French security firm Quarkslab has uncovered a critical security flaw that affects millions of RFID cards worldwide. Their research reveals a hardware backdoor in these smart cards manufactured by Shanghai Fudan Microelectronics Group, one of China’s leading chip manufacturers. This backdoor allows for split-second cloning of RFID cards, which are used to open doors in offices, hotels, and other facilities.
The RFID Cards Vulnerability
The FM11RF08S variant released in 2020 was marketed as having enhanced security features to prevent card-only attacks. However, Quarkslab researcher Philippe Teuwen discovered that these cards contain a hardware backdoor that allows unauthorized authentication using a now-exposed secret key. Most concerning is that this key is identical across all FM11RF08S cards, highlighting a significant RFID Cards Vulnerability.
The attack requires just minutes of physical proximity to clone an affected card. More alarming is that entities capable of executing supply chain attacks could potentially perform these cloning operations instantaneously at scale.
Widespread Impact
The vulnerability extends beyond the Chinese market. These cards are widely deployed across:
- Hotel chains throughout the US, Europe, and India
- Office building access control systems
- Public transportation infrastructure
- Various commercial facilities
The RFID Cards Vulnerability is particularly concerning because many organizations may be unaware they’re using compromised cards. The FM11RF08 and FM11RF08S chips are often sold under different branding through various suppliers.
Technical Details
- The research revealed multiple critical issues:
Vulnerabilities that enable hackers to identify secret keys when they are used across at least three sectors or cards. - A hardware backdoor allowing authentication with an unknown key which was then discovered to be identical across all cards.
- Similar backdoors in previous generation cards (FM11RF08, FM11RF32, FM1208-10).
The discovery of this widespread RFID Cards Vulnerability serves as a stark reminder that even established manufacturers can introduce critical security flaws. To avoid these attacks, organizations must regularly audit their RFID infrastructure, continually patch and update software, and monitor security alerts. Finally, they must be prepared to act swiftly when vulnerabilities are discovered.
Cyber Shield Alliance can help protect your organization against RFID card attacks with expert planning and implementation of crucial security measures. Contact us today to get started.