Slashdot Mirror
Hacking the RFID Network
An anonymous reader writes "The world's largest retailers are developing the EPC Network as the infrastructure for a global rollout of item-level RFID. In many ways this 'Internet of Things' resembles the ISBN system or CueCat's codes-to-content. But the network built for tracking consumer goods could also be used for intangible items: airline seats, music tracks or service calls."
on overusing this new system
Track music downloads and service calls? That's billions of unique items every year. How many items do these RFID tags support?
No. Those are magnetic strips that trigger the electro-magnetic detectors by the library doors. No RFID, sorry.
RFID presents the same looming threat as bar codes.
What does "hacking" have to do with any of this?
The major shortcoming of RFID tags is not their rollout in stores, it's that they want to do things like weave them into clothing fabric or hide them so you've got to work to get them out. I don't know about you, but that's a bit excessive. Moreso, the range on the tags is an issue; the tag may be tiny, but you can still get a considerable amount of range out of that, look what's possible with GPS.
Then we've got the registering everything idea. If we put RFID tags on everything that can go for 100 feet, and if everything has a unique identification code, then the government can ask for a list of which codes are associated with which objcts. Then, as stuff is baught, you swipe through your drivers lisence and a database is updated with what you have. Combine this with bank account data, wifi hotspots on poles that are constantly pinging devices, garbage trucks equiped with rfid scanning technology, and other pieces of information, and you've got one hell of a spying system. All those evil laws the people in power dream of would be possible.
If there was a law that said the RFID tags could only be put on removable stickers, and must have a range limited to less than 5 feet, then it'd be ok. It's the "weaving them into products" thing that's got everyone upset. Infact, if that weaving thing didn't exist, I think RFID tags would be pretty neat; you could buy a bunch of food and query it through your house, which could download and update a database of recipe's which could be setup on some kind of whacky algoritm that figures out which is going to go bad first.
The only problem there is that as the chips evolve, we'll be throwing small flash cards on em with advertising or more complicated systems of ensuring produce hasn't been tampered with, which if the laws don't change, will require licensing since you're copying; licensing to eat, not a good thing.
AS far as tracking people is conserned, we all know of the mark of the beast, and we all know that tracking accounts with rfid tags is just plain stupid. If you're going to track a person, have them wear a wrist band or something; even the guys on star trek didn't have that little pin thingy embedded in their forhead.
Candy-Coated Knowledge
Could anyone who understands RFID perhaps enlighten us about what sorts of security is built into the system?
If there's anything to say about the japanese, it's "wow, they're screwed up". If tagging your kid everywhere they go says something, it says "I don't trust you"; and the longer kids aren't trusted with responsability, the less they will be responsable, and if the world is filled with irresponsable people....
Dear lord...that'd be one screwed up place...
Candy-Coated Knowledge
How long are RFID tags (or the databases' links between a person and their stuff) supposed to last?
:P
When people get tired of or wear out their RFID clothes and then give them to Goodwill or sell them through consignment stores, tracking systems will think they're in multiple places at the same time.
So does this mean I should or should *not* start buying all my clothes at the second-hand store when RFID rolls out?
nn
"It's a wonderful idea. But it doesn't work." -- Tad Danielewski
I use my cuecat for my passwords...
"Consider some of the main usages . . . Anti-theft . . . Quick checkout . . . 'easily-removable' defeats the entire purpose for which a lot of stores will use them."
It's not the merchants' _ostensible_intended_ usages which are excessive, Virginia; it's the _potential_ uses, by corporations, hackers, private snoops, governments, etc.
Jeez, things are going way beyond Ben Franklin's famous saying about trading liberty for security. Lately, I've been seeing way too many of these examples of people being naively willing to short-sightedly throw away privacy, the safety of anonymity, and safeguards against the Ashcrofts of the world -- irreversibly -- not for "security", but MERELY for fscking temporary CONVENIENCE!!
Simple. Once it is ubiquitous, make it illegal to manufacture or sell any device that can interfere. Heck, make it illegal to even tell people how to make such a device.
Hmm. How likely is that to ever happen?
"The FCC has VERY tight restrictions on devices that put out RF in any form."
and how inconceivable is it, that readers will eventually be so small and cheap, that they can be placed so densely that you can't avoid being in range (without engaging in behavior that's considered sufficient probable cause to be detained)?
Who was predicting ubiquitous gigabit wifi ten years ago?
Assuming for the moment that we're talking about the passive RFID tags (such as those produced by Alien and Matrics), then the tiny chip on the tag gets its power by receiving the RF signal generated by the transmitter, and uses that power to send back a signal saying "here's my data".
Now assuming the usual inverse square stuff, and allowing that the signal back from the chip is being sent with about 30 dB attenuation, then some simple math (left as an exercise to the student because it's been a while since I did it) should give you some real-world ideas as to the range and reliability of these damned tags. And the size/power of the transmitter needed to energize them. And that's assuming a clean read in the first place, and not having to disambiguate Avogadro's Number of tags in the immediate vicinity of the transmitter. And that doesn't count the tags within 6" of the transmitter that have melted!
Sorry, mate, but I've been working with some of these tags and readers in an industrial environment for a while now. I'm alternately amused and frustrated by the tin-foil-hat brigade and the assertion that someone with a hand-held battery-powered minature device could scan tags reliably from across the room/across the street/from low-earth orbit and figure out where you bought your underwear.
I'd love to tag the cat myself and then track it round the house/neighborhood, but I suspect that the Tesla-esque transmitter on the roof would cause some comment among the neighbors/Dept of Homeland Security (-:
This space intentionally left (almost) blank.