RFID & Viral Vulnerability

Arleo writes "Student Melanie Rieback and others, part of a Tannenbaum research group in Amsterdam, have proven that RFID-tags are vulnerable for infection with viruses. In a research paper titled "Is Your Cat Infected with a Computer Virus?" is shown how an altered RFID tag can be used to send a SQL injection attack or a buffer overflow. They describe on the rfidvirus.org website possible exploits of this types of viruses: from altering the backoffice of a supermarket to spreading RFID viruses by infected bags on airports."

Comments

Bright Future for RFID malware.

[TripMaster Monkey]

Fascinating stuff, but it seems that the game plan for protecting against RFID malware is basically the same as protecting against more traditional malware...namely, enforcing proper bounds checking, enforcing proper database permissions heirarchies, disabling back-end scripting languages, isolating the vulnerable RFID middleware server in a proper DMZ environment, etc.

In other words, RFID malware has just as bright a future as the more traditional flavor, since most developers and administrators can't be bothered to take these elementary precautions.

Re:Bright Future for RFID malware.

[tgv]

Not only this, but a single check on the length of the tag would be sufficient against this attack. So in well-designed software there would only be one place where to check for length. It's not like certain well-known operating systems, that have unguarded buffers in dozens of places. That seems to diminish the risk quite a lot. Not to mention that any organization that takes its security serious, will probably set up a warning system for malicious RFID tags, which will expose attackers quite quickly, since they're likely to be physically nearby.

Re:Bright Future for RFID malware.

[Alex P Keaton in da]

Think about the shoplifting possibilities- Once RFID id used to monitor what is in your shopping cart, and you are automatically charged (because your credit card has RFID) as you walk out of the stores (No more checkout girl).
Write a little virus that defaults all your mechandise to 99cents an item, and you are good to go. This would of course only work with items worth more than 99cents, like steaks and electronics. Defaulting Bubblegum to 99cents would end up lamking you lose money.

Re:Bright Future for RFID malware.

[gutnor]

I imagine the bright future ...

I'll have too explain my dad to not to download whatever crap on internet, never reply yes when a crap want to install something without asking me first and now ...
I need to ask him to check the ServicePack version on his six-pack and explain him that bringing russian vodka home can wipe out his harddisk when he turns the TV on?

Re:Bright Future for RFID malware.

[Jeff DeMaagd]

That's quite a lot of work though, not something I would call "simple", especially for overworked and underpaid IT workers. Normally I wouldn't be concerned because most times, RFID should only be a serial number, but if even image files can cause trouble, then I suppose anything can.

Re:Bright Future for RFID malware.

[gunnk]

Would they have to be nearby?

I see a real threat for anonymous attacks:

Attacker buys RFID-tracked product at store.
Attacker alters RFID-tracked product to allow for attack.
Attacker returns the product to the store shelf and waits...
Joe Sixpack checks out with infected product.
Clerk scans product and infects store database.
All prices for all products now set to $0.

Re:Bright Future for RFID malware.

[Anonymous Coward]

MOD PARENT UP!
Seriously, the overrated mod is getting overused. People seem to use it to mod down someone they don't like, or a post they don't agree with, because overrated can't be metamoderated.
MOD PARENT UP!

Re:Bright Future for RFID malware.

[Loether]

>which will expose attackers quite quickly, since they're likely to be physically nearby.

Good point. If I wanted to infect a system say at wallmart. I'd just place the infected RFID tag on a product on the shelf and wait for someone to buy it or inventory it. I'm long gone by the time the infection attempt takes place.

Re:Bright Future for RFID malware.

[Danse]

Clerk scans product and infects store database.

All prices for all products now set to $0.

Again, any decent software developer knows that you never trust outside input. You always check everything that comes in. Follow that simple rule and your software is secure from these kinds of attacks.

Re:Bright Future for RFID malware.

[Beryllium Sphere(tm)]

>basically the same as protecting against more traditional malware

That really is a good insight. The RFID issues that Tanenbaum and company pointed out are just new examples of the general problem, software reading untrusted data.

Re:Bright Future for RFID malware.

[Fred_A]

Except we all know how many decent software developers will be employed to write this kind of application...

The software will likely be wide open from this kind of attack.

Re:Bright Future for RFID malware.

[LWATCDR]

sql injection attack?
How would you let something like that happen? There is a ton of code to prevent that all over create not to mention that I think every database on the planet has a quote function just to prevent that kind of thing.
Buffer overflow? just what data entry method is not vulnerable to a buffer overflow if the programmer is careless?
I would have been shocked if RFID was magically immune to programmer induced security breaches.

Re:Bright Future for RFID malware.

[BeBoxer]

Not only this, but a single check on the length of the tag would be sufficient against this attack.

Not true. The article specifically mentions potential SQL injection attacks, which are not caught by a simple length check. Also, you are assuming that the tag contains nothing more complex than a single ID number. As the complexity of the data in the tag goes up, so does the complexity of the parsing code for that data. Take for example including a picture of the owner in the RFID tag inside of a passport. Now the outside data is being fed to a some type of image decompression software with all sorts of opportunities for vulnerable bugs. Not only is image data likely to be a component of lots of RFID data, image decompression routines have historically been fertile ground to exploitable code bugs.

None of which is to say that the problem isn't manageable, but just that it's a lot more involved than a single length check. In fact, it's that kind of thinking which leads to vulnerable bugs. "Hey, this 1KB of random data is the right length, it must be OK. No need to worry about bugs anywhere else in the system." Riiiight.

Re:Bright Future for RFID malware.

[Adrin]

Can I used this as a quote.. AWSOME!!!!!!!!!!!!!!! RFID has a dark future. I can't wait till I have enough money to get a white panel van with a directional ANT. on top. The amount of research I will be able to do in parking lots, Customer tracking in malls, behaver patterns in shoppers. I may make enough to learn how to spell better.

Re:Bright Future for RFID malware.

[tgv]

It does the injection via buffer overflow. In a secure environment, RFID tags can be supposed to hold only a limited amount of data, e.g. a 64 byte code number with some kind of verification. If the application stops reading after 64 bytes, you can put as much SQL on the tag as you can, but it won't get injected.

Don't misinterpret me: I think RFID is a bad idea, but blowing up airports using a buffer overflow on a malicious tag can easily be prevented.

Re:Bright Future for RFID malware.

[BeBoxer]

It does the injection via buffer overflow.

False. I re-read the paper just to make sure I didn't miss anything. They have an example of a working atttack against an Oracle database. Their attack is 127 bytes long in a system with a 128 byte data field. Where is the buffer overflow?

but blowing up airports using a buffer overflow on a malicious tag can easily be prevented.

