in Shanghai Fudan Microelectronics Group’s contactless cards, enabling instant cloning of RFID smart cards. This vulnerability affects widely-used MIFARE Classic cards and their variants, potentially compromising user-defined keys. Quarkslab urges swift infrastructure checks and risk assessment, as these cards are not limited to the Chinese market.
From the meeting notes provided, it is clear that French security services firm Quarkslab made a significant discovery of a backdoor in millions of contactless cards produced by Shanghai Fudan Microelectronics Group. This backdoor allows for instant cloning of RFID smart cards used for various purposes such as opening office doors and accessing hotel rooms.
The backdoor, as documented by Quarkslab researcher Philippe Teuwen, was found to exist in the MIFARE Classic card family, originally launched by Philips (now NXP Semiconductors) in 1994. This discovery is particularly concerning as it enables attackers with physical proximity to the affected cards to conduct attacks that could have wide-ranging security implications.
Furthermore, the meeting notes highlight that the FM11RF08S variant of the MIFARE Classic, released by Shanghai Fudan Microelectronics, features specific countermeasures against known card-only attacks. However, Teuwen’s research revealed vulnerabilities in this variant, including the cracking of secret keys common to all existing FM11RF08S cards.
Quarkslab urged consumers to swiftly check their infrastructure and assess the risks, as the affected cards may have wider deployment beyond the Chinese market, including in hotels across the US, Europe, and India.
Overall, the meeting notes point to a critical security issue in contactless cards manufactured by Shanghai Fudan Microelectronics Group, necessitating prompt action and awareness to mitigate potential risks.