Using inexpensive off-the-shelf components, an information security expert has built a mobile platform that can clone large numbers of the unique electronic identifiers used in US passport cards and next generation drivers licenses.
The $250 proof-of-concept device - which researcher Chris Paget built in his spare time - operates out of his vehicle and contains everything needed to sniff and then clone RFID, or radio frequency identification, tags. During a recent 20-minute drive in downtown San Francisco, it successfully copied the RFID tags of two passport cards without the knowledge of their owners.
Paget's contraption builds off the work of researchers at RSA and the University of Washington, which last year found weaknesses in US passport cards and so-called EDLs, or enhanced drivers' licenses. So far, about 750,000 people have applied for the passport cards, which are credit card-sized alternatives to passports for travel between the US and Mexico, Canada, the Caribbean, and Bermuda. EDLs are currently offered by Washington and New York states.
"It's one thing to say that something can be done, it's another thing completely to actually do it," Paget said in explaining why he built the device. "It's mainly to defeat the argument that you can't do it in the real world, that there's no real-world attack here, that it's all theoretical."
Article here. Time to break out the Faraday cage (i.e., your stylish metal foil wrapping :)) for your passport.
Note however, that other technologies are being developed that overcome the existing RFID tag limitations. One such technology is called RuBee [emphasis added below]:
The Institute of Electrical and Electronics Engineers has approved a standard for RuBee, a technology that is a bit like RFID but can be used in harsher environments such as underwater or in firearms.
Steel, liquids, animals and people, among other things, can disrupt RFID (radio frequency identification), according to Visible Assets, the small company that developed RuBee. Visible Assets sponsored the development of the new IEEE 1902.1 standard along with Seiko Epson, one of its licensees. It took about three years to complete the specification, according to Visible Assets CEO John Stevens.
RuBee gets around some of the limitations of RFID by using magnetic or "inductive" waves rather than radio waves and using very long wavelengths, Stevens said. In addition, RuBee tags can both send and receive signals, unlike RFID tags, which can only be passively read by scanners, he said. That means RuBee tags can either communicate with a base station or form a peer-to-peer network. RuBee is a packet network protocol like Wi-Fi or ZigBee, according to Stevens.
RFID is used to identify and gather information about objects and people for shipping, asset management, security and other applications. RuBee can serve much the same purpose, but in conditions that hamper RFID, according to Visible Assets. For example, a RuBee tag can be built into a gun and send data through its steel body. That allows a base station at an armory to collect information about how many times the gun was fired while it was in the field, Stevens said. The same base station and tags can be used to keep track of which guns are in the armory at a given time, he said.
...
Steel and other materials can block RFID signals and "detune" RFID antennas, preventing them from using the frequency they are supposed to use, according to Stevens. RuBee signals can go through steel, water and other materials because they use very long wavelengths with "near-field" communication, he said.
RuBee uses frequencies in the kilohertz range, far below those typically used for radio communications, where it's easier to use magnetic than radio signals, Stevens said. The wavelengths used in a typical RuBee network are about 1.5 miles (2.4 kilometers) long, while the wireless links between tags and base stations typically span less than 50 feet. With less than one wavelength between the elements of the network, the signals can penetrate materials more easily.
Another advantage of low frequencies and long wavelengths is low power consumption, according to Visible Assets. RuBee tags have been proven in the field to last several years on one coin-sized lithium battery, the company said.
Visible Networks, founded in 2002 and based in Chatham, New Hampshire, makes its own RuBee chips and licenses the technology to other vendors. Epson Seiko makes RuBee tags, and gunmaker Sig Sauer builds tags into guns for use with tracking systems. Visible's chips range in price from a few dollars to more than US$100, depending on how specialized they are, Stevens said. The company has demonstrated RuBee with steel and water in a YouTube video. [video below]
Article here.
Posts
No comments:
Post a Comment