The RFID readers story

I've mentioned Radio Frequency Identification (RFID) tags before, mostly in terms of their potential to violate people's expectations of privacy. Those concerns are about the ability of large companies, like, for instance, Wall-Mart, to track details of their customers' purchasing habits. There are, however, a whole slew of other problems with the tags - especially in the realm of the tag's security vulnerabilities.

For those of you who haven't come across them before, RFID tags are tiny sensor chips that emit a burst of radio carrying information when triggered by a reader. Over the last few years the prices have dropped dramatically, making the possibility of tagging individual items a reality. The justification is that it helps shops track their inventory, especially in a situation where the shops are using just in time inventory control.

What is not generally realised is that RFID tags are also being used for a variety of other things, and are starting to exhibit serious security vulnerabilities. Wired magazine recently published a piece about the RFID hacking underground, and it's well worth a look.

The article looks at four or five different cases of RFID insecurity.

The first is a system that uses an RFID based smart card to unlock doors as the owner approaches the door. In this case a 'hacker' was able to read out a copy of the tag's emissions and duplicate them, allowing the hacker (who was employed to test the security of the system) to enter the supposedly secure building. The process of obtaining and cloning the card took only a few minutes.

Then there was the case of a library using a very common RFID chip based system to control the loans of its library books. In this case the chips had been deliberately left 'unlocked', so that extra data could be added later. The result? A system that could be completely wiped by anyone with a few hundred dollars worth of home made equipment that fits into a jacket pocket.

A similar system in a hi-tech German shop called Future Store allowed anyone with similarly equipment to rewrite the prices encoded in the tags - and I doubt that anyone doing so would have made the price higher! Admittedly the shop is an experimental one to show off the possible technologies available for the future. Presumably the demonstration of futuristic shop lifting technologies wasn't intentional!

Still on the data addition and changing, there is the issue of placing data - similar to browser cookies - onto RFID chips, to track the activities of users. Imagine putting a cookie onto the toll pass of someone you wanted to track, and then coming back a few days later and downloading all the information about where they had been. Scary, isn't it!

Or, how about the guys who cracked the RFID encryption in Exxon Mobile's Speed Pass a few years back. Apparently it took only 30 minutes to crack with a brute force attack - something which is supposed to take several hundred years. The crack would have allowed those involved to get free gas at any Exxon gas station had they been so inclined (and who knows who else didn't reveal that they'd cracked the system and took the free gas?).

Finally, of course, there are the much publicised RFID chips that some people have implanted. Yet another security silver bullet for those with more money than common sense. The intrepid Wired reporter had one implanted in his arm. It took only a few seconds for a hacker to read out the ID information and clone it.

So, why bother to clone the human, when you can clone their ID?

http://www.wired.com/wired/archive/14.05/rfid_pr.html

Alan Lenton
7 May 2006

Read other articles about computers and society

Back to the Phlogiston Blue top page