|
|
Log in / Subscribe / Register

Fun with RFID tags

The various privacy implications of widespread use of radio-frequency identification tags have been widely discussed. This eWeek article, reporting on a Black Hat Briefings session, brings up a new issue. It seems that the portion of most RFID tags which holds the product code is rewritable. Anybody who can haul a suitably equipped system into a store can rewrite the tags at will, creating no end of opportunities for confusion and theft.

According to the article, things go even further than that:

And there's an even worse scenario: "It is only a matter of time before someone puts a root exploit on one of these tags and hacks into your supply chain," Grunwald said.

That scenario seems unlikely; the capacity of an RFID tag, and the uses to which the tags are put, do not afford many opportunities for the injection of shell code into point-of-sale systems. But, then, somebody might just pull it off.

The real security risk is the number of systems which will be programmed to believe what their RFID readers are telling them. It is surprising that a device meant to be used as an identification token is rewritable in this way. It should not take too long before troublemakers with RFID writers convince the retail establishment that this was a bad decision.


to post comments

Fun with RFID tags

Posted Aug 5, 2004 20:55 UTC (Thu) by alarsen (subscriber, #4585) [Link] (1 responses)

> Anybody who can haul a suitably equipped system into a store can
> rewrite the tags at will

That's only true if the systems designer hasn't done his/her job;
the memory of the very popular ISO 15693 tags can be protected once the
application data has been written, effectively turning the read/write tag
into a read-only tag (the protection, once set, cannot be lifted).

Fun with RFID tags

Posted Aug 13, 2004 10:28 UTC (Fri) by irios (guest, #19838) [Link]

Perish the thought what can anybody equipped with a suitable barcode printer do in
any store *today*!

Not only can RFID tags be rendered read-only, but each has a unique ID code, which
with the help of a little cryptography may be used to digitally sign the item.


Copyright © 2004, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds