Slashdot Mirror
Hacking the RFID Network
An anonymous reader writes "The world's largest retailers are developing the EPC Network as the infrastructure for a global rollout of item-level RFID. In many ways this 'Internet of Things' resembles the ISBN system or CueCat's codes-to-content. But the network built for tracking consumer goods could also be used for intangible items: airline seats, music tracks or service calls."
on overusing this new system
Track music downloads and service calls? That's billions of unique items every year. How many items do these RFID tags support?
I can track my porn collection internationally?
I knew they could be used as flotation devices- but now they're apparently virtual as well. That explains the problem with overselling flights I guess. They're selling VAPORSEATS (tm) (Patent Pending)
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
What they're saying is that RFID can be applied to intangible information - content rather than the physical media - just like ISBN/Library_of_Congress system uses an identifier for a book rather than an instance of it.
In other words: RFID can be extended to apply to an entire class, rather than instances of it, as is usually done.
Bet somebody'll mention how this is great for pr0n in the next 5 minutes.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
at least someone will be able to find my remote control
-ninjaneer
RFID presents the same looming threat as bar codes.
What does "hacking" have to do with any of this?
"err sir ... you appear to be stealing an elephant from our store .... err um please turn out your pockets ... wait I was wrong you appear to be carrying the entire housewares department ..."
...piggybacks on DNS to look up manufacturer info. The spec is here... nifty stuff!
The Army reading list
The major shortcoming of RFID tags is not their rollout in stores, it's that they want to do things like weave them into clothing fabric or hide them so you've got to work to get them out. I don't know about you, but that's a bit excessive. Moreso, the range on the tags is an issue; the tag may be tiny, but you can still get a considerable amount of range out of that, look what's possible with GPS.
Then we've got the registering everything idea. If we put RFID tags on everything that can go for 100 feet, and if everything has a unique identification code, then the government can ask for a list of which codes are associated with which objcts. Then, as stuff is baught, you swipe through your drivers lisence and a database is updated with what you have. Combine this with bank account data, wifi hotspots on poles that are constantly pinging devices, garbage trucks equiped with rfid scanning technology, and other pieces of information, and you've got one hell of a spying system. All those evil laws the people in power dream of would be possible.
If there was a law that said the RFID tags could only be put on removable stickers, and must have a range limited to less than 5 feet, then it'd be ok. It's the "weaving them into products" thing that's got everyone upset. Infact, if that weaving thing didn't exist, I think RFID tags would be pretty neat; you could buy a bunch of food and query it through your house, which could download and update a database of recipe's which could be setup on some kind of whacky algoritm that figures out which is going to go bad first.
The only problem there is that as the chips evolve, we'll be throwing small flash cards on em with advertising or more complicated systems of ensuring produce hasn't been tampered with, which if the laws don't change, will require licensing since you're copying; licensing to eat, not a good thing.
AS far as tracking people is conserned, we all know of the mark of the beast, and we all know that tracking accounts with rfid tags is just plain stupid. If you're going to track a person, have them wear a wrist band or something; even the guys on star trek didn't have that little pin thingy embedded in their forhead.
Candy-Coated Knowledge
http://news.com.com/Japan%20school%20kids%20to%20b e%20tagged%20with%20RFID%20chips/2100-1012_3-52667 00.html
i, for one, welcome our rfid tagged japanese overlords.
for a minute there, i lost myself...
If there's anything to say about the japanese, it's "wow, they're screwed up". If tagging your kid everywhere they go says something, it says "I don't trust you"; and the longer kids aren't trusted with responsability, the less they will be responsable, and if the world is filled with irresponsable people....
Dear lord...that'd be one screwed up place...
Candy-Coated Knowledge
.. Are Japanese school children anyway? (Japan school kids to be tagged with RFID chips) Just wait until a stalker hacks that RFID network!
One line blog. I hear that they're called Twitters now.
How long are RFID tags (or the databases' links between a person and their stuff) supposed to last?
:P
When people get tired of or wear out their RFID clothes and then give them to Goodwill or sell them through consignment stores, tracking systems will think they're in multiple places at the same time.
So does this mean I should or should *not* start buying all my clothes at the second-hand store when RFID rolls out?
nn
"It's a wonderful idea. But it doesn't work." -- Tad Danielewski
why on earth should airline seats be intangible? last time I sat in one it wasn't. I further imagine that the seats not get lost too often and therefore do not need to be tracked..... This whole idea is just nonsense...
simply dictate where you send your products and keep the consumer in one place, like a vat of amneotic fluid. Come to think of it, all those carbon based units churning out 100W of heat and only using less than 10% of their processing power...
Imagine a super beowulf cluster of those...
Er wait...
My hyperlinks aren't worth the paper they're printed on.
If anybody wants to do something constructive, then help "hack" on the open source RFID C library on Savannah.
It's my understanding that a common practice these days is to have microships (which I assume to be RFID tags) injected under the skin of pets, so lost pets can be identified even if they're not wearing collars.
