Slashdot Mirror
RSA Creating RFID Blocker Tag
burgburgburg writes "RSA is introducing a new RFID cloaking system to guard secret data. The RSA Blocker Tag technology uses a jamming system designed to confuse RFID readers and prevent those devices from tracking data on individuals or goods outside certain boundaries. At its security conference, RSA demonstrated the blocking technology in a pharmacy setting. The pharmacist provides your prescription in a special bag with the Blocker tags. When the drugs are in the bag, RFID readers are blocked. Take them out, they're readable. The tags work by emitting radio frequencies that fool RFID readers into thinking they're receiving unwanted data, causing them to shun data from that source. RSA promises that this new technology will not interfere with the normal operation of RFID systems or allow hackers to use security technology to bypass theft-control systems or launch denial-of-service attacks." Maybe it's just me, but this seems to not address any of the important RFID issues at all.
OK paranoid people, now you've got something to line the inside of your tinfoil beanies!
I guess soon we will all want to start using lead paint again on our houses.
Now I can stop wearing all this aluminum foil!
I see a new business opprotunity! Several states decided a while back to make a profit off of the backs of the citizens by selling government databases to spa^H^H^H marketers. One of those databases was the registration data from the DMV.
Combine that with RFIDs scanned as they leave the store, returning to the car, and I think we will have an incredible insight into the nature of those people's purchases. I'm sure some clever individuals will be able to build a portable scanner and have some underpaid kids key in the corresponding plates... won't this be wonderful!
Sig under construction since 1998.
After this, of course, Wal-Mart comes up with the RFID-blocker-blocker. And then RSA develops the RFID-blocker-blocker-blocker. And so on.
So what keeps someone from sneaking DVD's out of a store in one of these magic bags?
Cube On! (http://stores.ebay.com/PuzzleProz)
RSA promises that this new technology will not interfere with the normal operation of RFID systems or allow hackers to use security technology to bypass theft-control systems.
I think this kind of technology is asking to be abused. Just like the cell fone signal jammers.
Consensus is good, but informed dictatorship is better
So once stores are using automated RFID-reading-Visa-charging tills instead of employing humans, you be able to get one of these bags, fill it with goodies, and walk out without paying?
Sounds good to me.
SteveB.
I hope they start selling a t-shirt with a giant version of those tags printed on the front.
I probably would wind up getting sued. I guess you have to have a business plan to be able to jam signals without fear of prosecution (mostly kidding here).
It does seem like a reasonable application but, as the story says, isn't intended to address the broad range of objections. Still, protecting privacy of medical information is a step in the right direction... and what's to prevent me from applying it elsewise?
Why not simply make the bag out of a material that simply dampens radio signals, opposed to sending out additional, confusing signals? It's a technique used to keep security sensors from detecting RFID security tags. And the substances that work are ..reasonably commonplace.
Awk! Pieces of eight. Pieces of eight. Pieces of seven... ERROR: General Protection Fault. [Paroty Error.]
Why not just pull out the RFID?
RSA's next annoucment will be tags that will block the operation of the tags that block the operation of the tags on the things you buy. This will be offered as a security enhancement to stores to prevent the RFID system from being jammed.
www.eFax.com are spammers
About 6'2" tall, maybe... 2 feet wide... with a breathing hole if possible, and maybe some plastic towards the top to see out of.
Oh, I don't know about that. Seems this is just the thing to keep those guys wearing RayBans and black macks, lurking in an arcane sea-green Dodge Dart parked in the far corner of the drugstore parkinglot from discovering which medication you're on this week for your schizophrenia and irrational paranoia.
A feeling of having made the same mistake before: Deja Foobar
Great, now I have to wear a body condom to block my RFID's... Actually, i'm glad to see companys looking at RFID in a responsible way. Hopefully between that and angry consumers, this can be a usefull technology without being a privacy hazard.
The pharmacist provides your prescription in a special bag with the Blocker tags. When the drugs are in the bag, RFID readers are blocked.
"Excuse me sir, could you please leave your stack of empty Walgreen sacks here at the counter"
--Best Buy employee
"If you think you have things under control, you're not going fast enough." --Mario Andretti
What I want is to be able to disable the damm tags on anything I've already purchased and taken home!
-MattT *** Not speaking for my employer, or any other sentient beings ***
That's what shoplifters use right now to defeat the currently used radio tags. 60 minutes did a segment on professional shoplifters last Sunday. It's a $10 billion a year industry.
Who told the criminals about Faraday cages? Did they learn it on the Internet? We need to remove this dangerous physics information from places kids and robbers can get it!
The latest Slashdot meme.
