Slashdot Mirror
RFID & Viral Vulnerability
Arleo writes "Student Melanie Rieback and others, part of a Tannenbaum research group in Amsterdam, have proven that RFID-tags are vulnerable for infection with viruses. In a research paper titled
"Is Your Cat Infected with a Computer Virus?" is shown how an altered RFID tag can be used to send a SQL injection attack or a buffer overflow. They describe on the rfidvirus.org website possible exploits of this types of viruses: from altering the backoffice of a supermarket to spreading RFID viruses by infected bags on airports."
Fascinating stuff, but it seems that the game plan for protecting against RFID malware is basically the same as protecting against more traditional malware...namely, enforcing proper bounds checking, enforcing proper database permissions heirarchies, disabling back-end scripting languages, isolating the vulnerable RFID middleware server in a proper DMZ environment, etc.
In other words, RFID malware has just as bright a future as the more traditional flavor, since most developers and administrators can't be bothered to take these elementary precautions.
____
~ |rip/\/\aster /\/\onkey
Student Melanie Rieback and others, part of a Tannenbaum research group in Amsterdam, have proven that RFID-tags are vulnerable for infection with viruses.
American oak tree research groups and Swedish aspen tree research groups have responded by working around the clock to fix this security hole. Never before have groups centered on deciduous trees been so involved in computer security.
My work here is dung.
I don't understand why we _have_ to use RFID at all. I understand it may make some things easier, but aren't we efficient enough? In these days where security is becoming more and more of an issue, why even creating another security issue when the old way still works. Is tracking something via a barcode scanning system really so inefficient that we need RFID? I don't understand, we seem to be pretty efficient in most industries already, why do we need to squeeze another cent an hour out by using some new and relatively unproven technology when the old way works just fine?
Judges and senates have been bought for gold; Esteem and love were never to be sold.
My company is rolling out RFID badges for all staff to streamline our security and help reduce the amount of late employees etc - is this something that could be a problem or is it just theoretical?
I understand that a virus could preform an SQL injection or a buffer over run, but these activities are not what defines a virus.
In computer security technology, a virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents...-Wikipedia
GENERATION 25: The first time you see this, copy it into your sig on any forum and add 1 to the generation. Social exper
From rfidvirus.org: Here is where the trouble comes in. Up until now, everyone working on RFID technology has tacitly assumed that the mere act of scanning an RFID tag cannot modify back-end software, and certainly not in a malicious way. Unfortunately, they are wrong. In our research, we have discovered that if certain vulnerabilities exist in the RFID software, an RFID tag can be (intentionall) infected with a virus and this virus can infect the backend database used by the RFID software. From there it can be easily spread to other RFID tags. No one thought this possible until now. Later in this website we provide all the details on how to do this and how to defend against it in order to warn the designers of RFID systems not to deploy vulnerable systems.
So to sum up, if some programmer doesn't do his/her job, the RFID tag they plan on implanting in our passports could be used as delivery devices to compromise computer systems around the globe.
I'm going to rate this a pretty big if, though, as we know from all the patching going on, the probability is very high. RFID software is going to have to be thoroughly tested and watched like a hawk. Undoubtedly there's going to come a point where if one or two of these viruses get out and something newsworthy happens (airport computers crash, Citigroup gets credit card data stolen, etc.), the whole idea of RFID tags everywhere is going to get a serious black eye.
GetOuttaMySpace - The Anti-Social Network
Cashier: Um, $1 for 2 steaks? That can't be right.
Me: Sure it is. Look at the sticker. 50 cents a pound. The steaks weigh two pounds thus $1 for two steaks. Mad cow and all that.
Cashier: Ok, if the sticker says so, it must be right. *scan* *beep!* *scan* *beep!* *scan* *beep!*
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
"the virus on its tag infects the supermarket's product database, potentially wreaking all kinds of havoc such as changing prices."
Free beer anyone?
An RFID tag is the same as any user input and can not be trusted. When your applications are programmed with this in mind from the start this shouldnt be a problem.
But ofcourse there are nowadays lots of websites which are vurnerable for sql injection and similiar hacks. Even google had a cross site scriptiog exploit.
200GB/2TB $7.95 Coupon: SAVE90DOLLAR
I swear it's on sale! $9.99 a case, just check the RFID tag!
I'll take 10 please.
He who knows best knows how little he knows. - Thomas Jefferson
Only if the dimwits writing the RFID reading software are stupid enough to treat all rfid readings as 100% trustable OR does something stupid like allow scripting.
I can see a buffer overflow if your rfid is capable of generating a string massively larger than a normal rfid.
