Millions of RFID key cards can be easily cloned due to a backdoor

Millions of RFID key cards sold around the world contain a serious security flaw that allows them to be easily cloned, allowing attackers to gain unauthorized access to various areas.

Chinese origin

The problem was discovered by the French security company Quarkslab. According to the company, cards manufactured by the Chinese company Shanghai Fudan Microelectronics Group are affected. These cards, which are used worldwide to open office doors and hotel rooms, can be cloned in a matter of seconds.

In a paper written by Quarkslab researcher Philippe Teuwen, study This backdoor is described as allowing RFID smart cards to be duplicated by staying in proximity to an affected card for just a few minutes. What is particularly worrying is that attackers capable of executing a supply chain attack could use this backdoor to conduct large-scale attacks.

Teuwen came across this backdoor while conducting security analysis on the MIFARE Classic family of cards. These cards, which have been on the market since 1994, are used in public transport and the hotel industry around the world. Over the years, numerous vulnerabilities have been uncovered in these cards, allowing attackers to clone cards or read and manipulate their contents, simply through physical proximity.

In 2020, Shanghai Fudan Microelectronics launched the FM11RF08S variant of the MIFARE Classic, which includes specially designed countermeasures to fend off all known attacks. This new card has gradually become established worldwide. However, Teuwen discovered that it is possible to crack the keys of this variant in a few minutes if they are reused in at least three sectors or on three different cards.

In use worldwide

Further investigation revealed a hardware backdoor that allows authentication with an unknown key. After cracking this secret key, Teuwen found that it is identical in all existing FM11RF08S cards. A similar backdoor was also discovered in the previous version (FM11RF08), which showed that the same key is also used in other models from the same manufacturer and even in older cards from NXP Semiconductors and Infineon Technologies.

Quarkslab strongly warns of the risks associated with these vulnerabilities and advises users of the cards in question to check their infrastructure immediately. Many users may unknowingly use Fudan cards, as they are not limited to the Chinese market. In fact, these cards have been found in numerous hotels in the US, Europe and India.