And as I said, that's a dangerous attitude. The problem goes beyond mere bounds checking on the buffer. And if you were actually in charge of designing such a system using that attitude, you would almost certainly screw it up. Go and actually read the paper. Note that they give a list of seven recommendations to mitigate the risk. See numbers 2 and 3 especially, as they are the actual attack vectors in the example, not a buffer overflow.

Fir Trees?

[eldavojohn]

Student Melanie Rieback and others, part of a Tannenbaum research group in Amsterdam, have proven that RFID-tags are vulnerable for infection with viruses.

American oak tree research groups and Swedish aspen tree research groups have responded by working around the clock to fix this security hole. Never before have groups centered on deciduous trees been so involved in computer security.

Re:Fir Trees?

[psmears]

Never before have groups centered on deciduous trees been so involved in computer security.

Don't be silly. Fir trees are evergreen, not deciduous...

My question is why?

[danpsmith]

I don't understand why we _have_ to use RFID at all. I understand it may make some things easier, but aren't we efficient enough? In these days where security is becoming more and more of an issue, why even creating another security issue when the old way still works. Is tracking something via a barcode scanning system really so inefficient that we need RFID? I don't understand, we seem to be pretty efficient in most industries already, why do we need to squeeze another cent an hour out by using some new and relatively unproven technology when the old way works just fine?

Re:My question is why?

[Anonymous Coward]

You have to physically move packages to see the barcode. So doing stock counts etc, and tracking stock through the supply chain would be faster.

Re:My question is why?

[Anonymous Coward]

Because this brings us that much closer to the Mark of the Beast(tm), which is further proof that the end times are near. The closer we are to the end times, the more powers are given to Herr Bush to fight the "good fight." Simple really.

Re:My question is why?

[GundamFan]

Well there are a couple of advantages that I know of to RFID

1. Inventory, beeing able to know what is in your store and where it is in a retal setting.

2. Convinence, things like being able to park a cart next to a teller and have all the items charged instantly.

3. RFID is already used sucessfuly for tracking pets and could be used to store medical data in people with alergies or other specal medical requirements, along with other personal data if the individual choses.

Let me say I'm scared of some of the potental abuses to, but there are upsides to this.

Re:My question is why?

[ookabooka]

Why did we switch to barcodes when you could just bring it up to the clerk and they would punch in the price? Didn't the old way work? It is definately possible to manipulate barcodes to do some nasty things. Put a barcode from an "IPOD headphone" on an "IPOD Mp3 Player". If the clerk doesnt notice, you just got an Ipod for 10 bux. Obviously I wouldn't advocate doing this, but it goes to show that barcodes are anything but secure. If anything they are easier to manipulate, all you need is a photocopier and some tape. Sounds to me you are just hesitant to change, which is understandable, but IMHO RFID's would give us all a lot of nifty possibilities, which would outweigh the risks. The only problem I see is that it would be harder to manipulate an RFID system, meaning that people would trust it more, meaning that those who do have the knowledge to manipulate it are more likely to get away with it and with larger pay-offs to :-/

Re:My question is why?

[Gr8Apes]

Well there are a couple of advantages that I know of to RFID

1. Inventory, beeing able to know what is in your store and where it is in a retal setting.

Actually, according to a recent study, RFIDs are only about 90% accurate at best, for large palettes whizzing by on conveyor belts in a warehouse setting.

2. Convinence, things like being able to park a cart next to a teller and have all the items charged instantly.

See #1. I don't know any retailer that would abide by less than 99.999% accuracy. RFID does not meet this requirement at all.

3. RFID is already used sucessfuly for tracking pets and could be used to store medical data in people with alergies or other specal medical requirements, along with other personal data if the individual choses.

Let me say I'm scared of some of the potental abuses to, but there are upsides to this.

Now you're getting to the real meat of why some want RFID to take off. It's much easier to convince someone to accept an injection of a little chip than to be tattooed with a bar code, Henry Rollins not withstanding.

While it may be beneficial, the very reason it's beneficial is also why it's bad in an Orwellian sense. There is no way for this to be beneficial without the bad. You can't cover up an RFID, or make it inoperative, without impairing its usefulness when needed.

Re:My question is why?

[karnal]

My company is currently trying to work towards a whole-house RFID setup (we sell consumer products.)

Problems we've had (in talking with the engineers):

1. Our product is in metal containers (within cardboard). Bad for RFID.
2. Placement is CRITICAL. Especially in a plant environment, you need to know where the RFID tag is so you can read and write it quickly; in addition to minimizing #3
3. Outside RF. We've had instances to where in a test lab, we can read and write and verify the write within 80ms, as a box is cruising by on the conveyor. Once we transition to the plant, however, it gets a little more shaky, as you have less control over where the conveyor motor is, more flourescent lights, and oh yea, there's still those damn metal cans.

RFID has a long way to go from what I've been told by our engineers. It's not as dead simple as you might think -- of course, for handheld scanners though, which require human intervention - may be 10 times easier since humans can modify the environment to see fit on the fly.

Re:My question is why?

[FutrDreams]

Well corporations will push for this for efficiency but think of possible consumer uses. Say you have portable RFID scanner and a database provided by an organization. This organization could be Greenpeace, Consumer Reports your favorite wine review site, etc. So I walk into the store and key into my scanner, show me all coffee products that are Fair Trade Certified. Show me if they have any one of my favorite 10 wines, etc. RFID tags for home use -buy a pack of say 100 tags and tag things in your house. Where's the TV remote? Take a walk w/ a scanner and oooh there it is. Moving? Tag your stuff, put it in boxes. Done. What's in my pantry? Scan it. What drinks can I make w/ things in my bar? You get the point. There are some issues w/ creating the database, and privacy issues for corporations, but I'm sure there's a place for new companies to sell that info. -Futrdreams.

Re:My question is why?

[lord sibn]

honestly, my answer to the question "aren't we efficient enough" raises a few questions in my mind. i work in logistics, so to speak. manually finding and scanning barcodes takes three times as long as the alternative: electronic invoicing (where the supplier sends an invoice over the computer). not to mention the element of human error. any number of things can throw off the invoice quantities, and such errors must be (at high cost) hunted down and resolved. to you, upcs are ambiguous. to me, they are a pain in the ass.

Re:My question is why?

[couchslug]

"Is tracking something via a barcode scanning system really so inefficient that we need RFID?"
Yes. When you ship stuff you can only optically scan the surface.
"Stuff" has depth. RFID beats manual unstacking, restacking, re-covering, etc.
External barcodes reflecting bulk contents are invalid when an item is removed but the external tag is left unchanged. RFID offers immediate inventory adjustment with each bulk scan. It goes more than one link deep, so to speak.

Re:My question is why?