Outside of a SQL injection to get past a really poorly designed RFID reading application or plain stupidity in the RFID reading software part I can not see any way for a RFID to get the host reading PC to execute the code inside it.
It has nothing to do with the "evilness of RFID" and with the stupidity of the backend. An RFID tag is just a string of text. It's up to the backend application to sort it out.
This really is no different than replacing the barcodes on packages.
Tom
Someday, I'll have a real sig.
When he opens his box and finds that the poison is not let out, but the cat is still not alive (um, probably "dead anyway", to avoid unnecessary confusion in this matter (i.e., it won't suddenly "quantum wake up")) after having catched a RFID virus.
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
By itself RFID could be insecure. But you could retain its simplicity and its advantages (extends reading to a couple meters; longer number ID) with a second layer of security.
For example at one urban college library they put the cardholders' face immediately on the screen. The cardholder could have a fake ID or borrowed a friends, but its much harder to fake a face image. And a image is much easier for the guard to process than some descriptive text. Likewise the RFID code reader could flash an image of the product to the cashier or warehouse clerk as secondary identification.
Good to know that the Mark of the Beast will be an insecure Mark indeed! Hell, I might even be able to hack it into a meer Mark of the Small Furry Critter.
Except these dimwits DO treat RFIDs as trustable.
Not 'evil', just dumb. RFID reader is an insecure input device like any other, and you don't even need physical access to use it. But it seems nobody thought of preparing a barcode that could crash the cash register, recording a magnetic card that would infect the security system, etc. Some devices are thought to be too simple to mean danger - wrongly. I remember some old Atari games that would crash or misbehave if you'd open the joystick and pressed "left" and "right" simultaneously. I burnt electronics of a RC toy car by telling it to go forward and back at the same time. Got a motorbike to run backward by starting the engine by pushing it backwards. Managed to crash my cell phone by buffer overflow at battery load level sensor (it WAS a software failure!) Got a CD tray to stop halfway by simultaneously pressing the eject key and sending eject commands from the computer.
A toggle switch can be ballanced in the middle position. A pushbutton can be softly pressed make a spark-gap. Unconnected lines can be shorted. Even a single-bit input device cannot be trusted.
Anagram("United States of America") == "Dine out, taste a Mac, fries"
A lot of good comments have already been made here, but I'm surprised nobody has commented yet on something that seems obvious: if you're going to hack into a system, you have to know a little bit about the system first. You can't simply design some buffer overflow exploit and trust it will "hack" the back-end system. That seems awful "Independence Day"-ish - you know, writing a virus here on Earth that somehow magically attacks and shuts down an alien computer system. Makes for exciting movies (if you're not minimally smart about computers) but it never works in the real world.
In this case, it seems to me that if you know enough about both ends of the process, sure, you can develop some method to penetrate the system. Most malware authors have the benefit of working on a very well-known platform - the Windows PC - with known software (one of the limited numbers of email or browser programs). But attacking a back-end system like this is a much more dicey proposition - each large corporation probably will have its own back end, and may be running any of a dozen OS-and-database combinations.
So to benefit from this attack, it seems to me that the author has to be an insider to stand a ghost of a chance of success. If he's an insider, there are MUCH easier ways to penetrate the system.
As a result, while I have great concerns about RFID, this strikes me as FUD.
1) Develop complicated, application-specific RFID attack that would never be real-world useful
2) Write research paper spreading more fear about RFID
3) PROFIT! (or at least get a lot of attention)
--Brandon / Split Infinity Music
The problem I have with the idea of an RFID virus is that most RFID middleware is based on either .NET or Java. I'm not saying it's impossible but the prospect to propagating a virus by RFID tag becomes a whole lot harder if they have to put MSIL or Java bytecode on the tag. I've developed a few RFID applications and all of the incoming RFID data are numbers (e.g. id: 12345) and I just look that information up in a database. It's not like I'm storing "SELECT * FROM table WHERE id = 12345" on the tag and then executing it blindly.
Oh, a lesson in history from Mr. I'm my own grandpa.
These are all RFID in action saving you money. They save you money because they save truckers money;
d =57,1302257,57_1302270&_dad=portal&_schema=PORTAL
http://www.illinoistollway.com/portal/page?_pagei
http://www.ezpassde.com/
http://www.sunpass.com/
http://www.prepass.com/
Weight in motion, which usually uses RFID;
http://science.howstuffworks.com/question626.htm
We've been doing RFID since 1996. It's not new technology. We are just talking about new applications.
--------
HELLO, My Name is
";UPDATE Users SET name = "nuzak";
--------
Now you are all nuzak.
Done with slashdot, done with nerds, getting a life.