Cairo Metro cards safe from hacking

Cairo Metro's proposed new smart card system is not at risk from a security hack, the company supplying the smart card chips has told itp.net.

Cairo is due to introduce a new ‘contactless' ticketing system for its Metro by 2010, although researchers have hacked and cloned similar smart cards which are in use on public transport in London and the Netherlands.

Dutch researchers have been able to break the encryption of the Mifare Classic RFID chip used by the card and create copies, leading to fears that bootleg tickets or ‘free' passes could be created for use on public transport.

Smartrac, the manufacturers of the smart card ‘PRELAM' - a pre-assembled card inlay with embedded RFID chip and antennae - say that while the Egypt Metro card will use a chip from NXP, the company that makes the hacked RFID chip, they will be supplying a more advanced version with more security features.

In a statement the company said: "The PRELAM we delivered contains an NXP Mifare DESfire chip. NXP Mifare DESfire chips offer more hardware security features than the standard Mifare Classic chips. Mifare DESfire chips offer advanced encryption functionality such as TripleDES (Data Encryption Standard)." The PRELAMs will be converted by Egyptian Company Masriacard into finished, branded cards, which the Cairo Metro Organization will then issue to passengers.

The contactless card system, which will give passengers an RFID-enabled card that is scanned when passing through ticket barriers, is intended to be faster and easier to use for customers, and to require less maintenance of ticket barriers and other machinery for the operator.

Researchers at the Radboud University in Holland revealed in July that they have been able to hack the NXP Mifare Classic RFID chip, which has been deployed in over one billion cards worldwide, for systems such as public transport and for building access systems. The researchers were able to clone the cards, leading to concerns that criminals could set up lucrative rackets creating fake cards.