Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/172 Thanks!
Here I am, Matteo Cholera,
the first one of the tool, Matteo.
We share the same first name.
And he is Matteo DeCaro,
and we are presenting these talks to show
you how to build a safe and FC
validating system.
So who
you are, as I
told you before, I am Laura.
Here you can find all my
all the details about my name, my
Twitter. And the same as him, so
I debit on his nickname.
Twitter email.
We are both students and
we are. I'm studying electronics
engineering at the Polytechnic of
Turin and the know if someone of
you knows and
he's studying computer engineering.
But his employer, too at a
cellular network.
If he is a security company
and don't ask me
anything about the numbers after my
ego,
then so what are we dealing
with today?
MIF ultralight thugs.
What are those thugs?
They are designed to work at a target
frequency of thirteen point fifty
six megahertz, and they are designed
by Annex B semiconductors.
As you can see, there is the logo on the
bottom of the slide,
and we are also using
an NFC shield by either
fruit because later
we will show you a test
using those shield because
it is our stamping machine.
So I will show you some facts
and figures about me or ultralight.
How is it composed, for example?
This is the structure of
re-authorized tag.
It is from memory
of 512 bits,
so 64 bytes and they
are arranged in 16 pages.
And here
we will look more in the tail.
And as you can see, the first block
of 10 bytes is
of the first seven
are a number or serial number,
and there is another byte call
internal. The internal is something like
a constant and
depends on the next B
manufacturer.
While the serial number is something
that makes unique each tag,
so each mystery will try to tag
as its own UI the
number. And there are two check
bytes that they are a
result of XOR operation,
but it is not so important.
So they are programed by the manufacturer
and they are read only, so you can't
actually change that field.
Then after this
section, there is a very important
section that is the lock byte.
They are just two bytes
and as you can see, each square
is a single bit, and
those numbers stand for
the number of the page of
the whole ticket.
You can make a read-only, so if
you actually change, you
turn one bit from zero to one
of those log bytes.
You can make a page of the
whole Typekit read only.
And as you can see, there are three
squares which
they have a b o, and
those are used for making
Read-Only the lock beat itself.
So
we will see later how this
could be important in case of
a lock attack.
OK, then OK, bytes can be
edited as you want.
Why that?
Because if
you are going to write something
on those bytes, they are simply
what are you going to write?
Is Bitwise stored?
So if you have a bit
already in state one, you can't
turn back in to zero.
So if you lock a page, it will be
locked forever.
Then there is the most important
sector, I think, in the in the whole
ticket that is the OTB.
It is made of four bytes
and by default they are set
to zero or set to zero.
And it is the only security function.
And if they were used right thugs,
as if you want
to write on the OTP, it's something like
the log bytes. So you have two
or bitwise all the data
you want to write.
And just a note.
It stands for one time programable, not
one time password and
the other in the transportation
system. It is used for storing
the number of lights, right, Celeste?
Why this?
Because if you
consider this section and
if you know that you can
only or the data you want to write
on, you can actually only decrease
the number of zeros of the bits
in this section.
So if it is
by default, you have four bytes or set to
zero. If you want to write data
underneath, you are actually decreasing
the number of zeros.
Speaking about the bits
and why
it is useful for the multiple right
because you are decreasing and
so you can use it for
storing a limited quantity on
it.
As you can see, the number of zero is
decreasing while you are writing
on it.
Then we are looking to the section
of data. Data is the way it
the sector.
You can read and write on it as you
want.
If, of course, the pages
are not locked and
so there are 12 pages, 48 bytes
were to write on.
But um,
where we can?
OK.
Sorry.
OK.
As regards the transportation system
application, you can
you can find here, for example,
the time of the last stamp,
for example, the validation, the
validator Machine ID or
information about the bus line
down on the ground stop.
They can be stored here because it is
readable and the sector,
so it stores a
lot of information.
So, um, some pros and cons
of using like thugs.
Of course, one of the pros is
that it's cheap and it is really
cheap, so if you think about
using for a transportation system,
you have to buy a lot to make, for
example, the multiple ride tickets and
distribute to everyone.
So if it is cheap, I
will personally buy them.
But the other point is
the possibility of creating limited
tickets. So if I want to make
15 rides, take it.