Essentially, the blocker tag system works by tricking readers that all the possible RFID tags are present at a given time. Because RFID readers can communicate with only one tag at a time, when multiple tags reply to a single query, the reader detects a collision.
When that happens, the reader tries to communicate with each tag individually, asking each for its next bit, which identifies the portion of a binary tree the tag resides on. However, when queried in the presence of a blocker tag, the blocker tag also responds, but with a "0" and a "1" bit, confusing the reader and preventing it from getting valid responses.
So couldn't you just always have a blocker tag with you at all times? Say you build one of these into your watch, for instance. Wouldn't that make a store's entire RFID system useless for the items you're carrying?
Also, blocker tags in bags don't do anything to protect your privacy once you take the item out of the bag; so if the RFID tag is on clothing, it would still be active while you're wearing it, but not while you're walking out of the store with it. Something about that definitely doesn't seem right.
You don't need a special chip to stop RFID tags from functioning. Look at the EZPass/FastPass/etc. systems in use on highway systems across the country. They come with a metallized plastic bag, similar to the antistatic ones that your hard drive came in, that blocks the signal from the EZPass so that you won't register when you don't want it to. All you need is your standard Anti-static bag. Drop your RFID tags in there and watch the readers try to find them. Signals won't penetrate: no chip necessary.
Remember, there were no nuclear weapons before women were allowed to vote.
As described, what they've built is pretty much the embodiment of "harmful interference". It'll require an amedment to the FCC's Part 15 rules to be legal. Which seems fairly unlikely...
Or perhaps...
<conspiracy> It sounds to me like RSA actually has some other use in mind for these tags. </conspiracy>
Children in the backseats don't cause accidents. Accidents in the back seats cause children.
blocks from 10 MHz to 20 GHz mobilecloak
Uh...why would you need to put RFID tags on drugs or on drug containers in the first place?
If you're talking about prescription filling errors, that would be solved overnight by two things:
a)making doctors fill out prescriptions similarly to how most government forms are- one box per letter,capital letters(and when a prescription is rejected- the pharmacy makes it clear to the patient, AND the hospital, WHY. Doctors who can't be bothered to write clearly for the safety of their patient find themselves on the street).
b)training pharmacists better, holding them and their employers accountable for mistakes, and FDA(or state) conducted spot checks(we check health codes at restaurants to make sure Jenny the short order cook doesn't store that pot in the wrong place, but we can't be bothered to have someone fill a prescription a few times a month and check the results at a lab?)
If we're talking about theft(gillette's supposed reason for doing RFID), the major source of theft is armed(or claiming to be armed) robbers stealing powerful painkillers that have value on the black market.
RSA is grasping at straws here, finding a solution to the problems with a solution that was invented out of thin air(for a real problem). Say that 5 times fast.
Please help metamoderate.
Not to mention a whole host of other problems. Seems RSA is looking for a new business model, seeing as their compression patent expired.
...so I get RFID tags on my bottles of pills. Great. Then I put them in this bag and the tags are jammed. Ok.
SO WHAT THE HELL IS THE POINT OF THE TAGS IN THE FIRST PLACE!?!
If I have to take the bottle out of the bag to show it to the pharmacist or cashier or whoever when I want to get a refill or pay, why not just put a goddamn BAR CODE on the stupid bottle!?! There! Done! I show you the bottle, you do something with it. Bam! Just like what we have today! No extra cost! No upgrades! No new hardware! This is like inventing Caller ID so you can sell everyone Called ID Blocking! Why have BOTH? We can just live without the RFIDs in the first place!
"Life's funny sometimes." "And sometimes it isn't." --Cat's Cradle
we like to call it the microwave
[Fuck Beta]
o0t!
...I'm sure that they'll find some law, like the DMCA, to use against anyone who dares try to assert this bizarre "privacy right". If no law can currently be manipulated into supporting their agenda, they'll write a new one and pay Congress to enact it.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
- The tags themselves have to be designed with fusible links (so that they can be overloaded & die), and
- The POS devices have the option of tag nuking, or maybe some area at the POS where tagged goods can be placed that will nuke them. (Many stores already have those pads that wipe out inventory control tags to prevent theft - same kind of notion.)
So, the question at a practical level is - is the industry actually responding to this, or is RSA's announcement just bandwagon hopping?"The time is always now" - Victor
FCC regulations prohibit deliberately interfering with radio communication. 47 CFR 15.5(b)
Odd. When I want to block an RFID tag, I put it an ESD bag. (Electrostatic bag, the kind that come with many computer components). When I ordered an RFID based automated toll-booth system, it came with an ESD bag, and in their FAQ they explicitly state that if you don't want your tag read and your account charged, just put the device in the bag, easy as that. Presumeably, an ESD bag (which has enough metal in it to accomodate a random static discharge) would create a Faraday cage around the tag, and keep the radio signals from getting in or out of the bag. Now all I have to do is make a shopping bag out of ESD bags.... or just line a backpack, and _bam_. Shoplifter's dream. just remember to close the bag first....
