Actually, the Gen 2 RFID tags that will be in use by retailers have an ideal range of around 25-30'. With special equipment you can read even farther. Also, RFID tags typically only store data so your worm scenario is entirely unlikely. RFID tags that retailers typically use store only RFID equivalent of a bar-coded UPC. It would take a very poorly written program to take data off an RFID tag and 'run' it. Not to say this can't happen (see SQL injection) but it's so unlikely.
There was an article that was posted with a 'proof of concept' RFID virus. Totally bogus from the outset. They wrote a program that used RFID in non-standard ways, then programmed a non-standard RFID tag that their non-standard program read and then executed the tag information.
Also, in response to an earlier poster the Gen 2 RFID tags already have a built-in kill switch. You can send a command to the tags that will deactivate them. So, coming up with complicated schemes for destroying RFID tags is a bit overblown. Also, I've been led to believe that a couple seconds in the microwave will also deactivate them.
I'm a little dismayed about the fearmongering surrounding RFID. I do think that the implications of technology that can conceivably be used to track people need to be discussed but I think it is possible to do it without being a sensationalist.
There are different types of open. Your point is hardly at all related to the article. Just revealing some of their process will no doubt be very useful to developers who also develop code that needs to be secured. Also, providing more details on vulnerabilities might be useful to people who are protecting corporate networks. Obviously, what you meant is that this effort won't be popular with the best developers with a chip on their shoulders.
We do the exact same thing (develop software that runs on mobile devices for inventory management and bar code data collection) with a large variety of manufacturers' devices. CE.NET has been a breeze to work with and incompatibilities have been minor. Yes, each manufacturers' devices do have different scanning routines and some are -wildly- different. But, Windows Mobile has been a nightmare... We embed the IE component into our application for rendering. Windows Mobile's browser is just not even close to fully functional. Limited DOM and strange quirks to the way it works. Enough to make you want to pull your hair out.
Our applications are natively developed so we don't deal with Compact Framework. It certainly seemed the right idea five years ago. So far it has served us well. The thing that really gets me about Windows Mobile is the horrid user interface on the device. Applications don't really close and I find the user interface to be atrocious. Perhaps it's a familiarity issue.
Well, this is an opportunity for me to toot my own horn, so to speak. It sounds like what we offer might be a bit overkill for what you need right now but our software, Co-Log/Open might be something to look at when you want to start integrating portable (and fixed) bar code data collection terminals into your various system. Our products are designed for companies that want to track inventory and labor on shop floors, although it's really a data collection system toolkit. We use our own system internally for tracking our inventory and tracking RMAs. We use Quickbooks but haven't upgraded to a recent enough version to really try direct integration, though what I've looked at shows the integration will not be very difficult. Bar codes might be something to look at a little further down the line but systems are getting inexpensive enough that smaller and smaller businesses are taking advantage of them. And the nice thing is that our system has the capability to integrate into a variety of back end systems so you're never stuck.</shamelessplug>
When a pimply faced cracker does the same thing (call up people in order to gain illegal access to a system) it's called social engineering and fuck-as-hell illegal.
Profane ranting aside, I believe you're wrong. 'Social engineering' is not at all illegal. It's -acting- on that information [i.e. the commission of a crime] that's illegal. Certain types of social engineering may be illegal (such as claiming you're a police officer) but lying to someone and having them trust you isn't a statutory crime I'm aware of.
As others have pointed out just get a really good NDA (which I'm sure the bank has probably already insisted on anyhow). The benefit of 3rd party code review is that they just might actually turn up a vulnerability in your software. This is just like having someone pay you to help you validate your software. At the end of this you can say your software has been validated by Fortify.
This is the view of an outsider to the project; I'm speaking strictly as a user here. It appears that the in particular Firefox and Thunderbird were brought along to certain level of functionality and usability and now are floundering. Critical security problems are being addressed but very old usability bugs stick around for years. It's the small things that tend to drive a person over the edge. That last bit of polish that makes the difference between a 'commercial' application and an open source one. I had high hopes that Firefox 1.5 would raise the bar even more but thinking back, I can't think of what was significant about the 1.5 release now. I think it was fixing the automatic updates, which was pretty critical.
It would be interesting to compare the number of different versions of software and applications this covers. Windows XP has not evolved tremendously in the last several years. Certainly Microsoft has shown a renewed (if not a completely successful) focus on security lately. But I think Microsoft benefits in this survey from a more stately release cycle.
Microsoft are the greatest company in the world and managed by a genius.
Bill, Seattle
This one made me chuckle. Nice to see the press with a sense of humor. I can't tell whether it's funnier because of the 'Microsoft are' British-ism or not.
This seems like a fantastic installation for an interactive meuseum. Or, make a USB version and we can set it up on the PC and let Junior go nuts. It'd also do well on consoles, I think. Hmm, this might have more application than I first thought!