I think a good idea would be to make pet doors that can "learn" to unlock only when certain RFID tags are within 4 or five feet. You could set it for the pets you own, and other pets (and/or other critters) wouldn't be able to get in.
Also, if your pets didn't have the chips implanted, you could just get a chip on a collar.
Alaska Jack
I'll let the philosophers sort out whether the ability to track every object is a good or bad thing. However, I do know that if this system becomes too pervasive without security, this is going to be a big problem in a hurry.
I remember a commercial where a shifty guy walks through a store stuffing things in his jacket, and then walks out of the door to be stopped by security. The guard informs him that he forgot his receipt, hands it to him, and sends him on his way. I'm all for putting checkers out of work, but if such an environment existed, it would also be profitable to spoof the system.
As they are currenly used, I suppose the only profit would be to either disable the tags or somehow make the store think it has already been purchased. That brings me to the next issue. I assume most people have tried to walk out of a store with a purchased tagged item where the checker forgot to take off the tag. It is annoying and embarassing. Imagine if this could happen with every article of clothing that you own because the store database gets screwed up.
I don't practice what I preach because I'm not the kind of person that I'm preaching to.
What would be the easiest way to find and/or destroy an RFID tag? Put your new pullover in the microwave oven for 3 seconds?
Is there any way to destroy such a tag embedded in electronics? Would it be possible to make the tag a vital part of the electronics in such a way that its destruction would lead to immediate equipment failure?
Are the signals easy to spoof?
Geek rants since like... 2000 or something.
Maybe I'm just spoiled being a hardware engineer, but it seems to me that the people who are crying about these RFID tags and privacy are just plain ignorant.
I can tell you it will be trivially easy to build a jammer for them. Maybe a little harder to build an RF source with enough energy to burn out their cute little itty-bitty diodes. And until they get wise and start putting challenge/responce encryption in them, building a box to spoof them would be a weekend project for your average Radio Shack hobbyist.
Will someone please educate them about the technology so they can devote their time to something that really matters? (If they want something to bitch about, they can read my blog for ideas.)
I might just wait until they're manditory in license plates and walk parking lots blowing them all out, (but probably not being a grownup and all.) Perhaps I should have posted as AC just for suggesting it. (Damned Patriot Act bastards.)
"Consider some of the main usages . . . Anti-theft . . . Quick checkout . . . 'easily-removable' defeats the entire purpose for which a lot of stores will use them."
It's not the merchants' _ostensible_intended_ usages which are excessive, Virginia; it's the _potential_ uses, by corporations, hackers, private snoops, governments, etc.
Jeez, things are going way beyond Ben Franklin's famous saying about trading liberty for security. Lately, I've been seeing way too many of these examples of people being naively willing to short-sightedly throw away privacy, the safety of anonymity, and safeguards against the Ashcrofts of the world -- irreversibly -- not for "security", but MERELY for fscking temporary CONVENIENCE!!
Assuming for the moment that we're talking about the passive RFID tags (such as those produced by Alien and Matrics), then the tiny chip on the tag gets its power by receiving the RF signal generated by the transmitter, and uses that power to send back a signal saying "here's my data".
Now assuming the usual inverse square stuff, and allowing that the signal back from the chip is being sent with about 30 dB attenuation, then some simple math (left as an exercise to the student because it's been a while since I did it) should give you some real-world ideas as to the range and reliability of these damned tags. And the size/power of the transmitter needed to energize them. And that's assuming a clean read in the first place, and not having to disambiguate Avogadro's Number of tags in the immediate vicinity of the transmitter. And that doesn't count the tags within 6" of the transmitter that have melted!
Sorry, mate, but I've been working with some of these tags and readers in an industrial environment for a while now. I'm alternately amused and frustrated by the tin-foil-hat brigade and the assertion that someone with a hand-held battery-powered minature device could scan tags reliably from across the room/across the street/from low-earth orbit and figure out where you bought your underwear.
I'd love to tag the cat myself and then track it round the house/neighborhood, but I suspect that the Tesla-esque transmitter on the roof would cause some comment among the neighbors/Dept of Homeland Security (-:
No need to shoplift OUT of the store -- walk in and start tossing rfid emiters in coat pockets, bags of socks, other shoppers' carts .....
Overwhelm the system and it becomes useless.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
Why not? The idea with the ONS is that someone (VeriSign, per the contract that EPCglobal let) will run a fairly small (and replicated by others) root service to say, "If you want to know about EPC=XXXXXX..., you need to look over there," and give a pointer to PepsiCo. At PepsiCo (or some agent of PepsiCo's choosing, say IBM, or GXS, or whomever), there'll be services to further parse the request, and direct it to an appropriate target. PepsiCo could choose to construct a single huge database with entries for every tag (associated with every product) it creates, though it need not... that might be broken up among various bottling units, etc... we need to think of "EPC space" as a vast, federated landcape of services.
The elegance of the EPC is that it parses into parts: a part will say, "This EPC was assigned by PepsiCo," a part will say, "It corresponds to this PepsiCo product," and a (fairly large) part will say, "For this PepsiCo product, this particular EPC represents this specific unit."