"Is this not a rare fellow, my lord? He's as good at any thing, and yet a fool." -from "As You Like It", Act 5,
Maybe it's just me, but this seems to not address any of the important RFID issues at all.
Why would this address any of the important issues. The important issues are based in policy, not technology. Technology enforces policy.
I submitted an article on this to /. a few weeks ago but it was rejected. Typical of /. to print every anti-RFID piece of FUD they get but to ignore anything that might indicate that some companines get it.
Lasers Controlled Games!
SCO has issued a 'cease and desist' letter to the RSA, claiming that their use of RFID blocking technology violates SCO's IP wherein they use 'patented processes' to block RFID tag scanning. Patent searches reveal that SCO has recently hired several convicted shoplifters and their associated technologies now belong to SCO.
Maybe it's just me, but this seems to not address any of the important RFID issues at all.
First, enlighten us and tell us what the "important RFID issues" are.
Then, tell us why this device was supposed to resolve them, and didnt.
I don't need no instructions to know how to rock!!!!
Oh yes, I feel safer already!
</BLOCKER>
Merely a pacifier in the mouths of consumers. "Oh we are safe now, back to living/enjoying RFID as per the norm". Tell them whatever they want to hear, they will believe you and be happy.
We've tested it here at the UCONN Library. We use RFID tags on our books, and if you know where the tag is and hold a pack of cigarettes in front of it when you leave, it will block the tag from being read. In this case, tinfoil really WILL protect you!
Should market a powerred belt buckle with enough strength of signal to jam everything in a reasonable area. I imagine a suitably rebelious buckle with a little battery.
I know people who would buy one just to be difficult, others because they are smart.
ls
1994: Since when do people want to visit other computers on a giant network?
1984: Since when do people want an entire television channel devoted to videos of musicians singing and dancing?
1974: Since when are terrorists going to attack airplanes?
Just because it isn't happening now, doesn't mean it's not right around the corner. C'mon dude, get your head out of the sand.
Just the thought of these tags gives every Walmart exec a permanent erection, from the distribution department to the ad department, and every department in between.
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
The problem with all of this stuff is that I have no way to check any of it for myself. How do I know that the "blocker bag" they gave me works? How do I know that someone won't start a business of supplying cheap substitutes, for businesses that want to pacify their customers, that look like real blocker bags but don't do anything? What do I look for? The genuine RSA seal? What if the pharmacist hands me a bag that has some other company's seal on it? Do I trust it?
Will there be a TRUSTe seal on the bag to tell me that I can trust the company that made the bag... just like the TRUSTe seal that certified that eToys would never sell their customer list?
Suppose I have a genuine RSA-branded blocker bags with an authentic non-counterfeitable TRUSTe hologram on it. How do I know it's working properly? Will the pharmacy supply a "blocker bag scanner," like the price-checking guns in Walmart, that let me verify that the blocker bag is actually working? Will the blocker bag scanner have a Commonwealth of Massachusetts weights-and-measures sticker on it to assure me that it's working properly?
If the answer is that I should just trust the pharmacist to be telling the truth when he says it's a blocker bag... well, why shouldn't I just trust the pharmacy not to do anything bad with the data they are capturing from all the RFID tags I'm wearing?
Just because CVS/Pharmacy gave a marketing firm a list of diabetic customers to sell to companies marketing products for diabetics doesn't mean they'd ever do such a thing again. Heck, that was way way back in dark ages... 1998.
These companies are all like Lucy holding the football for Charlie Brown. Trust us, trust us, trust us... even though we've betrayed your trust over and over again in the past, we'll never do it again.
"How to Do Nothing," kids activities, back in print!
Perhaps I'm missing something here, but aren't the tags in question used for tracking inventory and such? It's not like this blocker is intended to be used against RFID tags that the makers explicitly don't want to have disabled, so why don't the RFID tags themselves have a "disable code" that turns them off?
What do you mean? This addresses the very most important problem with RFID, namely:
The fact that RSA can't make any money off it!
I wish I could have a gizmo that would disale cell-phones withing ten or so feet. It would be very useful in movie theaters, on the bus, in restaurants, etc.