It expires after 15 rides
because the rights are stored in the
OTP. And so, as I told you before,
when you turn all the bits to one,
it is.
You can't do anything more.
And so your ticket is expired.
And so it is good for a transportation
system.
But what the cons
there is no hardware encryption, so
you have to implement a system if
you want to make some encryption to
encrypt your data.
And another con is that
it is not widely implemented,
usually on public
transportation system, so it
could be vulnerable to one of
those attacks.
The rest at the dark lock, a dark
time attack or replay attack, and I will
explain, you know?
So what about those kind of
vulnerabilities?
First one, the rest of that,
it was published in 2011
and expected in San Francisco,
and it works if the rides are stored
in the data sector.
So they are not stored in the OTP
sector, the one I was telling you
before. But in the data sector they want,
which is readable and write about
as you prefer, let's say.
So how to proceed?
Just dump fresh Typekit.
Then when it is expired, you
just write the previous dump on your
ticket.
The data sector is right, the both.
So you can actually write to the same
number of rights you have when it was
new and fresh.
And so just have fun with your
take it. So it is very easy,
but it is hardly a pliable as
it is very well known.
Exploit Tariq Ali speaking.
And
so it is very simple and this
exploit.
This one, the Lock stock, it
has been published in 2013,
so this year and it works
fine if the stamp machine does not check
that a bit of the OTB.
So if their rights are stored
on the RTP sector,
you just have to turn the beat of
Read-Only of the OTB from zero
to one and make it read only.
So stamping machine just
tries to stamp it, but it fails,
and so you will have the same number of
rights left.
So have fun with the IRA because for
life.
And so this is a quick summary.
The stamp machine checks if the
ticket as being stamped.
I don't know, let's say, 90 minutes ago
or a hundred, it depends on the
transportation system.
Then if no, the ticket
is still valid.
Well, yes.
So it is older than that
minutes. And so that machine
tries to stamp that they get
it checks if there are rights left.
No, your ticket is useless.
OK. Yes.
OK. There are rights left, so let's stamp
it. But
it's right that the time stamp right.
Other stuff. And when he tries to
validate and write, the new number of
rights fail.
So there is no feedback way,
and the machine does not know if
it has a stamp that is good or not.
And so you win.
But do not forget
to take one write off because if you have
a five right multiple,
if you have a multiple write ticket with
five rides, you have to take
one off before doing this
procedure because it's not
a good idea to have a fight, writes
Typekit. And still favor over the last
five rights left.
So there is something missing.
So then I forgot this passage.
OK. And this is the time of the stealing
this year and assume you
know where the time of the last stamp
is stored and
the this timestamp is
not encrypted.
So you know, it is in the data
sector and the data sector in readable
and rewritable.
So if you know how to write
the data in that sector,
you can just write by
yourself.
The actual time in the same way.
And so you can invalidate your ticket
without touching the
number of right, the left.
Um, it doesn't change.
And so you are doing this time machine
work, so you have a ticket that you can
stamp whenever you want.
And this is very good
and you are always
a validated ticket.
The last attack just to
our concept because we never applied it,
but assumed that the timestamp
is encrypted and they
are not.
They are used the non universal
parameters. So everything
that is not unique for the thing,
just a key, for example, for Encrypt Your
Ticket,
for example, just use the alias
with a timestamp and the using
a key. You know,
the point is that you can replay the
encrypted timestamp on several tickets.
So if you are, if there are four people
taking that bus, you can just
tap one and share
the result with the other tickets, and it
will still be valid for the
all for tickets.
So it could be
an attack if you don't use
the unique vocal parameters for the
tickets.
So let's come to the conclusion
and of this theoretical part.
And so you have to fix those
vulnerabilities and fix the reset
attack, so rides must not be
stored in that sector as
they could be vulnerable for us at the
back.
Then you have to check the state
of the local beat of the OTP
and in case
not to fall in the
lock attack case.
So to avoid it, you'll have to
check if the Lockerbie state of the
OTB is one of the zero
then to fix the time attack.
You have to encrypt, of course, the
time stamp and to fix
the replay attack.
You have to use a universal
ticket to take, for example, the UIDAI.
That is, you need to call for each
ticket.