I imagine with a little craftwork, a cheap USB camera and a little FOSS you could make one of these yourself.
Quote: He explained that when a department has a small number of simple Office macros and templates, but a large number of complex applications, it is easier to switch to OpenOffice on Windows before switching to Linux.
What you missed was the 'large number of complex applications.' To me this implies that there are applications (outside of Office) that will need to be 'transitioned.' They'll need to wean people off the applications or create Linux-compatible equivalents.
Why did they not simply pursue a GUI for the ][ series instead of branching off with a completely different product?
They did, the Apple IIgs: http://en.wikipedia.org/wiki/Apple_IIgs
A friend of mine upgraded to one of these. I seem to recall it was about this time that the Amiga came out. This was when I moved off the Apple ][. Despite the claims of 'Apple ][ forever', Apple killed off the ][ line.
Actually, this is one of the problems I have. I want to install Linux once and not have to fret over 'Did I choose a distro I'm going to regret?' Will I choose one with KDE and then decide I really wanted Gnome? Will my distro have an easy to use patch/download system that will update frequently enough that I can get the things I want when I want them? I haven't found good answers to these questions.
I realize that I can overcome all these problems by downloading tarballs and building things myself. But the fact of the matter is I don't want to do that much tinkering.
I work in the Auto-ID industry and, unfortunately, the proponents of RFID are really working the hype machine. RFID, as others have pointed out, still is an immature technology. There are many hurdles to be overcome before it can really be used effectively. Add in to that the costs of current systems and you won't have widespread adoption where bar codes are now.
Some of the problems with RFID:
Filtering the massive amount of data that can be collected
Gen 2 standards still not finalized
Cost
Can require a reconfiguration of business process to get full benefit
Limited amount of information can be stored in a tag
Bar codes are cheap, easy to train users to read, and are often used for different purposes than RFID is envisioned. Currently, most RFID labels include one or more bar codes for backup reading and for storing additional information not contained on the RFID chip.
I think RFID will make great strides and the technology will begin to be pushed down into smaller and smaller manufacturers/retailers but it's still many years off.
Roy
http://www.data-net.com/
Slashdot Mirror
Actually, the Gen 2 RFID tags that will be in use by retailers have an ideal range of around 25-30'. With special equipment you can read even farther. Also, RFID tags typically only store data so your worm scenario is entirely unlikely. RFID tags that retailers typically use store only RFID equivalent of a bar-coded UPC. It would take a very poorly written program to take data off an RFID tag and 'run' it. Not to say this can't happen (see SQL injection) but it's so unlikely.
There was an article that was posted with a 'proof of concept' RFID virus. Totally bogus from the outset. They wrote a program that used RFID in non-standard ways, then programmed a non-standard RFID tag that their non-standard program read and then executed the tag information.
Also, in response to an earlier poster the Gen 2 RFID tags already have a built-in kill switch. You can send a command to the tags that will deactivate them. So, coming up with complicated schemes for destroying RFID tags is a bit overblown. Also, I've been led to believe that a couple seconds in the microwave will also deactivate them.
I'm a little dismayed about the fearmongering surrounding RFID. I do think that the implications of technology that can conceivably be used to track people need to be discussed but I think it is possible to do it without being a sensationalist.
There are different types of open. Your point is hardly at all related to the article. Just revealing some of their process will no doubt be very useful to developers who also develop code that needs to be secured. Also, providing more details on vulnerabilities might be useful to people who are protecting corporate networks. Obviously, what you meant is that this effort won't be popular with the best developers with a chip on their shoulders.
We do the exact same thing (develop software that runs on mobile devices for inventory management and bar code data collection) with a large variety of manufacturers' devices. CE.NET has been a breeze to work with and incompatibilities have been minor. Yes, each manufacturers' devices do have different scanning routines and some are -wildly- different. But, Windows Mobile has been a nightmare... We embed the IE component into our application for rendering. Windows Mobile's browser is just not even close to fully functional. Limited DOM and strange quirks to the way it works. Enough to make you want to pull your hair out.
Our applications are natively developed so we don't deal with Compact Framework. It certainly seemed the right idea five years ago. So far it has served us well. The thing that really gets me about Windows Mobile is the horrid user interface on the device. Applications don't really close and I find the user interface to be atrocious. Perhaps it's a familiarity issue.
I'm not sure why this was modded funny. Obviously the moderator didn't actually follow the link to see that it's a serious piece.
http://www.dilbert.com/comics/dilbert/duh/ Although this doesn't really address your technical questions exactly, there are surprisingly a lot of good ideas in there.