I can't speak as to Best Buy Specifically, however, I did some contract work for another Big Dept store a few years back (about 2-3 years before they went out of buisness)... I wasn't doing security but I saw the security offices and whatnot (in fact, I stayed overnight in the store, sometimes with a security person, sometimes with just a manager - only once did we get a request by one of them to check our tool bags at the end of the night, but when we said ok immediatly, she just let us go - but she was just a biutchy manager that gave us an attitude all night long - she was also the only one that complained about me wanting to take a book and sit on one of the futons in the store when I had an hour of downtime waiting for data to copy... bitch)
Anyway... my point... ive seen the way their security operate and talked with them about it a bit.
From the moment you enter the store, you are on tape. They may or may not be watching you specifically... you just don't know. Rest assured they are watching somewhere in the store. They know what to look for, they know how to tell who to watch.
Who is the security guy? Well I will tell you, he is probably dressed well, but not like an employee. He/she wont wear the store colors, or a name tag, and he is watching the cash registers as much as anywhere else.
In fact, the store I saw had a very old system overall that hadn't been upgraed in years, not like all these new Best Buy stores. Yet still with that old system they could watch a cashier (what? you think the shoppers are the only people the security folks watch? notice the camera density by the checkout - those are for watching the clerks as much as you) and on a seprate terminal he could watch the transactions go by as the clerk scanned items and input stuff into he register to make sure the clerk wasn't putting through improper transactions or helping people steal from the store.
-Steve
"I opened my eyes, and everything went dark again"
Now that you've posted you can't mod me up though. :)
Lasers Controlled Games!
After working for several months with the new EPC compliant tags (what WalMart has mandated) I can, with a great level of assurance, say that one does not need a chip to prevent reading of the chips, that is way overkill, and probably not really reliable.
There are a couple ways to easily defeat the chips:
1) put the product inside of a foil lined bag. Doesn't even have to be heavy foil, any slightly metalic foil will block the RF signal to the point that the tag cannot be read.
2) Hold the product close to your body. The water in your body absorbs the RF signal, silencing the backscatter RF signal.
3) Put two standard RFID chips close together and the antennas will 'shadow' each other, blocking the signal from both.
From my experience it is harder to read the tags than it is to not read the tags. (the fact that you can read a tag is almost a miracle in itself) To build an entire chip to defeat an RFID chip is just stupid.
RSA is just looking for something else to patent, like they did the RSA algorithm.
Nothing here...move along
You can't really get around the fact that a foil bag blocks all electric fields passing through it. It would act as a Faraday cage. Now IANAP, but if I recall from Physics class, the foil bag, as a conductor, acts as a sort of ground for all electic fields attempting to pass through it, so the charge from the filed ends up on the surface of the bag, so none penetrates into the center of the bag. Now of course a tin foil bag isn't a perfect conductor, so it will let a little bit of the electric field through, but with a fairly highly conductive bag you could cut the electric field down significantly. Unless the readers use extremely high powered signals, they wouldn't get through. Plus, the tag doesn't transmit a very high power signal to begin with, so the signal will never get out.
If you can read this then I forgot to check "Post Anonymously"
Excuse me, but why would they put RFID tags on items like medicines and then design bags to block them from the view of the RFID system? Why not, uh...just not tag them in the first place?
The more I read about this RFID thing, the more I'm thinking the idea just hasn't come along to the point where it has to be. Obviously, if these issues are getting discussed at a high level, we need to put something in place that's a bit more targetted to the problem: we want to be able to read items for a specific purpose, and no other purpose. Walk out of a store with items, get automatically charged to the credit card = good. Someone sitting in the parking lot with an RFID reader able to tell you just walked out with Preparation H, herpes medication, and a coffee enema kit = bad.
I'm betting that the propeller-heads among us have the capability to solve this problem, technologically I'm talking. Also, do we have to start out tagging everything? Why not just tag the non-controversial items? Let's not start with the Complete Homeopathic Colon Invasion Toolkit (TM), or people themselves. Let's start with something a bit more pedestrian and refine things from there...
sev
but have you considered the following argument: shut up.
Just let all information formats on RFID tags be public. Let anyone buy a reader. Obviously, going in to a store with a RFID tag re-writer would be a problem, but the checkout-register could doublecheck randomly.
Make storing customer personal information on such a tag a felony, even if the customer signs any forms indicating otherwise. Business can still use RFID for quick checkout, inventory management, etc.
Since we all have readers, we can doublecheck that the tags are, in fact, erased. I would suggest having readers all over the store, even on the way out. If they are not properly, totally erased, bring them back to the counter. Even 10% of customers doing it would provide major incentive to get the tags erased correctly, the first time.
