The OV-Chipcard, which is already being tested in Rotterdam, is expected to replace paper tickets on all trains, buses and trams.
But a new report from researchers at Royal Holloway, University of London (RHUL), backs up earlier claims that the Mifare Classic chip used in the smartcards can be hacked.
The publication supports findings by Dutch business organisation TNO, and has apparently led opposition parties in Holland to call for a complete halt of the card’s development.
Earlier this week, two German computer engineering students claimed that any of the 10 million Oyster cards in circulation – which use the same technology – could now be cloned in less than 10 minutes using a standard PC and card reader. The cloned cards could then give fraudsters unlimited free travel.
As early as last February TNO said it had “unreservedly concluded” that the Mifare chip used in the cards would have to be replaced and that preparations for migrating to a more secure chip should begin immediately.
Karsten Nohl, one of the men who claims to have hacked the card, told Australia’s Brisbane Times that he could crack the CRYPTO1 encryption in as little as 12 seconds.
“The Mifare system was marketed as having advanced levels of protection, proved security and that’s what people thought they had a few months ago and now our research has shown them quite the opposite,” he said.
Estimates suggest as many as a billion passengers use the technology to pay for their journeys, with major cities like London, Washington and Brisbane all signed up.
Dutch company NXP, which manufactures the Mifare Classic cards, said it was taking the claims very seriously.
A spokesperson said, “NXP has established an open dialogue with the researchers and is evaluating possible attacks”.
