Comprehensive security analyses of a toys-to-life game and possible countermeasures Master thesis - July 2016 Author Kevin Valk Radboud University
[email protected] Supervisor Supervisor Second reader Robert Leyland Lejla Batina Eric Poll Radboud University Radboud University
[email protected] [email protected] Abstract This thesis aims at modeling important attacks on a toys-to-life game using attack-defense trees. Using these trees, different practical attacks are executed to verify the current coun- termeasures and find possible new exploits. One critical exploit led to a binary dump of the firmware, which made it possible to reverse the key derivation algorithm. This led to breaking the security layer that protected the toys. With the key derivation algorithm known, toys could be forged for under a dollar and made it possible to search for unreleased toys and variants. Given the possible attacks, numerous countermeasures are presented to protect games against these attacks and improve general security. The foremost countermeasure is the addi- tion of digital signatures to the toys. This countermeasure makes it infeasible to forge toys. However, this does not stop 1-on-1 clones, but concepts are explored to protect against 1-on-1 clones in the future using Physical Unclonable Function (PUF). 1 Contents 1 Introduction 4 2 Background 5 2.1 Attack Trees.......................................5 2.1.1 Basic attack-defense trees............................5 2.1.2 Quantitative analysis...............................6 2.2 Public-key cryptography.................................6 2.3 Near Field Communication...............................7 2.3.1 MIFARE Classic.................................7 2.3.2 MIFARE Classic knockoff tags.........................8 3 Threat model 10 4 Attacks 14 4.1 Proxmark III......................................