What is RFID?
RFID tags or (Radio Frequency Identification Tags) are data chips that house unique identification information on them that can then be read by an external data reader through the use of radio waves. RFID technology is currently being employed in a number of everyday products such as building ID cards, credit cards, and e-passports (biometric passports) that are remotely accessed when held near a reader. These no-swipe cards provide a contactless transaction in which the user only has to hold the RFID enabled card near the reader to access the data on the card.
What is the Problem with RFID Technology?
Though RFID tags are convenient for corporations looking for fast building access, consumers seeking speedy purchases, and travelers who are leaving the country, they have been electronically copied by hackers who can skim information off of the tags from feet away. RFID tags are a concern for anyone who beeps into an office building, at a grocery store, in a cab, or at the airport - leaving vulnerable your office building, bank account, passport, and identity.
The Problems
1. Information stored on most RFID cards can be read by anyone with a cheap receiver. A security researcher quotes on his website "it's quite practical to read someone's card without removing it from their wallet. A bit of deliberate clumsiness, a reader up my sleeve, and I would have little trouble cloning anyone's card.
2. The activation range of standard RFID tags can be extended significantly. This results in the ability to attack RFID technologies at greater distances. Two college students were able to extend the range to 69 feet!
3. RFID cards can be copied with minimal effort after being read by an attacker. Video of an attack on the speedpass.
4. The encryption methods on most RFID cards are proprietary. They often rely on security through obscurity. Reseachers have already exploited this design flaw and broken a real world system. Video of how encryption was broken.
5. RFID technology can be used as a tracking mechanism.
6. Several consumer privacy organizations have been concerned with insecurities and abuses of RFID technology. Some institutions have rolled back usage of RFID technology because of the above concerns.
How can I tell if I have an RFID tag in one of my cards?
RFID tags are used in a number of personal identification cards including government ID cards, numberous credit cards (like the Chase blink card), building access cards, and e-passports and drivers licenses. If you "beep" your card without it touching the reader at your office building, the grocery store, the airport, and a growing number of other places, your card is being wireless activated and contains RFID technology.
What are others saying about RFID insecurities?
RSS News Feed
MIT RFID Privacy Conference
There was a full day conference at MIT about RFID privacy concerns.
PrivacyRights.Org
Tags can be read from a distance, not restricted to line of sight, by readers that can be incorporated invisibly into nearly any environment where human beings or items congregate. RFID readers have already been experimentally embedded into floor tiles, woven into carpeting and floor mats, hidden in doorways, and seamlessly incorporated into retail shelving and counters, making it virtually impossible for a consumer to know when or if he or she was being "scanned."
Association of Corporate Travel Executives
The thought that your travel documents could be broadcasting your nationality to those with an interest in harming U.S. citizens is bad enough," said ACTE President Greeley Koch. "But it could also be pinpointing likely targets for pickpockets, thieves, and even providing information to steal.
Business Travel Coalition
The Coalition urges the State Department to heed the concerns and advice of privacy and security experts from the U.S. and around the world. Current barcode technology represents a superior and tested alternative to RFID use. Moreover, there are other “contact” technologies that would prevent the broadcasting of Americans’ identities to those who would do them harm.
Spychips.com
Spychips make Orwell's Big Brother seem relatively harmless." In "Spychips," Albrecht and McIntyre prove that the RFID industry's claims that their tags would not be used to track people are total lies. They do so by excerpting patent applications made by the some of the biggest proponents of RFID: transnational corporations such as IBM (patent application # 20020165758 -- IDENTIFICATION AND TRACKING OF PERSONS USING RFID-TAGGED ITEMS), Procter & Gamble (patent application #20020161651 -- SYSTEMS AND METHODS FOR TRACKING CONSUMERS IN A STORE ENVIRONMENT) and Philips Electronics (patent application # 6,611,206 -- AUTOMATIC SYSTEM FOR MONITORING INDEPENDENT PERSONS REQUIRING OCCASIONAL ASSISTANCE).
RFID Related Videos
Clonning Passport card RFIDs in bulk for under $250
Mifare Hack
RFID in U.S.Passports 10 pm News Story
The Secret of Skimming
Vulnerabilities in First Generation RFID
Cloning RFID Tags in Sacramento