[oceanofapathy]

Capacity. Would you want to deal with 40" barcodes? Sure barcode density can be increased, but you're still relying on the visible spectrum for data transfer. And consider that barcodes must be relatively flat and not damamged. RFID is a great technology. No, we are not effecient enough without it. If that's your train of thought, I'll be laughing at you while you ride your horse to work.

Re:My question is why?

[gunnk]

2. Convinence, things like being able to park a cart next to a teller and have all the items charged instantly.

See #1. I don't know any retailer that would abide by less than 99.999% accuracy. RFID does not meet this requirement at all.

If you think this is true, you need to check your receipts and count your change more frequently.

I've never seen a shop that manages 99% accuracy... the clerk fails to scan an item (doesn't notice it didn't beep), the item is in the database with the wrong price, the item scans twice, the item is missing entirely (so the clerk asks you to give them the price)...

99.999%???

Re:My question is why?

[Gr8Apes]

My receipts are certainly more than 90% accurate. Do you think retailers would accept no better than 90% as a replacement? How about 95%?

If they're going to go with something as expensive as a retrofit of RFID will be, I'm guessing they're going to want 99% or better.

Re:My question is why?

[Anonymous Coward]

Retail scan percentages in America at the moment are around 95%. That is, for every 100 items scanned via barcode, 5 items are manually typed in as generic.

I was talking to a software provider for the supermarket sector, and at a conference he was recently at, the people working on RFID technology were happy to get 60% scan rate in a real world environment.

It's likely the tech is going to take another 5-7 years before it's up to the 95%+ scan rate we need to function and trust our inventory.

Re:My question is why?

[Maxo-Texas]

Actually the checkouts are getting smarter these days.

Say that the ipod headphones weighs .307 pounds.
And that the ipod weigths .794 pounds.

An increasing number of checkouts will catch that. I don't know how sensitive they are but my gut feeling is that it is fractions of an ounce based.

Re:My question is why?

[Anonymous Coward]

We also are placing the tags on metal objects. If you have air and cardboard, it should not be a problem. Also, has your team looked at the new ceramic and foam backing to place the tag directly on the object?

We are using active tags for WIP and are placing the tags directly on the objects. These tags are expensive (+-$20), but we reuse them. We use passive tags on the shipping labels.

Also, one more thing to look out for - the noise level. Certian parts of our plants were just too loud to use passive RF technology.

By the way, is your company using integration services? If so, who?

Re:My question is why?

[Anonymous Coward]

Unfortunatly, we are not efficient enough. Here's my retail perspective on RFID...

I use to work at Staples and on average we would get 7-10 pallets of merchandise 2-3 times a week. It would take us approximatly 3-5 hours to break down an entire shipment and a full count of inventory could not be completed until the end.

With RFID, the minute the pallets came through the doors they would be scanned and a full inventory could be taken in seconds as opposed to manually scanning barcodes on each item to tally an inventory count.

Furthermore, taking regular inventory counts once the merchandise is in the store poses the same problems: lots of workers running around the store manually scanning/counting items - many man-hours worth of work (8+ hours most of the times I took part in it). RFID would reduce not only the number of hours it would take to do a full inventory, but also the number of people required.

And lastly, finding items once they are in the store. If you've ever been to any store looking for an item only to find the shelves where the item normally are to be empty, then asked someone if they could 'look in the back' to see if they have any extras. The number of hours wasted looking for stray items which are 'in-store' according to the computer is astounding. With RFID you can simply push a button to see if an item is actually present in the store or if the inventory count is incorrect and there are actually no items left. And from what I've read, they are working on (or have worked out) a means of triangulating RFID tags to actually locate items, again reducing the time it takes to find stray merchandise.

We use RFID in cars on toll roads because having everyone zoom through is far more efficent than the backups that occur when people have to stop at a tollbooth to pay the fee.

Barcodes are nice and simple, but they require individual scans. RFID can scan entire shipments all in one go.

Re:My question is why?

[samureiser]

Because you can just as easily switch price tags. I'm willing to bet most people working the registers don't have the prices of every product in their store memorized.

Furthermore, scanning saves you time on line. It doesn't make a huge difference for 3 items, but if you're at the grocery and purchasing dozens of items trust me - you notice.

Of course, this doesn't address the issue of bar codes vs. RFID... I'll leave that discussion to much more qualified /.'ers.

Re:My question is why?

[utlemming]

But I would bet that companies will push for laws banning the use of RFID scanners in businesses to prevent exactly that -- not for consumers but for competition. Imagine what a competitor would be able to pull off -- a quick walk around the store and they have the complete inventory of what the competior has and even quantities. Or, even more interesting would be a competor using an RFID scanner as people leave their competitors store. Then competitors will be able to tell what people are buying and then alter prices accordingly. Of course this would only work if the suppliers use the same RFID identification number for each retailer.

Any form of obsufication would only work for a short period of time. As the products start to leave the store, people will start to make a database for the purpouses that you described above -- and then it would only be a matter of time before competitors would buy the databases or obtain them.

Like I said, I would bet that RFID readers will be illegal to use except by the people that employ them on site.

Re:My question is why?

[Information Architec]

It's all about making the client pick up the cost. There was a time in a newspaper shop that I used to be able to drop the exact money for a newspaper on the counter with a wave of the bought item and a nod to the shop owner, nimbly avoiding the queue of people waiting to stock up on cigarettes, sweets and lotto tickets. Now I have to queue with everyone else, wasting my friggin' time doing SFA, just because the barcode scan manages the till, invenstory, re-ordering and pricing. The retailers don't give a rat's ass about the client, as long as it saves/makes them money. RFID is in the same vein but takes it all the more further. Now you don't even know if the goods have a RFID chip or not, or what it might be used for, or how long it stays. Here's some ideas: - customer profiling in store: which items attract attention (detect when goods removed from shelf and how often before being purchased)? - customer loyalty: how often does a customer - who's bought an item of clothing here before - return wearing said item (the chip's still in there: did you think otherwise?); - turnaround time: mean time from being shelved to being checked-out; - spending patterns: cooperation between different stores to identify "their" customers by noting "friendly" RFIDed products coming into their stores; If you think any of this is fantasy, get along to an RFID conference soon....

Will this affect me?

[Onymous Hero]

My company is rolling out RFID badges for all staff to streamline our security and help reduce the amount of late employees etc - is this something that could be a problem or is it just theoretical?

Re:Will this affect me?

[AnonymousPrick]

My company is rolling out RFID badges for all staff to ... help reduce the amount of late employees etc...

I'm just curious, will the company also compensate the employees who are working more hours - even if they are coming in late?

I know, if you said something like this, they'd call you in and tell you "what a bad attitude you have." or that "you're not a team player."

Yeah, I'm bitter....fucking corps...

