Slashdot Mirror
Long Range RFID Hacking Tool To Be Released At Black Hat
msm1267 writes "Next week at the Black Hat Briefings in Las Vegas, a security researcher will release a modified RFID reader that can capture data from 125KHz low frequency RFID badges from up to three feet away. Previous RFID hacking tools must be within centimeters of a victim to work properly; this tool would allow an attacker or pen-tester to store the device inside a backpack and it would silently grab card data from anyone walking close enough to it.The researcher said the tool will be the difference between a practical and impractical attack, and that he's had 100 percent success rates in testing the device. Schematics and code will be released at Black Hat as well."
Plus it's built using an Arduino.
...as in, almost though not quite enough to reach into an American's personal bubble, but totally workable in Japan.
Ezekiel 23:20
"Long" is a relative term. When going from a few centimeters to a meter, that's a an increase of 20 or thirty times.
A rifle is long range compared to a pistol. A mortar is long range compared to a rifle. A cruise missile is long range compared to a mortar.
You do realize the difference between low frequency and high frequency RFID right?
Allow me to answer in Haiku:
What you found yells loud,
while this new device can hear,
barely a whisper
You never realize how much manually made unmanaged "linked" lists suck, till you have src.link.link.link.link...
I believe it has to do with frequency. He's looking at the 125KHz range, which Wikipedia lists a range of about 10cm. The link you posted is for 860-928MHz, which Wikipedia lists as having a rnage of up to 12 meters.
http://en.wikipedia.org/wiki/Radio-frequency_identification#Frequencies
I don't think you want an RFID-proof wallet so much as a radio frequency blocking wallet. An RFID-proof wallet would just be silly, because then where would you keep your RFIDs?
According to a relative of mine in law enforcement this attack is already in play in several major cities. Generally targeting Apple stores as the cards that are collected are more-likely to have higher limits and available balances. The CC thief generally stands at the entrance to the store with a backpack, and is automatically uploading card details to a central host. Those details are then written to blank cards and used in Casinos in Las Vegas within a matter of hours.
ungggghhhh
You can tell an RFID enabled card pretty easily. It's not kept secret. Your first clue should be the printing of the distinctive "radiating four parenthesis" logo that advertises "RFID within".
Second, if you have a card that you might suspect has RFID in it, but you're not sure, look carefully at the surface of the card, particularly the reflections of light on the smooth surfaces. If the card has an embedded chip, it's often visible as a small (5mm, 3/16") squarish dimple, either on the back or the front of the card. Sometimes the dimple is parallel to the edges of the card, but some HID cards have the chip set at a 45 degree angle in a corner of the card. HID cards also commonly have their ID number printed along an edge with a dot matrix printer.
Usually, though, it's not a mystery. The banks or the issuers put the RFID chip in the card because they intend for you to use it, not because they like to spend money on secret chips you won't use.
John
125KHz is the same freq. that they use in the little rfid pills they inject to your pets...
I'd love to be able to track / control my pets around the house with this
- Sick cat? only give it access to one of the litter boxes.
- Cat with different dietary requirements? Give them each their own bowl that are 5+ feet away from each other and have it with a door / retractable cover.
- Outdoor cat? Have the cat door unlock when it gets close to it, but only for that one cat.