Virus Jumps to RFID

MrShaggy writes "According to a BBC article, researchers have been able to make the jump between RFID tags and viruses. They found that the mere act of scanning a mere 127 bytes could cause an attack vector that would corrupt databases. From the article;'"This is intended as a wake-up call," said Andrew Tanenbaum, one of the researchers in the computer science department at Amsterdam's Free University that did the work revealing the weaknesses on smart tags. "We ask the RFID industry to design systems that are secure," he said.'"

Comments

Re:FUD?

[LiquidCoooled]

If the tag data is expected to be an alphanumeric code to represent the customer: Slashdot_LiquidCoooled_634315

this can be used (incorrectly) to produce a raw piece of SQL:

select * from Customers where Code='Slashdot_LiquidCoooled_634315'

if that code contains quotes and they are not being handled correctly then it is certainly possible to corrupt the database.

Suppose my RFID was programmed with something like this and it was not being validated correctly:

'; Drop table [customers];

The resulting SQL could end up something like:

select * from Customers where Code=''; Drop table [customers];'

bye bye customers table (if permissions set at defaults and the wind is blowing your way)