Re:Will this affect me?

[Onymous Hero]

All employees are subject to regular pay reviews and these statistics will be taken into account, yes.

Re:Will this affect me?

[TripMaster Monkey]

I think what he's asking is: does the badge record the leaving time as well as the arrival time? This is a problem where I work as well...the badge records when you come in, but doesn't record when you leave, so it doesn't matter if you stay late to finish a project...all the management cares about is when you got there in the morning.

I don't work late anymore.

Re:Will this affect me?

[pushf popf]

I'm just curious, will the company also compensate the employees who are working more hours - even if they are coming in late? I know, if you said something like this, they'd call you in and tell you "what a bad attitude you have." or that "you're not a team player." Yeah, I'm bitter....fucking corps...

Don't be bitter. Life is too short to suck

Let them do what they want, you do what you can do without making yourself crazy, and if in the end, they don't like it, you can go find a better job, or they can fire you and you can collect unemployment and then get a better job.

No employer can abuse you any more than you're willing to accept. I got laid of from a crappy job a couple of years ago where I was a "slacker" because I was only working 9am until 9pm, not 8am to midnight like most of the others.

Best thing that ever happened to me. I got a month of paid vacation in the middle of the summer (unemployment), then got a much better job with normal hours.

Re:Will this affect me?

[daniel422]

Honestly, that type of system seems to have too many loopholes to be used for timecard purposes. RFID badges are quite common in corporate life -- and have been used for years to open doors and the like by waving your badge in front of it (HID is probably the most popular maker). All RFID is not created equal. Here is a white paper from HID's site on the differences between typical RFID inventory-tracking technologies versus smart card technologies: http://www.hidcorp.com/pdfs/whitepaper_tags_vs_sma rtcards.pdf Both are RFID, but the level of security and use is vastly different.

Wait...

[GundamFan]

Realy how is this diffrent from an email virus? it's not like they can reprogram "good" RFID tags into "bad" ones can they?

Re:Wait...

[TheLogster]

If the bad RFID tag infects a system that has the right "bits" attached to write RFID tags. The it would be possible for the infected system to write out new bad RFID tags, or event rewrite good RFID tags - turning them bad....

Re:Wait...

[GundamFan]

I see... so really all you need to do is secure the scaning computers from the attack just like a traditional virus. It was unclear to me if the tags could talk to each other, I was prety sure they couldn't.

No wonder people get scared... if somone with a good grasp of computer tech can get confused here imagine how your grandparents fell.

haven' read the article but...

[Anonymous Coward]

April 1st is still a couple of weeks away

Virus? I think not.

[uniqueUser]

I understand that a virus could preform an SQL injection or a buffer over run, but these activities are not what defines a virus.

In computer security technology, a virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents...-Wikipedia

Re:Virus? I think not.

[TripMaster Monkey]

If the SQL injection or buffer overrun instructs the middleware system to overwrite all RFID tags subsequently scanned with the exploit code, that's pretty self-replicating, isn't it?

Re:Virus? I think not.

[StupidKatz]

AFAIK, at this point, RFID tags are WORM. Trying to wirelessly *overwrite* an RFID chip would, as I understand it, do nothing other than potentially fry the chip, due to the way the chips are made - they don't have any write capability, so it would be akin to trying to re-write a pressed CD with a sooped-up laser.

At that point, I'd be more afraid of the EM emissions than any RFID dastardliness.

Re:Virus? I think not.

[uniqueUser]

Yes, if it could some how insturct the reader to copy instructions to other tags, then yes, I would define that as a virus. But that takes more than just simply sending an SQL injection or over running some buffer. Tags can be build for read/write, so this could become a possiblily.

Re:Virus? I think not.

[tomstdenis]

They are just supposed to be unique identifiers. For all it matters they could be random strings of 128-bits.

The point is you use the RFID tag as a key in your database.

Say I receive 12 widgets from a company to put on my shelf. Each widget has an RFID tag. I enter each of them into my database. Now as I sell them they're scanned the tag is used to search the database [e.g. it's the key] and I mark it as gone.

The actual value of the tag doesn't matter so long as it's unique. E.g. two widgets don't have the same ID. So for all intents and purposes you could order a box of 5000 random RFID tags and make good use of them.

Tom

Re:Virus? I think not.

[Anonymous Coward]

Nope, there are rewritable tags but they are more expensive than read only ones.

Re:Virus? I think not.

[farker haiku]

virus is a self-replicating program that spreads by inserting copies of itself into other executable code

From the linked pdf: To prove our point, this paper will present the first self-replicating RFID virus.

So, um, yeah. Maybe, just maybe, you should RTFA. I know, I know. Pipedream.

Re:Virus? I think not.

[Anonymous Coward]

Yes, but then that would be a software virus. RF technology is not the all ending technology. These tags are really not that "smart". They carry a "key" and some of the more expensive ones can carry environmental info (temperture). It is the software that pulls the "trigger".

So, keep your network safe and the tags will fall in line. They only do what you tell them to.

Re:Virus? I think not.

[honkycat]

That's true of most existing schemes, but more and more, manufacturers and end users are interested in actually encoding data in the tag itself. Some modern RFID tag protocols allow for an arbitrarily large address space on the tag. They also include security measures (basically, a password) to make it difficult to access the tag in order to prevent unauthorized altering of the data. Most if not all also include a mechanism for locking the tag down once and for all.

There is a lot of value in this. It allows the tag to be updated to contain supply chain information all the way through to the sales floor without needing to coordinate databases between the handlers. It does complicate the handling of data on the tags, though.

Re:Virus? I think not.

[Anonymous Coward]

What is the equipment used to write to them like? I highly doubt they are re-writable wirelessly... Unless they are several orders of magnitude more expensive, and thus not nearly as ubiquitous.

Re:Virus? I think not.

[uniqueUser]

So, um, yeah. Maybe, just maybe, you should RTFA. I know, I know. Pipedream.

Hangs head in shame

I apologize to you and the rest of the /. community. I will refrain from posting for 24 hours, starting now.

Mighty If-fy

[Billosaur]

From rfidvirus.org: Here is where the trouble comes in. Up until now, everyone working on RFID technology has tacitly assumed that the mere act of scanning an RFID tag cannot modify back-end software, and certainly not in a malicious way. Unfortunately, they are wrong. In our research, we have discovered that if certain vulnerabilities exist in the RFID software, an RFID tag can be (intentionall) infected with a virus and this virus can infect the backend database used by the RFID software. From there it can be easily spread to other RFID tags. No one thought this possible until now. Later in this website we provide all the details on how to do this and how to defend against it in order to warn the designers of RFID systems not to deploy vulnerable systems.