And so then
um, he will go on
and explain you the sample, the.
Hello.
OK. And we also
create a sample lib with
which fix all the vulnerabilities with we
find this year there
are a lot of the
sample lib.
OK. Uh, it's just a simple
sample, and that
means that it's not the final year
each vendors should modify it
and use for his own
system because it's very
simple.
OK, these are the functions which
you can find her sample lib.
There is the encryption we use
ice divider,
not them, which
just checks if the ticket is still valid
or not ought to be checks.
If it checks only the
OTP sector is
readable and right about or only read
only the power function is a
power function.
Uh, the one in motto I don't didn't
like it.
Uh, rides
check, check the number of rides left on
the ticket and remove right to remove
the rides.
Um, OK.
These are the basic function for
every secured ticket ticketing system
because and they are not enough.
You will see this later.
It's not. Uh, yes,
this late, OK?
They encrypt the i's function.
Uh, it doesn't require a result.
All right.
In which will be written the
timestamp encrypted,
we use the Unix timestamp
divided by 60
to get the means because usually you
have like 90 100 minutes
of video for each decode and you stamp
it.
Uh, the encryption is ice, uh,
one hundred and twenty eight.
Just some bitcoin
from Silk Road.
And, yes, we buy the
folder is a very strong key
for encryption. You can change it
now.
You can change and
you use also the UID to prevent the
replay attack.
So we just encrypt the timestamp,
plus the UID with the
strong key of a zero one two
three four five six seven and
so on.
Valid or not,
it read, it reads the
the sector from the etiqueta
and check if it's under 100
minutes. This is just fine, but you can
change it as you prefer.
Um, it use the same function of before
to list the 128 the
OTP check.
What did you OTP check is a fundamental
function because the lock attacker is
very, very
useful in almost all cities.
I found it there was
a lock attack in Turin.
If you watch our talk,
there is a lock attack in
Florence, I think, and
also in several other cities in the U.S.
I don't didn't check in German try.
Uh, OK.
Just check if the Autopilot bit is set to
one, is it so it returns
to zero if
it's set to zero zero turns one.
These are just the sample
function.
Which is double.
I don't know why.
OK. Yes, in the sample.
I just use the size of the TV sector.
So just show bytes
so you can have a
maximum 16 writes per ticket.
You can easily change it to get
through right.
Depends on your needed
remove rights. Remove rights.
Just change your OTP sector to
from zero to one.
It means that if you have six rights,
you can have 15.
Just turning one.
Yes. Just turning one zero to one.
And that's then it to check
the number of zeros left to see
the number of rights left.
OK, you need to use the ATP function
check because it's not included in the
move, right? So use of.
Yes, the image of him before.
Let me see if I have a favorite
favored time find writes at
you have always five writes, then
if they control your ticket, they say,
OK, it's stupid, but you have five,
right? That's not good.
That's up in it.
Yeah.
OK. Why?
It's not really, really secure to sleep.
There is some problems with the
NFC in general
and the ultralight.
All the security features are on the
ticket, so you rely all the trust
on the client.
That's usually not so good.
RFID frequency could be jam, so
you can stop all the
validation of your
bass or whatever you want.
And for four
company, you can type a statistics or
something very useful for marketing and
blah blah blah.
This could be enough secure
for little transportation systems or
only bus or something like that, like
the little town like mine.
But if you have a big transportation
system like here in Hamburg or in Turin
or Milan or whatever,
you should use an online database,
online database and Frobisher between all
the stamping machines
here, you should write that you would of
somebody gets so you can check
if someone use the ticket
more than you should
the right left for each ticket.
So you always know how many
rights are left on the ticket.
You can blacklist the tickets for
Akari with the ticket or
update the encryption key for the
stamping machine. So if someone stole
you a stamping machine to reverse
the file more, you can update
a key and say Good
bye to this machine and
you have company stats which are
quite useful.
Now I show you the little example
of a sample lib.
Using this is just an Arduino one
with other fruit and fizzy shield.
If you want to replicate our results,
we will update the sample label.
The sketch of our adrenal
and also the other fruit labor
with some feature to work with
with me favorites, right?
Because it usually works only or mi
plastic.
Don't use me focus.
OK.
