Now Available: Smart Card Hacking for the Masses?

At Black Hat this past week, research was publicly unveiled that some commentators say could lead to smart card hacking effectively reaching the domain of script-kiddies.  In a session entitled “Reviving Smart Card Analysis”, Karsten Nohl and Chris Tamovsky promised to “demonstrate a method of extracting application code from smart cards with simple equipment to open the application code for further analysis.”  Mr. Nohl has significant experience with hardware reverse engineering, having been part of the team that broke the encryption used in the chip at the heart of the Mifare card.  The research presented at Black Hat involves the development of a set of tools that allow the Degate VLSI-reverse engineering analysis tool to be used for easily accessing and analyzing the protocols used by smart card chips.  According to the abstract of their presentation, “[t]he protection capabilities of the chips is increasingly used to also keep secret application code running on the devices.”  The abstract ends on a somewhat amusingly ironic note by stating that “[s]uch obscurity is hindering analysis, hence letting logic and implementation flaws go unnoticed in widely deployed systems, including credit card systems.”  Time will tell whether these tools will be used only for analysis of logic and implementation flaws or whether they will lead to actual attacks on smart cards and other chip-based systems.  It does appear, however, that the bar on protecting such smart cards and systems has certainly been raised.