So to sum up, if some programmer doesn't do his/her job, the RFID tag they plan on implanting in our passports could be used as delivery devices to compromise computer systems around the globe.

I'm going to rate this a pretty big if, though, as we know from all the patching going on, the probability is very high. RFID software is going to have to be thoroughly tested and watched like a hawk. Undoubtedly there's going to come a point where if one or two of these viruses get out and something newsworthy happens (airport computers crash, Citigroup gets credit card data stolen, etc.), the whole idea of RFID tags everywhere is going to get a serious black eye.

Re:Mighty If-fy

[Anonymous Coward]

So to sum up, if some programmer doesn't do his/her job, the RFID tag they plan on implanting in our passports could be used as delivery devices to compromise computer systems around the globe.

Well, there goes another good plan for world domination. Darn.

G.W.

Re:Mighty If-fy

[Shadowlore]

So to sum up, if some programmer doesn't do his/her job,
we could see SQL Injection attacks, or buffer overflow vulnerabilities, or ... must I go on? It could be argued (quite well IMO) that some programmer not doing their job is part and parcel of most security vulnerabilities and code bugs.

But once it hits as you describe, the black eye will be irrelevant. By then the tech will be "crucial to the actions" of first responders, airport security, etc.. Then what happens? Congress bloviates in a "special hearing" for a week or two, the pundits speak of it a litte with each of the two media sides saying that the other side is responsible. Then maybe a scandal of the week when some Senator who voted for it is discovered to have taken money from someone who may or may not have been involved in any RFID development companies. Maybe, just maybe, there might be some RFID "security regulations" passed, but as usual the government (DHS, FBI, CIA, airport (in)security systems contractors, Congress) will exempt itself from these regulations.

And that's pretty much it.

Bonus question: how much of that was involved in the Blackberry thing? At least the exemptions part at a minimum. Obviously neither RIM nor NTP(?) donated much to the Republican party. ;)

Silly Government, technology can be hacked!

[Attis_The_Bunneh]

I believe I was discussing such scenerios with friends before and considered that one could easily pass viruses this way, especially if the RFID chips are attached to other networks. Oh joy, proof that the more control the idiots in government try to squeeze the less secure they become each time. :)

-- Bridget

Porterhouse steaks at last!

[smooth wombat]

...from altering the backoffice of a supermarket...

Cashier: Um, $1 for 2 steaks? That can't be right.
Me: Sure it is. Look at the sticker. 50 cents a pound. The steaks weigh two pounds thus $1 for two steaks. Mad cow and all that.
Cashier: Ok, if the sticker says so, it must be right. *scan* *beep!* *scan* *beep!* *scan* *beep!*

Re:Porterhouse steaks at last!

[Opportunist]

Considering that with RFID, the wet dream of supermarkets is that they don't need cashiers anymore but you just drive by with your cart and the (also RFID'd) CC in your wallet, I think that problem won't exist.

Re:Porterhouse steaks at last!

[smooth wombat]

This may be true but I still pay by check though I'm considering moving to cash, just like I do for gas. Cash only.

Yeah, it drives the credit agencies nuts because they can't track my credit history because I almost never have a credit bill (excluding my monthly ISP charge). The best they can do is see that I pay all my bills (electric, cable, etc) on time.

Merchants are certainly stymied because they can't gather enough information on me so they can't send me their snail mail spam.

No, I'm not paranoid. I just hate debt. Debt is evil. It sucks the life out of ones finances and inhibits the accumulation of wealth.

Granted, the current administration doesn't understand this but that's a whole other issue.

Re:Porterhouse steaks at last!

[Opportunist]

In 2 years you'll get a discount for paying with your card (or pay more for cash, even though they'll still call it a discount).

In 5 years you won't get anything at a huge supermarket chain anymore without card. Won't work? People will refuse to shop there? Think of some of the huge outlets that only let you IN when you got a card and go figure.

Re:Porterhouse steaks at last!

[Doctor Faustus]

No, I'm not paranoid. I just hate debt.
Why not use a check card, then?

Re:Porterhouse steaks at last!

[Egatlov]

Interesting. Last time I wrote a check the merchant ended up with quite a bit more info than if had I used my debit card. Most merchants I've written checks at require a local address and phone number on the check which. They don't have access to that information when you pay with debit/credit.

Re:Porterhouse steaks at last!

[Anonymous Coward]

There is a difference between debt and smart use of money through credit, debt is when you don't have the money to spend, smart use of credit is when you can use the money they give you to make more money.

My credit card bill is always ~$10,000 and it is paid in full every month, my money market account makes 4% so I make $400 a year and get Aeroplan miles for using their money.

I paid off my house then took out a mortgage for money that makes 9% interest on a %5 interest smart credit which I deduct from my taxes for investing.

Smart money always uses credit!

Re:Porterhouse steaks at last!

[Lord Ender]

The problem isn't the debt. The problem is YOU willingly accepting the debt.

By paying with cash, you are overpaying for everything you buy. Cash-back credit cards, when paid on time, are the equivalent of giving yourself a few percent raise every year.

Also, I think it is probably good for stores to know what kinds of good I buy. It could potentially help them keep things in stock better.

But keep overpaying with cash if that is the only way you can handle finance psychologically...

Still, you could just carry around a credit card, a wallet with 2 pockets, and some monopoly money. When you spend $5 on your card, you can move $5 of monopoly money from one pocket in your wallet to the other. When you get a paycheck, you can move all the money back. When the one pocket is empty, you stop using your credit card. That way, you can use a card, with all the financial and convenience benefits that entails, but you will never go into debt.

Meanwhile, most people will just keep track of their income/expenses in their heads.

Re:Porterhouse steaks at last!

[TubeSteak]

Think of some of the huge outlets that only let you IN when you got a card and go figure.

I have a BJ's (Sam's Club) membership.

You know how much they charge for a box of candy? $8~$10 bucks.

You know how much that same candy gets sold for by the piece? Minimum twice as much.

You won't save money on everything in the store, but you'll get your yearly fee back & start saving money if you buy in bulk. For a lot of people, it makes sense.

Awesome line

[nexcomlink]

"the virus on its tag infects the supermarket's product database, potentially wreaking all kinds of havoc such as changing prices."

Free beer anyone?

Re:Awesome line

[bloobloo]

Only if it is free as in speech too. :-)

user input

[mtenhagen]

An RFID tag is the same as any user input and can not be trusted. When your applications are programmed with this in mind from the start this shouldnt be a problem.

But ofcourse there are nowadays lots of websites which are vurnerable for sql injection and similiar hacks. Even google had a cross site scriptiog exploit.

Virus Virus

[poeidon1]

everywhere, but not a single one which is in my control.

Newcastle Brown Ale RFID

[digitaldc]

I swear it's on sale! $9.99 a case, just check the RFID tag!

