Near Field Communications World » OBB

Mobilkom Austria customers to use NFC tags to access WAP pages

Sarah Clark — Thu, 19 Mar 2009 21:20:09 +0000

The mobile operator has put together a combined NFC handset/NFC tag package for customers that uses the tags to access WAP pages, including an option to buy ÖBB rail tickets.

TAG TRIAL: Innovision's tags will point Mobilkom subscribers at WAP pages to buy ringtones, traffic info and rail tickets

Mobilkom Austria has launched a new package for customers that includes a Nokia 6212 classic NFC phone and four Topaz NFC tags from Innovision Research & Technology.

Each of the Topaz tags is pre-programmed with a link to a particular WAP page, enabling customers to quickly and easily access a page by simply touching the appropriate tag with their phone.

Using the tags, customers can access ringtones, pictures and animations, traffic information and fuel price updates provided by the Austrian automobile club (ÖAMTC) and sports news provided by Austrian sport channel Laola1.

The fourth tag features the link to a WAP page for purchasing the ÖBB Handy-Tickets currently being tested by Mobilkom Austria, ÖBB and Nokia. Participants in the trial simply place their mobile ticket order by touching the ÖBB Handy-Ticket Topaz tag with their NFC phone to receive an electronic ticket, which will be validated via NFC by the train conductor. The Handy Ticket trial is currently running on two routes around Vienna.

Mobilkom has also been working with the eHealth systems team from the Austrian Research Centers (ARC) on a blood pressure monitoring solution that uses NFC to securely transmit patient data over the air.

Last month, Innovision announced it has signed a contract with a leading global semiconductor corporation for the use of its NFC IP in their system devices. The company expects the contract to generate direct revenues in excess of US$10m over several years from a combination of licence, development and royalty income.

This article was first published at www.NearFieldCommunicationsWorld.com.

Related news:

Fraunhofer researcher delivers update on NFC vulnerabilities

Sarah Clark — Mon, 09 Feb 2009 17:08:40 +0000

URI spoofing and redirection — where an authorised NFC tag is replaced with one that points to a resource under a fraudster's control — is still an issue, says security researcher Collin Mulliner.

Fraunhofer Institute SIT researcher and trifinite group member Collin Mulliner has presented an update on his ground-breaking work in potential NFC vulnerabilites at 253C, the Chaos Computer Club's annual hacker convention.

ORGANISED CHAOS: The 25C3 conference was held in Berlin, Germany at the end of December 2008

Mulliner first reported on how NFC phones could be attacked in May 2008 in a presentation at EUSecWest. In that first research, using an early Nokia 6131 phone, Mulliner discovered that it was relatively easy to trick an NFC handset user into performing a harmful operation with their mobile phone without doing anything so complicated as attacking the NFC handset itself.

The potential weak link in the chain is the passive NFC tag, says Mulliner. It's simplicity and low cost is its disadvantage as well as its advantage because it is easy and cheap for a fraudster (or just a trickster) to acquire the tags and to then replace an authorised tag with a fraudulent one of their own.

This means, for instance, that when an NFC handset owner interacts with a tag on a movie poster or tourist information map, instead of the tag performing the expected operation it would instead do whatever the fraudster had set it up to do.

Mulliner's examples of how this could be exploited included:

A tag set to send the browser on a user's handset to a particular website could be replaced with one set to send the user to a different website.
A smart poster could include a tag set to deliver a freephone number to a user's handset. This could be replaced with a tag set to deliver a premium rate number belonging to the fraudster instead.
A tag set to send a free SMS text containing the latest weather forecast could be replaced with one that instead placed an order for a premium ring tone.

Mulliner then took a look at how this all might work in the field, visiting Vienna and Frankfurt to look at both transit ticketing and vending machine applications.

In a group of four vending machines, for example, he identified that the NFC tags on machines B, C and D could be replaced with tags that point to vending machine A. Then, whenever anyone made a purchase at any of those machines, the item bought would be dispensed from machine A — straight into the waiting hands of the fraudster.

Mulliner also looked at the potential vulnerabiities of the existing SMS-based NFC ticketing system on Vienna's Wiener Linien and OBB's Handy-Ticket and also at RMV's Handy Ticket system in Frankfurt.

Mulliner then presented his findings to Nokia who, he says, took them seriously and responded promptly.

The result, he revealed at 253C, is that many of the issues uncovered during the initial testing have now been fixed — but there are still issues. "The Nokia 6212 Classic is not vulnerable to most of the bugs I found in the Nokia 6131 NFC," Mulliner told the audience, "but URL spoofing is still possible."

FOR THE CRACK: Mulliner demonstrates how a malformed URL in an NDEF NFC tag can make the Nokia 6212 show the user one destination while actually loading another

Mulliner presented his conclusions to the assembled hackers and security researchers at 25C3:

Found some bugs in common NFC phone — Bugs are trivial but can be exploited
NFC phones can be attacked in multiple ways — Phishing, malware, worms, denial-of-service
Passive tags are the primary vector for attacks — Maybe make tags tamper proof? Use NFC point-to-point mode (active components on both sides; but these are more expensive)
Users of early NFC services need to watch out! — Basically need to check content of tag every time

If you haven't come across his work before, it's worth taking the time to read through Collin Mulliner's presentation slides (PDF) to gain a full understanding of the issues involved.

And if you'd like to then be reassured that there are ways of fixing the problems Mulliner has identified — albeit by adding a layer of significant complexity to the way things work — Dave Birch of Consult Hyperion has some good ideas on how this could be done.