In fact, why don't we walk around the store with RFID readers? That way we can check the real price of each item - no confusion or misleading shelf placement. If there is a rebate, that information should be on the tag.
Lastly, to achieve nirvana, all we have to do is require the wages of people who made the item on the RFID tags. That way the (now well informed) consumer can choose between shoes, clothing or other goods made in various countries - and actually be confronted with how little people earn in some places. Sure not everyone will care, but enough will.
a war on terrorism? How can we end a war on a method?
It's bad enough that every corporate conglomo is going to be allowed to invade your privacy for their own records, but now there is going to be a second conglomo who is going to SELL you products to protect you from the first! Jesus H. Christo! We need to elect another political party because both current groups somehow think this is a good idea. They have both been sucking on the corporate teat too long.
"Curiosity killed the cat, but for a while I was a suspect."- Steven Wright
Armor piercing rounds generally have steel cores. The main use of steel core ammunition in the US is for cheap surplus rounds sold and mainly used for target practice.The don't make good rounds for hunting (or assassination) as they tend to pass through the target without shedding much energy. Good rounds for hunting are soft-tipped or hollow core and expand and stay in the animal. That way they transmit the most energy and create a more lethal wound channel.
...
If you consider the size of a buck deer, moose, or elk it quickly becomes apparent that if you allow sportsmen to hunt these animals, then you must have appropriate ammunition available that will dispatch them with a high probability with one shot. If you look at the rounds used in the past to hunt elephants you'll see they are huge are in fact not very common, and the rifles that can fire them are quite expensive, and even more uncommon. And, if you disallow hunting, then you have to reintroduce natural predators for game animal population control; look at New Jersy's experiment with elimination of deer hunting. Famine in the deer population as it grew, increase in disease in the deer population and increase in related vectors that directly and adversly affect other animals and humans.
If you want to change the rights of gun ownership in the US have the courtesy to attack the problem head on. Make an attempt to change the 2d amendment. Legislation that violates the 2d Amendment is just an affront to the legal basis that supports all our laws. When you do, remember that over 50% of US housholds own guns, legally. Guns are _so_ easy to manufacture that a plant in NJ was set up by organized crime and operated for years creating blackmarket firearms. We dropped (in WWII) leaflets showing how with simple mechanics tools a reliable fully automatic weapon (the so called "grease guns") could be made my resistance fighters. Make sure you address all the potential avenues for criminal creation of firearms when you try to make a legal ban of them. And then consider what other rights you have to give up to allow enforcement of those provisions to assure crimminals don't have firearms. And consider those who legally use a firearm in self-defense and assure a way to protect all the citizens all the times. I see very large budget increases for the new police state you'll need to implement this.
Feel free to mode this down along with the parent. Now if only he'd have suggested RFIDs in bullets or handguns
- Tjp
I am in wallow with my inner money grubbing capitalistic pig. ... Oink!
Given a sufficient amount of money and technical prowess, I'm sure one can build an RFID scanner to defeat this jamming technology. But this raises the bar somewhat, and gives a modicum of privacy assurance for the cost of a single RFID tag.
Think of it like the safety seal on over-the-counter medications. Is that plastic doohicky ironclad proof that some loony hasn't poisoned your NyQuil? Of course not -- there're always ways to tamper with a bottle. But at least the seal raises the bar, so that only persistent and resourceful loonies need apply.
As you say: for the truly paranoid, an active version of this device could do a much better job. Heck, if you're going to the trouble of carrying around a device with batteries, complicated logic and an RF transmitter, you might as well just jam the region of the spectrum that RFID tags like to use.
When the drugs are in the bag, RFID readers are blocked. Take them out, they're readable... RSA promises that this new technology will not interfere with the normal operation of RFID systems or allow hackers to use security technology to bypass theft-control systems..." What kind of double speak is this? Look, either the technology blocks reading of RFID tags, or it doesn't. If it does block reading, it enables people to bypass theft control systems. If it does not, it does not protect privacy. It's as simple as that! RSA is trying to convince us their technology is smart enough to tell the difference between an honest drug consumer and a shoplifter?!? WTF?!?
"Freedom means freedom for everybody" -- Dick Cheney
Seems to me we are about to be dragged into a consumer privacy Cold War that will make SPAM and computer viruses look like idle fun. How do you want to live?
a) Get used to having your every move recorded in a giant marketing/antiterrorism/conformity database. Ignore little annoyances like being IRS audited every year because you checked the wrong books out of the library.
b) Buy and continuously upgrade your array of privacy-protection technology.
c) Live in a shack in the hills and deal only through barter.
d) Armed revolt.
I don't personally find any of these attractive.