I'll take 10 please.

Implications for prices

[doktorstop]

Totally fascinating... so in the near future we can expect the airport/supermarket security to immediately arrest anyone with a working IPAQ =)
Seriously thou, think of the implications! You could actually increase all the pricetags at your local Wallmarrt...

Ai Ai

[towsonu2003]

"Is Your Cat Infected with a Computer Virus?"

Call Schwarzenegger now, before my cat intentionally infects my microwave oven, which then will try to eat my dog and pass the infection along to other microwave ovens as well as american passports!

Re:Ai Ai

[Anonymous Coward]

Uh oh. We named the dog Skynet.

Pure FUD

[Anonymous Coward]

Only if the dimwits writing the RFID reading software are stupid enough to treat all rfid readings as 100% trustable OR does something stupid like allow scripting.

I can see a buffer overflow if your rfid is capable of generating a string massively larger than a normal rfid.

Outside of a SQL injection to get past a really poorly designed RFID reading application or plain stupidity in the RFID reading software part I can not see any way for a RFID to get the host reading PC to execute the code inside it.

bot-nets?

[Anonymous Coward]

I imagine in the future rfid-kiddies will have bot-nets of them causing large scale DDOS attacks on our wallets =)

overhype

[tomstdenis]

It has nothing to do with the "evilness of RFID" and with the stupidity of the backend. An RFID tag is just a string of text. It's up to the backend application to sort it out.

This really is no different than replacing the barcodes on packages.

Tom

Re:overhype

[Roy van Rijn]

Agreed... if some idiot wants to make the barcode-reader-backend execute sql code, then I can write a barcode virus too.

If they would just 'read' the RFID tag instead of putting code on it.. the only real problem they face is that the information could overflow. But that isn't so hard to counter.

Re:overhype

[tomstdenis]

Exactly. this has nothing to do with a "virus" [ooo spooky!] in the RFID tag. It's no different than SQL injection attacks on the web or user interface bugs in video games.

Design crap software, expect user stimulus to break it.

This is only "news" because it has RFID in it and everyone loves to beat up on what they don't understand.

Tom

Re:overhype

[noidentity]

"It has nothing to do with the "evilness of RFID" and with the stupidity of the backend. An RFID tag is just a string of text. It's up to the backend application to sort it out."

Someone could write really bad barcode reader software with the same vulnerability, or they could even (I know, I'm stretching things here) write software that overflowed based on how much a user typed into the keyboard. Somehow "if length > maximum" is too much to ask for.

Re:overhype

[madmaxx]

It's not just a string, it's a series of blocks that can be read as ASCII or binary data (for most tags/readers). The data can be encrypted, and the blocks can be locked (to become read-only permanently). And the applications can be smart enough, if they do not lock/encrypt the tags, to consider the data more clearly.

Problem for Schrödinger

[Bromskloss]

When he opens his box and finds that the poison is not let out, but the cat is still not alive (um, probably "dead anyway", to avoid unnecessary confusion in this matter (i.e., it won't suddenly "quantum wake up")) after having catched a RFID virus.

Minix

[richieb]

Did anyone notice that the author of the article (John Markoff) refers to Minix as "heart of Linux"? Markoff has been writing on technology for NYT for umpteen years and I'm suprised he'd write something like that!

Hmmm... on the other hand he is the one who first wrote about that dangerous hacker Kevin Mitnick...

Re:Minix

[slashdotmsiriv]

Duh, he is "part of a Tannenbaum research group in Amsterdam". He would write anything to please his Master...

Re:Minix

[REBloomfield]

Author of what article? Markoff isn't invloved in anything in the submission?

Re:Minix

[Doctor Faustus]

Tannenbaum himself has disavowed such claims, though.

Re:Minix

[richieb]

Author of what article? Markoff isn't invloved in anything in the submission?

Author of the New York Times article. John Markoff. Sorry for being unclear.

Duh, but really: DUH!

[Opportunist]

An SQL injection. Fine. OF COURSE it works if the backend application is written by some coder who has heard a few things 'bout SQL but has no idea of injections.

It's the backend that's the risk. Not the RFID tag.

Re:Duh, but really: DUH!

[SilentTristero]

No, the interesting point of TFA is that people don't understand that RFID tag data is just as untrustworthy as data you get from a random web form. That's their wakeup call: if you read and parse RFID data, sanitize it first!

multiple security systems

[peter303]

By itself RFID could be insecure. But you could retain its simplicity and its advantages (extends reading to a couple meters; longer number ID) with a second layer of security.
For example at one urban college library they put the cardholders' face immediately on the screen. The cardholder could have a fake ID or borrowed a friends, but its much harder to fake a face image. And a image is much easier for the guard to process than some descriptive text. Likewise the RFID code reader could flash an image of the product to the cashier or warehouse clerk as secondary identification.

Re:multiple security systems

[maxwell demon]

Of course this helps with switched RFID tags between products (i.e. if someone tries e.g. to buy a TV for the price of a box of potato chips). However, if the goal is to attack the system, by the time the cashier sees the image (or rather, doesn't see it) it is already too late: The attack already happened.

Free...

[Smauler]

Someone has to write a virus to completely screw up a crappily implemented system. Therefore, finally we may be able to attain the holy grail : free (as in beer) beer!

RFID Viruses? Excellent!

[Eli Gottlieb]

Good to know that the Mark of the Beast will be an insecure Mark indeed! Hell, I might even be able to hack it into a meer Mark of the Small Furry Critter.

Not pure FUD, just facts.

[Vo0k]

Except these dimwits DO treat RFIDs as trustable.
Not 'evil', just dumb. RFID reader is an insecure input device like any other, and you don't even need physical access to use it. But it seems nobody thought of preparing a barcode that could crash the cash register, recording a magnetic card that would infect the security system, etc. Some devices are thought to be too simple to mean danger - wrongly. I remember some old Atari games that would crash or misbehave if you'd open the joystick and pressed "left" and "right" simultaneously. I burnt electronics of a RC toy car by telling it to go forward and back at the same time. Got a motorbike to run backward by starting the engine by pushing it backwards. Managed to crash my cell phone by buffer overflow at battery load level sensor (it WAS a software failure!) Got a CD tray to stop halfway by simultaneously pressing the eject key and sending eject commands from the computer.

A toggle switch can be ballanced in the middle position. A pushbutton can be softly pressed make a spark-gap. Unconnected lines can be shorted. Even a single-bit input device cannot be trusted.

Re:Not pure FUD, just facts.

[PatTheGreat]

Do you specialize in creatively breaking things?

Re:Not pure FUD, just facts.

[Vo0k]

that's what the name 'hacker' comes from, doesn't it?