This article was first published at www.NearFieldCommunicationsWorld.com.

Related news:

Austrian mobile and rail operators develop VDV-based NFC ticketing

Sarah Clark — Tue, 27 Jan 2009 01:25:31 +0000

Mobilkom Austria and ÖBB, the federal railways group, are to field test an NFC system based on Germany's VDV contactless ticketing standard.

NEW GENERATION: NFC tickets beat text messages because they can't be deleted by accident, still work when the phone's battery is dead and can be read even during a phone call

Mobilkom Austria and ÖBB, the Austrian Federal Railways Group, have announced the development of an NFC mobile ticketing solution, based on Germany's VDV-KA contactless ticketing standard.

"This new generation NFC mobile ticketing solution offers enhanced user-friendliness and convenience for both passengers and ticket collectors when buying and managing train tickets," the companies say.

"With Mobilkom Austria's new, worldwide first chip-based NFC mobile ticketing solution, train tickets are no longer sent via text messages to the customer's handset but are saved in the so-called 'secure element' of NFC-enabled mobile phones and can be validated by a simple touch," said Mobilkom's Hannes Ametsreiter.

"Moreover, train tickets will not get lost, even if the SMS inbox of a mobile phone is purged by mistake, and they are always available, even when the phone battery has run out," he added, since the new system enables tickets to be validated with a simple touch of the passengers' and the conductor's NFC enabled mobile phones.

"In addition, tickets can be managed and validated while the customer is having a phone conversation," explained ÖBB's Gabriele Lutter.

A three month pilot project involving 100 test customers and 100 ticket collectors on the Vienna-Krems and Vienna-Gmund routes is to take place, with each participant being equipped with a Nokia 6212 Classic NFC handset. "In the initial stage," the official announcement explains however, "the Nokia 6212 Classic will not be equipped with the new chip-based NFC application developed by Mobilkom Austria as this solution is still in a trial phase."

In future, the announcement continues, "information such as mobile tickets will not be stored on a chip in the mobile handset but on the chip embedded in the SIM card. This will facilitate the switch from one NFC handset to another... The long-term objective is to develop an interoperable system allowing customers to use transport facilities of different providers across countries with one single NFC ticket."

Mobilkom Austria has pioneered a wide range of NFC-based applications from transport ticketing, access cards and micro m-payment solutions supporting, among other things, an NFC trial at the University Campus of Hagenberg in 2006.

The new system is based on the VDV (Verband Deutscher Verkehrsunternehmen or Association of German Transport Undertakings) standard and has been integrated into the Mobilkom Austria mobile ticketing platform.

The development of the VDV standard was driven by the German Federal Ministry of Transport, Building and Urban Affairs to ensure electronic tickets in a range of formats such as smart cards, bank cards and mobile devices would be fully interoperable for use within public transport schemes throughout the country and internationally.

Eight million contactless cards conforming to the VDV standard are to be issued across Germany by 2012 and, last week, VDV Kernapplikations chose Cardag to manufacture the cards using NXP's SmartMX chips.

"Our vision is to provide passengers with a convenient and secure electronic ticket that can be used on any public transport scheme across Germany," explained Jozef (Sjef) A L Janssen, general manager of VDV Kernapplikations and the man in charge of the implementation of the new standard.

This article was first published at www.NearFieldCommunicationsWorld.com.

Related news:

Mobilkom Austria uses NFC to send blood pressure results to doctors

Sarah Clark — Thu, 04 Dec 2008 23:58:21 +0000

The mobile operator is working with an Austrian eHealth research team to develop telemedicine services that use NFC to transmit patient data securely over the air.

Mobilkom Austria and the eHealth systems team from the Austrian Research Centers (ARC) have unveiled a blood pressure monitoring solution that uses NFC to securely transmit patient data over the air.

TAKE IT EASY: A wave of your NFC phone will send your blood pressure results to the doctor

The UA-767 Plus NFC, based on the well established UA-767 blood pressure monitor, enables patients to take their blood pressure at home and then transmit their results to their doctor simply by waving their NFC-enabled mobile phone in front of the blood pressure monitor. The results are captured, encrypted and forwarded by the phone to their doctor's medical database. This not only saves times but also allows for a more precise evaluation of data and a more patient-oriented medical therapy, say the team.

"The 'Keep in Touch' technology not only helps to process data but it also offers a telemedicine service that connects chronically ill patients with their doctors which can lead to an optimization of their therapy," says ARC eHealth systems' Gunter Schreier.

Professor Friedrich Fruhwald of the Graz University of Medicine added: "Based on my first personal experiences with telemedicine I'm convinced that these applications will soon reach a breakthrough, especially for chronic illnesses."

And, says Hannes Ametsreiter, Mobilkom Austria's chief marketing officer, "The high degree of consumer convenience behind this service is what convinced us to join this project... As the Austrian innovation and market leader in mobile communications, it was a logical step for us to support the research work of the eHealth systems team of the Austrian Research Centers by providing our technological know-how, supplying the necessary technical equipment and contributing additional budgetary resources."

NFC-enabled phones have been commercially available in Austria since September 2007 when Mobilkom Austria launched a commercial NFC service in conjunction with NXP, Nokia, ÖBB (Austrian Federal Railways) and Wiener Linien, Vienna's main public transport provider.

This article was first published at www.NearFieldCommunicationsWorld.com.

Related news: