Wow.
“The Texas Instruments DST tag is a cryptographically enabled RFID transponder used in several wide-scale systems including vehicle immobilizers and the ExxonMobil SpeedPass system. This page serves as an overview of our successful attacks on DST enabled systems.”
“The encryption algorithm used in the TI DST tags is an unpublished, proprietary cipher that uses a 40-bit key. The algorithm was designed in the early 1990’s by engineers at Texas Intruments, but is still being deploying in current systems. By today’s standards, a 40-bit key is unacceptably short: advances in computing power have made such keys succeptable to brute-force key guessing attacks. Therefore, the actual security of the DST system rests with the secrecy of the proprietary algorithm used in the tags. One of the most important principles in cryptographic design states, however, that the security of a system should be based only on the secrecy of the keys, never on the secrecy of the algorithm.”
There are videos of these guys hotwiring a car and stealing gas from a pump.
Oh, and as always, thanks to Boing Boing.