Just a second. I don't like Windows.
How does it work?
She's.
OK.
Are we?
Do you see no.
Now you see, no.
And this.
OK.
Open, this means open.
Let's try with the first example.
Which is on the
bend, right?
Should be this one.
Uh, oh, shit.
OK.
Those eyes leave the time and
basically, oh yes, the base64
is just to encode the result of
encryption.
I would like to thank you everybody who
developed these libs because I use them
and patch something
and I don't like.
I don't like to congratulate with the one
who create might met.
Dot H.
Bad delivers for our doing.
OK, let's try.
This is a blank
me favorite writing it.
Just bow first.
The long of.
I hope that works.
Yes.
To be OK.
If I throw it out,
the ticket is still valid because
I just dump it before you give me another
ticket.
I don't know.
Thematic, this is our transport
safety ticket.
Don't look at it. I don't know if there
are some rides left me.
They still worried you could.
It gave me a blank Typekit
done.
Jesus.
The last minute issues.
Jesus.
Just a second, please.
What?
I8.
Oh, OK.
That's right.
OK, now it was
and.
As you can see it, just check if
you saw me fail to write ticket
the number of rights left, remove
a right and stop the ticket.
If you look at the look
at the function, first
of all. Oh, OK,
these rules, OK?
First of all, it checks if it valid
or not, theoretically, then
it checks the OTP.
If you are to be, is rewritable, if not,
exit, then check the number
of rights left.
If it's bigger than zero, it's
gone and then it
removed right. And then the
the the timestamp.
Now just a final example to
read what is written on the ticket.
He also.
I can't.
OK.
Just just to read all the pages on the
record.
As you can see, your trip now is
not zero zero zero zero zero zero zero
zero zero zero zero zero zero eight
zero zero zero.
If you transform it in binary,
there is one zero zero zero zero zero.
Then there is the encrypted timestamp
encoded in base64, divided by
two for performance
stuff and just
one last thing.
If you use an Arduino, you should have
a clock because Arduino
doesn't have a real time clock.
If you and if you unplug it
and plug it again, it was at the
timestamp.
So that's the only problem
with Arduino and the soul
if you have any questions.
Oh yes, just
oh yeah, the.
OK. OK.
And so
if you
appreciated our work, we love bitcoin
and the
donations are accepted if you want to
implement those libraries.
And I don't know, you want to
make a small donation, please
also not donation launch.
Yeah, it's breakfast
and
everything is good.
And and just let us know if
you find any bugs exploited
and something you want to come to next
see to exploit our labor.
Anything?
OK, thank you.
Thank you very much, guys.
And two questions from the audience or
from the single engine.
One question number one.
Yes. Have you considered the threat
of the
Chinese clone guards,
including the
program? Will programable UID?
Yes, there is some prob.
That's why I called our
labor enough secure.
If you use an online database, you
should avoid also this problem because
you have are you with
the owner of every
ticket which are in
whitelist?
So if you have a random we
or our program or who I.D., you
can blacklist it and make it
unusable.
That's why it's enough secure.
It's not completely secure.
Thank you. There is also a project them
of and
very nice guy called
timore something I don't remember,
which last year here at CTC
present an artwork called
The Chameleon.
I think which it's
very useful to emulate Typekit
and change your ID and everything
you want.
We want to meet him if anyone
knows him and ask about
my favorite right support and something
like that.
The question, OK, one final
question,
OK, OK.
Do you have your decrypting
them with the same key every
time you have to pair in
your
sorry, can you repeat
your trip? You are decrypting.
You are encrypting the your DNA
times compare with the same key all
of the time.
So you have the same.
You have different plaintext, the
encrypted of the same key.
You have no ivy or something.
We yes, we use the same
key every time we just change timestamp
the UAW same.
And that's why it's enough secure because
if you have an online database, you can
update the keys.
That's why.
Yeah, but suggest that
if you have, let's say
you use a cat two to two times
and we did dump it every time.
You have to try twice
a try at two
ciphertext encrypted the same key,
which isn't huge security problem.
Yes, you should, if you are.
I don't understand that really.
The question if you want, we can speak
about it after the talk
because we're out of time.
All right.
Let's give them another warm round of
applause. Thank you very much, guys.