Slashdot Log In
RFID & Viral Vulnerability
Posted by
CmdrTaco
on Wed Mar 15, 2006 10:04 AM
from the alliteration-is-fun dept.
from the alliteration-is-fun dept.
Arleo writes "Student Melanie Rieback and others, part of a Tannenbaum research group in Amsterdam, have proven that RFID-tags are vulnerable for infection with viruses. In a research paper titled
"Is Your Cat Infected with a Computer Virus?" is shown how an altered RFID tag can be used to send a SQL injection attack or a buffer overflow. They describe on the rfidvirus.org website possible exploits of this types of viruses: from altering the backoffice of a supermarket to spreading RFID viruses by infected bags on airports."
Related Stories
[+]
Technology: Real RFID Hacking Scenarios 180 comments
kjh1 writes "Wired is running an article on RFID hacking that has potentially scary implications. Many RFID tags have no encryption and will happily transmit their information in the clear if they are active or within range of a reader. Worse yet is that they can be overwritten. Some interesting scenarios and experiments: snagging the code off of a security badge and replaying it to gain access to a secure building; vandalizing library contents by wiping or changing tags on books; changing the prices of items in a grocery or other store; and getting free gas by tweaking the ExxonMobil SpeedPass tags."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Bright Future for RFID malware. (Score:5, Insightful)
Fascinating stuff, but it seems that the game plan for protecting against RFID malware is basically the same as protecting against more traditional malware...namely, enforcing proper bounds checking, enforcing proper database permissions heirarchies, disabling back-end scripting languages, isolating the vulnerable RFID middleware server in a proper DMZ environment, etc.
In other words, RFID malware has just as bright a future as the more traditional flavor, since most developers and administrators can't be bothered to take these elementary precautions.
Re:Bright Future for RFID malware. (Score:4, Insightful)
Parent
Re:Bright Future for RFID malware. (Score:4, Insightful)
I see a real threat for anonymous attacks:
Attacker buys RFID-tracked product at store.
Attacker alters RFID-tracked product to allow for attack.
Attacker returns the product to the store shelf and waits...
Joe Sixpack checks out with infected product.
Clerk scans product and infects store database.
All prices for all products now set to $0.
Parent
Re:Bright Future for RFID malware. (Score:5, Insightful)
Not true. The article specifically mentions potential SQL injection attacks, which are not caught by a simple length check. Also, you are assuming that the tag contains nothing more complex than a single ID number. As the complexity of the data in the tag goes up, so does the complexity of the parsing code for that data. Take for example including a picture of the owner in the RFID tag inside of a passport. Now the outside data is being fed to a some type of image decompression software with all sorts of opportunities for vulnerable bugs. Not only is image data likely to be a component of lots of RFID data, image decompression routines have historically been fertile ground to exploitable code bugs.
None of which is to say that the problem isn't manageable, but just that it's a lot more involved than a single length check. In fact, it's that kind of thinking which leads to vulnerable bugs. "Hey, this 1KB of random data is the right length, it must be OK. No need to worry about bugs anywhere else in the system." Riiiight.
Parent
Re:Bright Future for RFID malware. (Score:5, Funny)
I'll have too explain my dad to not to download whatever crap on internet, never reply yes when a crap want to install something without asking me first and now
I need to ask him to check the ServicePack version on his six-pack and explain him that bringing russian vodka home can wipe out his harddisk when he turns the TV on?
Parent
Fir Trees? (Score:3, Funny)
American oak tree research groups and Swedish aspen tree research groups have responded by working around the clock to fix this security hole. Never before have groups centered on deciduous trees been so involved in computer security.
Mighty If-fy (Score:5, Insightful)
From rfidvirus.org: Here is where the trouble comes in. Up until now, everyone working on RFID technology has tacitly assumed that the mere act of scanning an RFID tag cannot modify back-end software, and certainly not in a malicious way. Unfortunately, they are wrong. In our research, we have discovered that if certain vulnerabilities exist in the RFID software, an RFID tag can be (intentionall) infected with a virus and this virus can infect the backend database used by the RFID software. From there it can be easily spread to other RFID tags. No one thought this possible until now. Later in this website we provide all the details on how to do this and how to defend against it in order to warn the designers of RFID systems not to deploy vulnerable systems.
So to sum up, if some programmer doesn't do his/her job, the RFID tag they plan on implanting in our passports could be used as delivery devices to compromise computer systems around the globe.
