Dutch Court Allows Research On Smart Card Vulnerabilities To Be Published

from the good-job dept

We recently wrote about how NXP Semiconductor (formerly Philips Semiconductor) was suing to try to stop the publication of some research that showed some vulnerabilities in its chips used in smart cards around the world. The vulnerability itself was already widely known (though NXP denied it for a while). The good news is that a judge has denied the request, and the research will be published as originally planned. The bad news is that NXP wasted quite a lot of time denying there was a problem instead of fixing the problem -- and with this latest misguided legal stunt, made sure a lot more people knew about it.

Filed Under: obscurity, smart cards, vulnerabilities
Companies: nxp semiconductors

Dutch Chipmaker Sues To Prevent Researchers From Publishing Info About Security Flaws

from the security-by-obscurity? dept

NXP Semiconductors, which was formerly Philips Semiconductor division, is suing some researchers to prevent the publication of a paper outlining the security flaws in smartcards made by NXP. These smartcards are widely used for transit systems and building locks. Of course, the fact that these cards have been insecure has actually been known for quite some time. Rather than fixing the problem, though, NXP spent plenty of effort denying any problem existed. Now that multiple researchers have demonstrated that the problem really does exist, NXP is claiming it hasn't had enough time to fix the problem, and thus is suing to prevent publication.

Of course, if NXP hadn't wasted so much time insisting there was no problem, perhaps it would have been closer to a fix. And, most importantly, those who are looking to use this vulnerability already have access to it. Publication in a journal isn't going to alert criminals -- they already know about it. What it could do, however, is get more researchers helping on a solution. But, apparently, NXP would rather pretend that if they keep the details hidden, they can pretend there is no problem.

Filed Under: disclosure, lawsuits, security, smart cards
Companies: nxp semiconductors