Re:Not pure FUD, just facts.

[Anonymous Coward]

Yep, I agree with you fully. I mean, the Atari, if they're cartridge games, they'd hold like 4K maximum.. I'll cut them some slack. And scooters etc. have no electronics, and yes even a car engine can run backwards. However..

          Modern electronics such as phones and CDs just shouldn't crash (note smartphones are fair game, but crashing while charging the phone or whatever is right out.) An example I'm familiar with are CD-ROMs. I work at a surplus computer store, and for instance with CD-ROMs.. well.. hardware-wise a lot are virtually identical. But, depending only on software quality, some lock up solid on bad CDs. Some can be jammed in an intermediate position by just pushing eject fast enough (let alone button and software like the parent). Some won't read CDRs or CDRWs for no good reason. Some just automatically return a read error on a scratched disk, rather than trying to drop the read speed and retry first. The list goes on and on. I think the worst are the LG drives -- I've seen 8x up through 40x LGs that all are unreliable with CDRs.. they will not try to read it at a slower speed than maximum. On the other hand Lite-Ons will drop to 1x before they give up reading a disk; typically even a bad disk will read at 4x or 8x. They don't lock up. Even ones that are faulty will often work acceptably.. some drives have a brake in them to stop the disk before they eject the tray. If it goes bad some brands just open the tray with this spinning disk in it, which really is quite exciting, and can scratch the disk easily.. the Lite-Ons can tell.. ones with a bad brake just take 5 extra seconds or so to open the door.. and it works. The tray pops out with a stopped disk.

Re:Not pure FUD, just facts.

[Vo0k]

> and yes even a car engine can run backwards.

Without some really serious modifications you won't start a 4-cycle engine backwards. 2-cycle - no problem.

You almost have to be an insider FIRST

[Goldenhawk]

A lot of good comments have already been made here, but I'm surprised nobody has commented yet on something that seems obvious: if you're going to hack into a system, you have to know a little bit about the system first. You can't simply design some buffer overflow exploit and trust it will "hack" the back-end system. That seems awful "Independence Day"-ish - you know, writing a virus here on Earth that somehow magically attacks and shuts down an alien computer system. Makes for exciting movies (if you're not minimally smart about computers) but it never works in the real world.

In this case, it seems to me that if you know enough about both ends of the process, sure, you can develop some method to penetrate the system. Most malware authors have the benefit of working on a very well-known platform - the Windows PC - with known software (one of the limited numbers of email or browser programs). But attacking a back-end system like this is a much more dicey proposition - each large corporation probably will have its own back end, and may be running any of a dozen OS-and-database combinations.

So to benefit from this attack, it seems to me that the author has to be an insider to stand a ghost of a chance of success. If he's an insider, there are MUCH easier ways to penetrate the system.

As a result, while I have great concerns about RFID, this strikes me as FUD.
1) Develop complicated, application-specific RFID attack that would never be real-world useful
2) Write research paper spreading more fear about RFID
3) PROFIT! (or at least get a lot of attention)

Re:You almost have to be an insider FIRST

[maxwell demon]

Scenario: Someone working at the IT department of a shop (thus having inside knowledge of the system) gets fired and wants to harm the shop. The shop will make damn sure that he will not have access to the system afterwards (and let's assume that network access is well protected, too). However, he may well be able to smuggle a malicious RFID tag into the shop. There it lies, unnoticed, until a few days later some unsuspecting customer buys the item thus tagged. As soon as the tag is read by the scanner, the attack happened.

Re:You almost have to be an insider FIRST

[rk]

"A lot of good comments have already been made here, but I'm surprised nobody has commented yet on something that seems obvious: if you're going to hack into a system, you have to know a little bit about the system first."

You're 100% right, but there will emerge from 1 to 3 dominant vendors of backend RFID systems, and they will be deployed in many places, many people will have knowledge of these systems, and help to learn about their underlying architecture will likely be found right on the vendor's website, or only a couple Google searches away. Like every other system out there, there will be a few weird custom jobs, but most of it will be off-the-shelf software that thousands of organizations use.

Today's theoretical often winds up being tomorrow's practical.

Re:You almost have to be an insider FIRST

[cagle_.25]

Are you kidding? I fully expect to read the details of hacking into RFID right here on /.

:-)

RFID Software vulnerabilities

[Philodoxx]

The problem I have with the idea of an RFID virus is that most RFID middleware is based on either .NET or Java. I'm not saying it's impossible but the prospect to propagating a virus by RFID tag becomes a whole lot harder if they have to put MSIL or Java bytecode on the tag. I've developed a few RFID applications and all of the incoming RFID data are numbers (e.g. id: 12345) and I just look that information up in a database. It's not like I'm storing "SELECT * FROM table WHERE id = 12345" on the tag and then executing it blindly.

Re:RFID Software vulnerabilities

[Mirage]

I'm not sure you understand an SQL injection attack. In your example, your query would be something like "SELECT * FROM table WHERE id = " + tagID. If the valid RFID tag gives you "12345", all is well. If the altered RFID tag gives you "12345 or 1 = 1", well, you've got a problem. If your tagID is a numeric or you check the data you receive from the tag, you'll be fine, but if you just take in the data as a string or byte array, you're susceptible to this attack. Obviously my example doesn't fall into the virus category, but it gives you an example of how the attack works.

Re:RFID Software vulnerabilities

[Philodoxx]

I'm not sure you understand how RFID tags work. There are a variety of standards on how RFID tags are encoded, all of which break down into partitioning the tag's data into segments to form the unique identifier

For the sake of argument I'll use EPC SGTIN96. In the SGTIN tag has four partitions: Filter, Company Prefix, Item Reference, and Serial Number. Each of these fields is of varying size depending on how big tag is. Typically RFID tags are 96 bits (although some tags can get up to 1Kbit), even using 7 bit ascii there's not a whole lot you can fit in 96 bits. When I poll the reader, or the middleware I'm getting back a number, e.g. 12345 and it's my responsibility to parse through that number to get the fields I'm interested in. In this scenario I would have to be doing some *very* sloppy programming to open myself to an SQL injection attack (something along the lines of treating known numeric data as a string).

ISO and EPC Gen 2 tags do support custom data, which I suppose could be used to store strings but since it is severely space constrained (typically in the range of 2-32 bytes) I question the viability of such an attack. Not to mention that the field will likely be used to writing in ids instead of human readable data. Finally, it is common to encrypt the custom payload on an rfid tag. So even if somebody were to change it to "AND 1 = 1" it would be caught when the program tries to decrypt the tag.

Solution is easy...

[Anonymous Coward]

Simply disinfect the offending device with a RFID zapper . Oh, wait...