I'm going to rate this a pretty big if, though, as we know from all the patching going on, the probability is very high. RFID software is going to have to be thoroughly tested and watched like a hawk. Undoubtedly there's going to come a point where if one or two of these viruses get out and something newsworthy happens (airport computers crash, Citigroup gets credit card data stolen, etc.), the whole idea of RFID tags everywhere is going to get a serious black eye.
Awesome line (Score:4, Funny)
Free beer anyone?
user input (Score:5, Insightful)
But ofcourse there are nowadays lots of websites which are vurnerable for sql injection and similiar hacks. Even google had a cross site scriptiog exploit.
Pure FUD (Score:4, Insightful)
I can see a buffer overflow if your rfid is capable of generating a string massively larger than a normal rfid.
Outside of a SQL injection to get past a really poorly designed RFID reading application or plain stupidity in the RFID reading software part I can not see any way for a RFID to get the host reading PC to execute the code inside it.
Not pure FUD, just facts. (Score:5, Insightful)
Not 'evil', just dumb. RFID reader is an insecure input device like any other, and you don't even need physical access to use it. But it seems nobody thought of preparing a barcode that could crash the cash register, recording a magnetic card that would infect the security system, etc. Some devices are thought to be too simple to mean danger - wrongly. I remember some old Atari games that would crash or misbehave if you'd open the joystick and pressed "left" and "right" simultaneously. I burnt electronics of a RC toy car by telling it to go forward and back at the same time. Got a motorbike to run backward by starting the engine by pushing it backwards. Managed to crash my cell phone by buffer overflow at battery load level sensor (it WAS a software failure!) Got a CD tray to stop halfway by simultaneously pressing the eject key and sending eject commands from the computer.
A toggle switch can be ballanced in the middle position. A pushbutton can be softly pressed make a spark-gap. Unconnected lines can be shorted. Even a single-bit input device cannot be trusted.
Parent
overhype (Score:5, Insightful)
This really is no different than replacing the barcodes on packages.
Tom
RFID Viruses? Excellent! (Score:4, Funny)
You almost have to be an insider FIRST (Score:4, Interesting)
In this case, it seems to me that if you know enough about both ends of the process, sure, you can develop some method to penetrate the system. Most malware authors have the benefit of working on a very well-known platform - the Windows PC - with known software (one of the limited numbers of email or browser programs). But attacking a back-end system like this is a much more dicey proposition - each large corporation probably will have its own back end, and may be running any of a dozen OS-and-database combinations.
So to benefit from this attack, it seems to me that the author has to be an insider to stand a ghost of a chance of success. If he's an insider, there are MUCH easier ways to penetrate the system.
As a result, while I have great concerns about RFID, this strikes me as FUD.
1) Develop complicated, application-specific RFID attack that would never be real-world useful
2) Write research paper spreading more fear about RFID
3) PROFIT! (or at least get a lot of attention)
Re:You almost have to be an insider FIRST (Score:4, Insightful)
"A lot of good comments have already been made here, but I'm surprised nobody has commented yet on something that seems obvious: if you're going to hack into a system, you have to know a little bit about the system first."
You're 100% right, but there will emerge from 1 to 3 dominant vendors of backend RFID systems, and they will be deployed in many places, many people will have knowledge of these systems, and help to learn about their underlying architecture will likely be found right on the vendor's website, or only a couple Google searches away. Like every other system out there, there will be a few weird custom jobs, but most of it will be off-the-shelf software that thousands of organizations use.
Today's theoretical often winds up being tomorrow's practical.
Parent
Re:Virus? I think not. (Score:4, Interesting)
If the SQL injection or buffer overrun instructs the middleware system to overwrite all RFID tags subsequently scanned with the exploit code, that's pretty self-replicating, isn't it?
Parent
Re:Virus? I think not. (Score:4, Informative)
From the linked pdf: To prove our point, this paper will present the first self-replicating RFID virus.
So, um, yeah. Maybe, just maybe, you should RTFA. I know, I know. Pipedream.
Parent
Re:My question is why? (Score:5, Insightful)
Parent
Re:My question is why? (Score:5, Insightful)
1. Inventory, beeing able to know what is in your store and where it is in a retal setting.
Actually, according to a recent study, RFIDs are only about 90% accurate at best, for large palettes whizzing by on conveyor belts in a warehouse setting.
2. Convinence, things like being able to park a cart next to a teller and have all the items charged instantly.
See #1. I don't know any retailer that would abide by less than 99.999% accuracy. RFID does not meet this requirement at all.
