|
|
RFID credit-card attack demo'd
Author: Gareth HalfacreePublished: 22nd February 2008
The attack can be carried out with off-the-shelf hardware and freely available Python scripts.
Asking for a volunteer from the audience who had a smart-card on or about his person, hacker Laurie waved his magic RFID reader at the suddenly famous attendee and suceeded in popping their name along with the account number and expiration date for their RFID-enabled American Express credit card up on the big screen – without ever touching the man in question or even removing the card from his wallet.
Laurie has spoken to American Express in the past and voiced his concerns over his ability to read card details remotely. The company's response? “We are comfortable with the security of our product.” I wonder if their customers are quite as comfortable right now.
In mitigation, the company issued a statement that the account number visible from this magic-wand attack isn't the same as the one on the front of the card, but Laurie has countered with reports that the account number is still valid for on-line transactions. Which isn't very reassuring.
RFID tags – tiny chips which use the power gained from a radio field of a particular frequency to broadcast stored information – are popping up pretty much everywhere these days from pets (stores a unique identifier so lost pets can be returned to their owners) to clothes (allows for efficient tracking of stock levels and for theft protection), but the worrying trend is for rather more valuable items to come equipped. Anyone who has renewed their passport here in the UK in recent years will be familiar with the sight of an RFID chip attached to a full-page size antenna which contains the full details of the passport – including a digital photograph of the owner. The sort of information, in fact, which would be of interest to identity thieves who must be rubbing their hands with glee at the thought of being able to harvest personal details from anyone who walks within a ten meter radius of a scanner.
Laurie makes the tools he used to carry out the attack available to interested parties on his website. Until such a time as companies start taking the security of contactless data transfer more seriously, I would recommend lining your wallets with tinfoil: it's not just for blocking out the alien mind-rays, y'know.
What's your take on this: a plausible attack that could take the place of traditional mugging – hey, at least it's violence-free – or just a curiosity with no real risk attached? Share your thoughts over in the forums.
Related articles on bit-tech.net
Comments (22)
Stats: 0.117 seconds
But...
But...
The banks say that the security in these credit cards is hacker proof!
Seriously though, I don't want anything like this in my credit card. It took me long enough to accept a home wireless network, without having a "contactless" credit card in my wallet. If I do get sent one, it's going straight back.
"If you can't scratch glass with it, I don't accept it" - Zanywoop, HHGTTG.
Andy
How couldn't they be? They've probably spent a couple hundred bucks developing it! :D
How about setting up a scanner near an American Express office, picking up the account numbers of all the employees and executives and sending the data back to them and to the press at the same time? Let's see how comfortable that will feel...
why would you want a wireless credit card anyway. Who is so lazy they cant b bothered to swipe it or stick it a card reader..... I can understand using it for less important data, but come on my bank account? dont think so....
Having the Oyster card built in is good though, cuts down on the number cards I have to carry around :)
WTF? they are comfortable with that?
how can they be comfortable with that? do they have an internal guideline that no employee should use their own products or why do their employees not care? or is it just a marketing stunt to downplay the problem? (the second theory actually sounds more plausible).
I only use a visa when I have to. and none of this fancy RFID ****.
though the best wallet lining wouldn't be foil, but brass mesh. Faraday cages FTW!!!!!
Serously though, is anyone really surprised that the big companies are about ten steps behind the determined hackers with this? The irritating thing is that with passports, you don't have a choice, you have to accept one with this technology, at least with a credit card you can opt to use one without it.
I can see a nice little aftermarket sideline opeing up here, wallets, credit card holders and passport wallets that are guaranteed to be RF shielded until you open it.
This is the simplest solution around and the credit card companies should be shipping these with the cards so you don't have to buy them.
This is the simplest solution around and the credit card companies should be shipping these with the cards so you don't have to buy them.
This is the simplest solution around and the credit card companies should be shipping these with the cards so you don't have to buy them.
An interesting anecdote for you.
When London Transport was originally trialling the Oyster pre-pay system, they were intending to put the "Reader" around the entrance doorway, so it'd read the card (And debit the card) as you got on without you having to do anything. However, in initial runs the sensitivity was a little high, so everytime an Oyster-equipped bus passed a queue of people, it would subtract a fare automatically from their cards as it drove past.
For "Staff only" areas of LT buildings, they are using "Around-the-door" detectors to tell just how long staff are taking on breaks and the like. However, my father found a neat solution to that. He uses a stainless steel business card holder (a couple of quid), which is the perfect size for storing credit-cards, and when closed, forms a perfect faraday cage around the card, blocking all signals out. So why bother with these pesky "RFID Blocking wallets" when a simple business card holder does the job just as well? :)
first thing to do i guess is destroy the RFID device in the passport or card at least with the Chip and pin idea thay need to have the card at least
edit: not the people that hacked the thing, i am referring to the people creating and using the thing and shoving into other peoples asses....
I don't know if you mean it litteraly or not, but tampering with the rfid in your passport might just make those people at immigration just a tiny bit suspicious..
I see chip and pin as more of a convienence than anything meaningful in terms of security. In the end nothing will stop a determined thief!
So, how to go about this? 2 Sec's in the microwave?
:D