Major Backdoor in RFID Cards Allows Instant Cloning

A significant security vulnerability has been identified in millions of RFID cards produced by Shanghai Fudan Microelectronics, allowing for the instantaneous cloning of these cards, which are commonly used for access to office buildings and hotel rooms. The discovery was made by Quarkslab, a French security firm, and detailed in a research paper by Philippe Teuwen. The vulnerability, which can be exploited with just a few minutes of physical proximity to the card, poses a serious risk, especially in scenarios involving supply chain attacks. The affected cards belong to the MIFARE Classic family, widely used in public transportation and hospitality. Teuwen's research revealed that the FM11RF08S variant, released in 2020, was thought to have countermeasures against known attacks. However, he found a backdoor that allows unauthorized access using a common secret key across all FM11RF08S cards. Similar vulnerabilities were also discovered in earlier card generations. Quarkslab has urged organizations to assess their security infrastructure, as many may be unaware that their MIFARE Classic cards are actually Fudan's variants, which are prevalent in various locations worldwide, including hotels in the US, Europe, and India.

- A backdoor in RFID cards from Shanghai Fudan Microelectronics allows for instant cloning.

- The vulnerability affects MIFARE Classic cards used globally for access control.

- Exploitation requires only a few minutes of physical proximity to the card.

- Organizations are advised to check their infrastructure for these vulnerable cards.

- The issue highlights risks associated with supply chain attacks in cybersecurity.