And in other news

[dan the person]

Security researchers have discovered that accepting input from a webpage can expose you to viruses if your webserver software is vunerable to viruses.

Tanenbaum not Tannenbaum

[Multichill]

Andrew S. Tanenbaum to be exact.

Ludicrously dumb

[Anonymous Coward]

This has to be one of the most ridiculous pieces of headline-grabbing misinformation I've ever seen - their 'scenarios' are so contrived as to be completely laughable. Unfortunately this is just the sort of junk that the avarage idiot jounalist latches onto to further spread misinformation and nonsense.
You could write similar 'scenarios' with barcodes, but nobody would notice, just becasue some ignorant people seem to theing RFID is some kind of magic, they will probably believe this and the industry will likely suffer damage as a result.

Why we switched - save you money

[ACMENEWSLLC]

These are all RFID in action saving you money. They save you money because they save truckers money;

http://www.illinoistollway.com/portal/page?_pageid =57,1302257,57_1302270&_dad=portal&_schema=PORTAL

http://www.ezpassde.com/

http://www.sunpass.com/

http://www.prepass.com/

Weight in motion, which usually uses RFID;

http://science.howstuffworks.com/question626.htm

We've been doing RFID since 1996. It's not new technology. We are just talking about new applications.

It's hard...

[jesterpilot]

the difference between 'Deutsch' and 'Dutch'.

Article is crap

[RagingChipmunk]

The article is crap. More clueless acedmia. Hello - did anyone at this prestigous institute actually TRY to write a virus for the RFID tag? The article implies they might have. But, frankly, i doubt it - as an RFID tag has about 256 bytes of capacity. Wow, what horrible evil virus could be unleashed in 256 bytes.

Fouling up sloppy backend SQL code is one thing. Implying that my infected cat will slow to a crawl, barf up pr0n-storm hairballs and begin all night cries of "Viagra! Cialis!" because of its RFID tag is just rediculous.

Oh no!!!

[AnomaliesAndrew]

With Bluetooth enabled vehicles and RFID national/state ID cards coming into the picture, this might be the first time where a drivers license actually causes a person's car to crash! (pun)

-@

Gah... SQL Injection?

[Mr Z]

When will data-as-code die already? SQL injection, shell escaping vulerabilities, buffer-overflow attacks leading to arbitrary code execution, etc... All of these reflect ignorance of one common security principle: SEPARATE DATA FROM CODE.

We can eliminate all of these if the structure of the code is immutable with respect to the data it manipulates.

That's not to say that buffer overruns or corrupt data couldn't cause other mischief. But, at the very least, you could actually prove the mathematical correctness of your program if you can guarantee that the code you see in the source (and the libraries it links) is the only code that can execute. If a data input could become part of the code, all bets are off.

The fact that SQL queries are held in strings and look like data to the host programming environment is bad design from a security standpoint. A similar statement can be made for shell scripts. The fact that the semantics of a shell statement (such as "what commands are present") aren't known until after variable expansion has lead to how much havoc?

Now, I suppose some of you might read this as "Well, you can't write provably correct interpreters then!" Not true. The interpreter itself must treat all of the interpreted program as data and keep it separate from the interpreter's code. e.g. I shouldn't be able to subvert bash's internal programming with a shell script. In the interpreted language, none of the data manipulated by the interpreted language should ever be able to become part of the interpreted program—e.g. no input to a shell script should ever become part of the shell script's programming. As long as you construct those barriers—that the data manipulated by one layer of programming is never considered code at that same layer of programming—you eliminate these data-as-code attacks at that layer.

--Joe

viral misnomer

[Thaelon]

There is nothing viral about this story. It is just an RFID reader buffer overflow vulnerability. There may only ever be one tag involved in an attack; only the RFID reader software is affected, not other tags.

Why do the editors approve stories with such blatant buzzword abuse?

Re:viral misnomer

[SilentTristero]

Ummm, no. It uses the data in an evil tag to create a SQL injection attack which causes the vulnerable backend db to infect other tags (admittedly in a contrived but quite possible scenario). It is definitely viral. (They show other attacks such as buffer overflows which are not viral as well.)

I can see the RFID nametags

[nuzak]

--------
HELLO, My Name is
";UPDATE Users SET name = "nuzak";
--------

Now you are all nuzak.

An ounce of prevention

[Anonymous Coward]

First I want to state I did RTFA, and it does make a lot of assumptions about RFID middleware. However, as stated previously, these assumptions can be applied to any system that interprets data from an external source (SQL servers, web services, etc.).

I've worked with three different makes/models of RFID readers and their associated tags (both passive and active), all of which use only alpha numerics in their ID scheme. A simple check that the incoming data adheres to this rule will eliminate the possibility that symbols such as apostrophes, parenthesis, and semi-colons can be inserted. Also, all of the ones I've used do not send the RFID tag as text. They store the tag as bytes. In software I've worked on, they were converted to hex to further reduce the possibility of malicious data being picked up. Furthermore, their size is extremely limited, being only four bytes each.

Also, the SQL examples presented by this article assume all SQL servers adhere to the same SQL syntax. For a solution with multiple possible database back-ends, this hack would only work in some cases.

Admittedly, I cannot speak to systems which pass the tags as text, which is what this article appears to primarily focus on. However, for anybody with half-a-conceren about security, this article is a big, fat DUH! Hopefully all developers (not just RFID) have more than half-a-concern about security.

emergence of the beast!

[boojumbadger]

We have finally discovered the beast of the apocalypse! A sentient computer virus spread by rfid! NANO NANO neener

cool!

[Tumbleweed]

Now every store is a dollar store! :)

Tanenbaum

[GerardM]

Sorry, I can reliably inform you that Mr Tanenbaum was amused that you could not get his name right.. As they say; it does not matter what they write as long as they get the name right.. :)

Yeah, well, that's what I used to think

[Anonymous Coward]

I always assumed that sql-injection was only useful if the attacker could guess something about the database tables. Then I went to a presentation by a white-hat hacker, who showed us how to use sql-injection to read the system tables and suck down an entire database automatically. Then he showed us a script that googled for potentially vulnerable servers and tried that hack against them. He said phishing is for amateurs...organized crime groups in Russia are using scripts like this to suck down databases on a massive scale so they can sift through them later.

Not directly analogous, I know, but I gained a new respect for zero-knowledge attacks.

RFID is MUCH different than I originally thought.

[FiberData]

My original understanding of RFID was that it was just one really long (96 bits or longer) ID (number) and nothing else. I didn't realize there was any way to STORE information on the RFID tag.

Now I'm more concerned with RFID that I was originally. If it was just an immutable ID then I only see privacy concerns, but not "hacking" concerns from the RFID tag itself.

Since evidently some versions can actually store user data then this opens it up to a whole new class of problems.