The twenty-fourth Chaos Communication Congress met in Berlin over the last days of 2007. At eleven at night on Friday 28 December, the congress's second day, in Saal 3 and on the hacking track, Karsten Nohl and Henryk Plötz gave an hour's lecture in English under a title that was also a verdict: "Mifare — Little Security, Despite Obscurity". The programme stated the case without ornament. The most widely deployed brand of secure RFID chip rested its security on proprietary and secret cryptographic primitives; the speakers had analysed the hardware of the tags themselves and found weaknesses in several of the cipher's components. Nohl was then a doctoral candidate in computer science at the University of Virginia, Plötz a German researcher.
The chip they took apart measured about a square millimetre and was built in layers. They put it under a microscope, polished the layers away one at a time and photographed each in turn, and drove the card with OpenPCD, an open-source reader built for exactly this sort of inspection. The surface held roughly ten thousand small blocks, and Nohl noticed that they were drawn from a library of only about seventy types of gate; MATLAB scripts, once one instance had been identified by eye, found the others. They then looked for the shapes a cipher makes in a layout: long chains of flip-flops, XOR gates, which control logic rarely needs, and sparsely connected blocks at the edge that were tightly wired to one another.
What the reconstruction gave up was Crypto-1 — a 48-bit linear feedback shift register with a filter function over it. Nohl wrote that the number of challenges needed to recover each key bit with high probability "generally does not exceed a few dozen". Worse, its 16-bit random number generator could be manipulated into returning the same number every transaction. At the congress Nohl said only that the cipher was now known and that the detail would follow the next year; the working attack was held back. Harald Welte, whose OpenPCD project supplied the reader, wrote two days later that a couple hundred million MIFARE Classic tags were in use, in ticketing and door locks. NXP later told The Register it had sold one to two billion cards.
NXP spent months calling the chip a low-end product. Paul de Bot, a vice-president, told The Register in March 2008 that "You need to start this procedure over and over again for each individual card", and that a well-built system would leave no criminal business case in it; only one layer of protection, the company said, had been defeated. A Dutch institute, TNO, had put the cost high and the time at hours a card; Nohl called that "flat out wrong" and said anyone with the weak algorithm could break a card in minutes. NXP announced MIFARE Plus, with AES an option, days before that interview ran. The Radboud University break of the same cipher, and the injunction NXP failed to win against it, are told in July 2008.
The Off Switch
Facebook had launched Beacon on 6 November 2007 with forty-four partner sites. It watched what members did elsewhere — bought a ticket, rented a film, added something to a wish list — and told their friends, a web bug and a cookie doing the work. On 20 November MoveOn.org opened a group and a petition demanding that nothing be published without explicit permission: six thousand members by the next day, about fifty thousand within ten. Facebook replied that the campaign misrepresented the feature and that what was shared reached only a trusted network of friends. Stefan Berteau of CA's threat research group then found that Beacon reported activity by members who had logged off or opted out, and sent addresses and action strings for people with no account at all; Facebook confirmed his findings and said such data was deleted on receipt. Sharing became opt-in in the last week of November. On Wednesday 5 December Mark Zuckerberg posted an apology — "We simply did a bad job with this release, and I apologize for it" — and, with it, a control that switched Beacon off entirely.
At First Glance
On Thursday 6 December 2007 Oak Ridge National Laboratory, a Department of Energy site in Tennessee, said a sophisticated cyber attack over the previous weeks might have exposed personal information on thousands of visitors. The first counterfeit email had arrived on 29 October and at least six more waves followed; about 1,100 reached the network, and in eleven cases an employee opened the attachment, which let the senders take data off the machine. One lure posed as a scientific conference notice, another as a Federal Trade Commission complaint. "At first glance, they appeared legitimate," the laboratory's director, Thom Mason, wrote in a memo to some 4,200 staff. What they could reach was a database of visitors from 1990 to 2004 — names, dates of birth and Social Security numbers — and letters went to about 12,000 people. Bill Stair, a spokesman, said no classified data had been compromised and that of the Jaguar supercomputer there was "no access at all". Mason said the attack appeared part of a coordinated effort against numerous laboratories and institutions, which officials declined to name, and that no evidence showed the data had been used.
No Account in That Name
On 7 December 2007 the Reserve Bank of India issued press release 2007-2008/770 under a title that reads like a period piece: "RBI cautions Public against Fictitious Offers of Remitting Cheap Funds from Abroad". The method needed only a letter or an email. Foreign entities and individuals, sometimes through residents acting as their representatives, offered large sums in foreign currency to people and institutions in India, schools and hospitals among them, as help for a business or venture. Once a reply came, the sender asked for the recipient's bank account details and for a sum remitted as deposit or commission to release the promised money. Some told companies and trusts that funds for cheap loans were already lying in an account at the Reserve Bank awaiting its approval, and produced certificates and deposit receipts said to be the bank's. It kept no such account, the bank said.
