Australian spec looks to better secure contactless identity credentials

by Graeme Freedman, Principal, DotInDots

Concerns with the security and privacy of contactless smart card technology are nothing new. In recent years, the Internet has caught up with the physical access control industry and the PKI smart card industry, and some ‘dirty little secrets’ have been aired. For those of you who do not believe me, go to your browser and search “RFID hack clone,” “mifare hack,” or go to http://eBay.com.hk (Hong Kong) and search “RFID.”

In a matter of minutes you will find board-level schematics, source code and build-yourself kits that will allow you to clone many of the existing contactless devices used for physical access control and even transit. From eBay you can purchase shrink-wrapped product to clone the cards (with free shipping)! If you are a real nerd, you can Google “OpenPICC” or “OpenPCD” and purchase sophisticated portable devices that pretend they are real cards and readers and mount attacks on advanced smart cards.

None of this is new, but what is new is that a group in Australia under the direction of one of the largest government IT shops and most capable of agencies, have been looking at what to do about it.