@ AC above
IIRC they were intending to (possibly have) release the research to NXP so they could look at it before they released it publicly.
The solution is simple but costly DON'T USE MIFARE CLASSIC, not only does it use a badly designed proprietary algorithm but an easily manipulated PRNG and ends up with an effective key length of 32-bits, the only thing preventing someone bruteforcing the cards is the reader chips which IIRC (been a while since I read the data) have rate limiting, reverse the protocol and emulate it with an OpenPICC and you're done.
Again, it's been a while but I believe that the standard reader chips from NXP support DESFire cards out of the box, just need a software update to turn the capability on and phase out the MiFARE classic and replace it with MiFARE DESFire, granted 3DES ain't what it used to be but it's peer-reviewed and has a hell of a lot larger keyspace than CRYPTO1 (If it's good enough for ATM's it ought to be good enough for public transport ticketing).
The scary thing is MiFARE classic is still more secure than the products of a few well known proximity access card manufacturers...
Biting the hand that feeds IT