The notice also answered people asking leave to remit foreign currency as commission or fees for overseas lottery prizes: remittance in any form for a lottery, or the same thing under another name, is prohibited by the Foreign Exchange Management Act, 1999. G. Raghuraj, a deputy general manager, signed it. The bank issued the same warning again — on 30 July 2009, twice in 2010, in April 2011 under the title "RBI Never asks for Your Bank Account Details", and in February 2012, by which time it was telling the public that nobody from the Reserve Bank telephoned anyone about lottery winnings or funds received from abroad, and that such offers belonged with the local police or the cyber crime authorities. The fraud our India desk tracks now opens with a telephone call, and the six-hour reporting rule arrived fourteen years later.
Random features and deep belief nets
The twenty-first Neural Information Processing Systems conference met at the Hyatt Regency in Vancouver from 3 to 6 December 2007, its workshops moving up to Whistler for the two days after. Monday carried six two-hour tutorials. Geoffrey Hinton took one of the two final afternoon slots, on deep belief nets — models his abstract described as having "many layers of hidden variables", trained a layer at a time out of simpler undirected pieces; Ben Taskar had the other, on structured prediction, and Robert Schapire had opened the morning on boosting. After the opening banquet Luis von Ahn spoke for half an hour on human computation. Also in that year's proceedings was a paper by Ali Rahimi and Benjamin Recht on random features for large-scale kernel machines, which swapped an expensive kernel for a short randomised map; the conference gave it a Test of Time award ten years later, by which time the method had a name of its own, random Fourier features.
Seventeen failures on Windows 2000
On 4 December 2007 The Register reported the results of Virus Bulletin's December comparative, run on Windows 2000: of thirty-two products submitted, seventeen missed certification, thirteen for failing to detect viruses known to be circulating and the rest on false alarms over clean files, the worst in years. A polymorphic file infector did most of the damage. John Hawes, a technical consultant at Virus Bulletin, said self-modifying code was back in fashion and called the result "a shock and a concern"; Trend Micro, Kaspersky, Norman and Sophos were among the failures, and as the magazine tests free of charge and permits no retests, the figures stood as found. That same week Grisoft, the maker of AVG, agreed to buy Exploit Prevention Labs, whose LinkScanner checked the links on a page before anyone followed them, for undisclosed terms, to close by 31 December 2007. Its co-founder Roger Thompson became chief research officer. LinkScanner went into the free AVG edition, where what it did to other people's search results became July 2008's story.
⏳ Time capsule — December 2007
- On 15 December the United Nations climate change conference in Bali closed with the Bali Road Map, a two-year process meant to produce a new climate agreement at Copenhagen in 2009.
- On 19 December Microsoft announced that a pre-beta build of Internet Explorer 8 had passed Acid2, the standards-compliance test its previous versions had failed; the build had rendered the page correctly on 12 December.
- On 23 December counting in the Gujarat state election, voted on 11 and 16 December, gave the Bharatiya Janata Party 117 of the 182 seats and Narendra Modi another term as chief minister.
- On 27 December Benazir Bhutto, a former prime minister of Pakistan, was killed at an election rally in Rawalpindi.
What Obscurity Was Worth
The lesson was not that Crypto-1 was weak but that the secret was never the lock. The full method reached print at the USENIX Security Symposium at the end of July 2008. Nicolas Courtois, Nohl and Sean O'Neil posted an algebraic attack that April which recovered the whole 48-bit key in about two hundred seconds on a PC from one known initialisation vector; Courtois's card-only attack, posted the next March, needed about three hundred queries to the card and, he wrote, some ten seconds with the right hardware. Transport for London began swapping Oyster's MIFARE Classic cards for DESFire from 2010, and NXP issued a backward-compatible hardened version, MIFARE Classic EV1. In 2015 Carlo Meijer and Roel Verdult recovered keys from the hardened cards too, and NXP recommended migrating to products with its later security features. The brand outlived the cipher: NXP counts more than ten billion MIFARE chips sold.
The month's other stories have endings on record. Facebook said on 21 September 2009 that it would shut Beacon down, part of settling the class action over it; the $9.5 million fund paid about $3 million to lawyers and named plaintiffs and founded a privacy non-profit, the Digital Trust Foundation, with the rest, over objections that members got almost nothing and that Facebook helped control the charity. The Supreme Court declined to take the case in 2013. Oak Ridge was phished again in April 2011 — a notice dressed as human resources sent to 530 staff, an unpatched Internet Explorer flaw, the laboratory's internet connection cut at midnight that Friday — and Mason said what it was trying not to repeat was 2007. The same mid-December also produced Mebroot, the boot-sector rootkit told in January 2008.