Details of how to hack one of the world's most popular smartcards have been published online.

The research by Professor Bart Jacobs and colleagues at Radboud University in Holland reveals a weakness in the widely used Mifare Classic RFID chip.

This is used in building entry systems and is embedded in the Oyster card used on London's transport network.

Publication of the research was delayed by legal action taken by the chip's manufacturer.

Paper chase

Prof Jacobs and his team first identified the vulnerability in a research paper that was due to be published in March 2008.

However, the release of the article was delayed after chip manufacturer NXP attempted to secure a court injunction against its publication.

The paper was finally released on Monday at the European Symposium on Research in Computer Security (Esorics) 2008 security conference held in Malaga, Spain.

Sensitive data stored on the Mifare Classic chip is protected by a unique number that acts as a key. When the chip, or a card bearing it, is placed near a reader it transmits and receives information based on its key. The security of the system depends on the key remaining secret.

In March Prof Jacobs and his colleagues discovered a flaw in the chip's design which makes those keys easy to calculate and copy.

"Once we knew how the system worked and what the vulnerabilities were, it turned out to be very simple to actually clone cards, steal someone's identity and enter a building as someone else", he said.

After making the discovery the researchers informed the Dutch government and the chip's manufacturer, NXP.

When it knew about the research NXP moved to delay publication by seeking an injunction.

Steve Owen, vice president of sales and marketing - identification at NXP Semiconductors, told the BBC's Click programme that it was motivated to take legal action to give its customers time to update their systems.

"We sought the injunction to cause a delay, not to completely stop the publication," he said.

Mr Owen recommends that the card alone should not be relied upon for secure access to buildings.

"We do not recommend the use of Mifare Classic for new installations," said Mr Owen. "We are working with customers to review their security."

For less than a pound a security expert has got front-door access to a council's internal network.

Andrew Mason from security firm Random Storm bought some network hardware from auction site eBay for 99p.

When he switched it on and plugged it in, the device automatically connected to the internal network of Kirklees Council in West Yorkshire.

Kirklees council called the discovery "concerning" but said its data had not been compromised.

Privileged access

For 99p Mr Mason bought what is known as a virtual private network (VPN) server made by the firm Cisco Systems that automates all the steps needed to get remote access to a network.

Many staff working overseas or off-site use a VPN to connect back to corporate systems.

On powering it his new hardware Mr Mason expected that the device would need network settings to be input but, without prompting, it connected to the last place it was used.

Subsequent investigation found that the internet, or IP, address to which it connected was owned by Cap Gemini, in a range of addresses allocated to Kirklees Council.

"It is like having a long ethernet cable from the Council office to anywhere where I connected the device," said Mr Mason.

A connection such as this allows privileged access to networks. In the wrong hands, such as criminally-minded hackers, it would allow them to conduct reconnaissance and find out if the network had any vulnerabilities worth exploiting.

Internal network access permitted the credit card detail theft from retailers TK Maxx last year and Cotton Traders in June.