Well, this is an opportunity for me to toot my own horn, so to speak. It sounds like what we offer might be a bit overkill for what you need right now but our software, Co-Log/Open might be something to look at when you want to start integrating portable (and fixed) bar code data collection terminals into your various system. Our products are designed for companies that want to track inventory and labor on shop floors, although it's really a data collection system toolkit. We use our own system internally for tracking our inventory and tracking RMAs. We use Quickbooks but haven't upgraded to a recent enough version to really try direct integration, though what I've looked at shows the integration will not be very difficult. Bar codes might be something to look at a little further down the line but systems are getting inexpensive enough that smaller and smaller businesses are taking advantage of them. And the nice thing is that our system has the capability to integrate into a variety of back end systems so you're never stuck.</shamelessplug>
When a pimply faced cracker does the same thing (call up people in order to gain illegal access to a system) it's called social engineering and fuck-as-hell illegal.
Profane ranting aside, I believe you're wrong. 'Social engineering' is not at all illegal. It's -acting- on that information [i.e. the commission of a crime] that's illegal. Certain types of social engineering may be illegal (such as claiming you're a police officer) but lying to someone and having them trust you isn't a statutory crime I'm aware of.
You'd think they wouldn't be able to hide something as big as a mountain.
So, does that mean we're using IPv5 now?
In a world where people slave away for the sole profit of a board of directors and merciless shareholders...
Last time I checked people slaved away for a paycheck. Unless you pay more to get back and forth to your job, you're turning a profit.
Did anyone else think that they were all arrested in last year's car model?
Oh, I guess you'd had to have RTFA. Nevermind.
No, you're thinking of Schlock Mercenary (http://www.schlockmercenary.com/d/20040311.html)
As others have pointed out just get a really good NDA (which I'm sure the bank has probably already insisted on anyhow). The benefit of 3rd party code review is that they just might actually turn up a vulnerability in your software. This is just like having someone pay you to help you validate your software. At the end of this you can say your software has been validated by Fortify.
This is the view of an outsider to the project; I'm speaking strictly as a user here. It appears that the in particular Firefox and Thunderbird were brought along to certain level of functionality and usability and now are floundering. Critical security problems are being addressed but very old usability bugs stick around for years. It's the small things that tend to drive a person over the edge. That last bit of polish that makes the difference between a 'commercial' application and an open source one. I had high hopes that Firefox 1.5 would raise the bar even more but thinking back, I can't think of what was significant about the 1.5 release now. I think it was fixing the automatic updates, which was pretty critical.
It was a small typo on the web page. The release date is April 1, 2006.
It would be interesting to compare the number of different versions of software and applications this covers. Windows XP has not evolved tremendously in the last several years. Certainly Microsoft has shown a renewed (if not a completely successful) focus on security lately. But I think Microsoft benefits in this survey from a more stately release cycle.
I had a much better article that pointed to an article that says the student admitted to making up the story. Here's a link: Student admits hoax
Here's a link to an OpinionJournal article on it.
Microsoft are the greatest company in the world and managed by a genius. Bill, Seattle
This one made me chuckle. Nice to see the press with a sense of humor. I can't tell whether it's funnier because of the 'Microsoft are' British-ism or not.
This seems like a fantastic installation for an interactive meuseum. Or, make a USB version and we can set it up on the PC and let Junior go nuts. It'd also do well on consoles, I think. Hmm, this might have more application than I first thought!
I imagine with a little craftwork, a cheap USB camera and a little FOSS you could make one of these yourself.
Quote: He explained that when a department has a small number of simple Office macros and templates, but a large number of complex applications, it is easier to switch to OpenOffice on Windows before switching to Linux.
What you missed was the 'large number of complex applications.' To me this implies that there are applications (outside of Office) that will need to be 'transitioned.' They'll need to wean people off the applications or create Linux-compatible equivalents.
Why did they not simply pursue a GUI for the ][ series instead of branching off with a completely different product?
They did, the Apple IIgs: http://en.wikipedia.org/wiki/Apple_IIgs A friend of mine upgraded to one of these. I seem to recall it was about this time that the Amiga came out. This was when I moved off the Apple ][. Despite the claims of 'Apple ][ forever', Apple killed off the ][ line.
Actually, this is one of the problems I have. I want to install Linux once and not have to fret over 'Did I choose a distro I'm going to regret?' Will I choose one with KDE and then decide I really wanted Gnome? Will my distro have an easy to use patch/download system that will update frequently enough that I can get the things I want when I want them? I haven't found good answers to these questions.
I realize that I can overcome all these problems by downloading tarballs and building things myself. But the fact of the matter is I don't want to do that much tinkering.
- Filtering the massive amount of data that can be collected
- Gen 2 standards still not finalized
- Cost
- Can require a reconfiguration of business process to get full benefit
- Limited amount of information can be stored in a tag
Bar codes are cheap, easy to train users to read, and are often used for different purposes than RFID is envisioned. Currently, most RFID labels include one or more bar codes for backup reading and for storing additional information not contained on the RFID chip. I think RFID will make great strides and the technology will begin to be pushed down into smaller and smaller manufacturers/retailers but it's still many years off. Roy http://www.data-net.com/