3. RFID is already used sucessfuly for tracking pets and could be used to store medical data in people with alergies or other specal medical requirements, along with other personal data if the individual choses.
Let me say I'm scared of some of the potental abuses to, but there are upsides to this.
Now you're getting to the real meat of why some want RFID to take off. It's much easier to convince someone to accept an injection of a little chip than to be tattooed with a bar code, Henry Rollins not withstanding.
While it may be beneficial, the very reason it's beneficial is also why it's bad in an Orwellian sense. There is no way for this to be beneficial without the bad. You can't cover up an RFID, or make it inoperative, without impairing its usefulness when needed.
Parent
Re:My question is why? (Score:4, Insightful)
See #1. I don't know any retailer that would abide by less than 99.999% accuracy. RFID does not meet this requirement at all.
If you think this is true, you need to check your receipts and count your change more frequently.
I've never seen a shop that manages 99% accuracy... the clerk fails to scan an item (doesn't notice it didn't beep), the item is in the database with the wrong price, the item scans twice, the item is missing entirely (so the clerk asks you to give them the price)...
99.999%???
Parent
Re:My question is why? (Score:5, Interesting)
Problems we've had (in talking with the engineers):
1. Our product is in metal containers (within cardboard). Bad for RFID.
2. Placement is CRITICAL. Especially in a plant environment, you need to know where the RFID tag is so you can read and write it quickly; in addition to minimizing #3
3. Outside RF. We've had instances to where in a test lab, we can read and write and verify the write within 80ms, as a box is cruising by on the conveyor. Once we transition to the plant, however, it gets a little more shaky, as you have less control over where the conveyor motor is, more flourescent lights, and oh yea, there's still those damn metal cans.
RFID has a long way to go from what I've been told by our engineers. It's not as dead simple as you might think -- of course, for handheld scanners though, which require human intervention - may be 10 times easier since humans can modify the environment to see fit on the fly.
Parent
Re:Will this affect me? (Score:4, Insightful)
I think what he's asking is: does the badge record the leaving time as well as the arrival time? This is a problem where I work as well...the badge records when you come in, but doesn't record when you leave, so it doesn't matter if you stay late to finish a project...all the management cares about is when you got there in the morning.
I don't work late anymore.
Parent
Re:Porterhouse steaks at last! (Score:5, Insightful)
Yeah, it drives the credit agencies nuts because they can't track my credit history because I almost never have a credit bill (excluding my monthly ISP charge). The best they can do is see that I pay all my bills (electric, cable, etc) on time.
Merchants are certainly stymied because they can't gather enough information on me so they can't send me their snail mail spam.
No, I'm not paranoid. I just hate debt. Debt is evil. It sucks the life out of ones finances and inhibits the accumulation of wealth.
Granted, the current administration doesn't understand this but that's a whole other issue.
Parent
Re:Porterhouse steaks at last! (Score:4, Insightful)
In 5 years you won't get anything at a huge supermarket chain anymore without card. Won't work? People will refuse to shop there? Think of some of the huge outlets that only let you IN when you got a card and go figure.
Parent
Re:RFID Software vulnerabilities (Score:4, Informative)
I'm not sure you understand how RFID tags work. There are a variety of standards on how RFID tags are encoded, all of which break down into partitioning the tag's data into segments to form the unique identifier
For the sake of argument I'll use EPC SGTIN96. In the SGTIN tag has four partitions: Filter, Company Prefix, Item Reference, and Serial Number. Each of these fields is of varying size depending on how big tag is. Typically RFID tags are 96 bits (although some tags can get up to 1Kbit), even using 7 bit ascii there's not a whole lot you can fit in 96 bits. When I poll the reader, or the middleware I'm getting back a number, e.g. 12345 and it's my responsibility to parse through that number to get the fields I'm interested in. In this scenario I would have to be doing some *very* sloppy programming to open myself to an SQL injection attack (something along the lines of treating known numeric data as a string).
ISO and EPC Gen 2 tags do support custom data, which I suppose could be used to store strings but since it is severely space constrained (typically in the range of 2-32 bytes) I question the viability of such an attack. Not to mention that the field will likely be used to writing in ids instead of human readable data. Finally, it is common to encrypt the custom payload on an rfid tag. So even if somebody were to change it to "AND 1 = 1" it would be caught when the program tries to decrypt the tag.
Parent