Posts Tagged ‘rfid security’

Do It Yourself a RFID immobiliser

Sunday, May 2nd, 2010

rfid-car-immobiliser

This guy, [andrew_h] has put together this slick anti theft device for his car. This RFID immobiliser is used to keep the car engine from starts unless you swipe an RFID tag. Depending on how well you hide it, and how well the person stealing the car knows you, they would have no reason to suspect that they have to swipe the tag. Even if someone steals the car while it is already running, they won’t be able to re start the engine if they shut it off. Guys, you should try this one if you have any car to experiment with, or you have to steal a car to do this.. kidding! All steps, schematics and PCBs are available.

Available at Instructables.com via Hack A Day

How to build your own RFID reader

Thursday, April 22nd, 2010

DIY RFID

Do you have any idea on how easy it is to build your own RFID reader? Well, we stumbled upon some sites that’ll give you some clearer picture on how to make this thing happens. As pointed out by hackaday,

[Klulukasz] left a comment pointing to this DIY RFID reader that was a final project in 2006 for a class at Cornell University. It is well documented and includes not only a schematic and code, but an explanation of the design considerations used during the build. The project uses an ATmega32 and the parts list priced out at about $50 at the time. There were plenty of responses to theRFID spoofer post pointing out that there are readers available for $40, but we want the fun of building our own.

A bit more vague with the details but no less interesting is this other simple RFID reader design.

Courtesy: hackaday

RFID tracking system

Wednesday, February 24th, 2010

This is a working tracking system using RFID tags built by Nicholas Skinner. The system’s tags operate in the 2.4 GHz band and are used to track either people or assets. The readers are on a mesh network and can triangulate the location of any tag for display on a map. His system is even set up to show the travel history of each tag. [Nicholas] shared every detail in his writeup including some background about available hardware options and how he made his final decisions on what devices to use for the job. His conglomeration of software that ties the whole project together is also available for download.

http://hackadaycom.files.wordpress.com/2010/02/rfid-tracking-system.jpg?w=470&h=344

courtesy: ns-tech

Feds at DefCon Alarmed After RFIDs Scanned

Wednesday, August 5th, 2009



rfid_4-300x200.jpgLAS VEGAS — It’s one of the most hostile hacker environments in the country –- the DefCon hacker conference held every summer in Las Vegas.

But despite the fact that attendees know they should take precautions to protect their data, federal agents at the conference got a scare on Friday when they were told they might have been caught in the sights of an RFID reader.

The reader, connected to a web camera, sniffed data from RFID-enabled ID cards and other documents carried by attendees in pockets and backpacks as they passed a table where the equipment was stationed in full view.

It was part of a security-awareness project set up by a group of security researchers and consultants to highlight privacy issues around RFID. When the reader caught an RFID chip in its sights — embedded in a company or government agency access card, for example — it grabbed data from the card, and the camera snapped the card holder’s picture.

But the device, which had a read range of 2 to 3 feet, caught only five people carrying RFID cards before Feds attending the conference got wind of the project and were concerned they might have been scanned.

source: wired.com

DHS proposes funky ‘fix’ for RFID security

Saturday, November 15th, 2008

A proposal by the Department of Homeland Security attempts to address one potential security problem with RFID-chipped passports, but leaves more obvious problems hanging fire.

In an effort to detect attempts to clone the data stored on RFID chips used on US Passport Cards, DHS on Wednesday announced that it is recommending that manufacturers supplying these RFID chips include a “unique identifier number,” or Tag Identifier (TID).

The TID would be used to ascertain when a chip’s data has been cloned, as one would do to create a fake passport. If two passports with the same identifier number turned up at the border, one of them could be deduced as fake. That number would actually be the second unique number in the chip, since all a passport’s RFID chip stores is a unique number that is indexed in a database. (Currently the chips hold one unique number and one generic manufacturer code; that generic code is the one that would be replaced with a TID.)

It’s an identification model that works reasonably well with mobile phones and automobiles, but an identity document is a different creature. Conceivably, the ID number might help to determine whether, for instance, a hacker intercepting the snail mail has waved a reader near a State Department envelope and picked off the data without having to open the envelope — with “contactless” technology, the envelope would not have to be opened. But the model may not help with other security issues RFID researchers, privacy activists, and anti-terrorism experts have flagged. (more…)

24C3 Mifare crypto1 RFID completely broken

Sunday, August 17th, 2008

It’s an old issue but still got a kind of relations to our days of life.

Another highlight for us at CCC was [Karsten Nohl] and [Henryk Plötz] presenting how they reversed Philips crypto-1 “classic” Mifare RFID chips which are used in car keys, among other things. They analyzed both the silicon and the actual handshaking over RF. Looking at the silicon they found about 10K gates. Analyzing with Matlab turned up 70 unique functions. Then they started looking “crypto-like” parts: long strings of flip-flops used for registers, XORs, things near the edge that were heavily interconnected. Only 10% of the gates ended up being crypto. They now know the crypto algorithm based on this analysis and will be releasing later in the year.

The random number generator ended up being only 16-bit. It generates this number based on how long since the card has been powered up. They controlled the reader (an OpenPCD) which lets them generate the same “random” seed number over and over again. This was actually happening on accident before they discovered the flaw.

One more broken security-through-obscurity system to add to the list. For more fun, watch the video of the presentation.

Source: Hackaday

SkyeTek provides reader-driven RFID tag security

Wednesday, July 2nd, 2008

While other reader offerings rely on tag manufacturers to provide security for RFID tags, SkyeTek supplies RFID readers that implement security onto generic tags, providing cost savings as well as investment protection by enabling customers to switch tags without penalty.

This newer approach to tag security enables original equipment manufacturers (OEMs) and product designers to control their own security requirements. In addition, with reader-driven security on generic tags, manufacturers can take advantage of encryption without the cost of a proprietary tag.

Some tag manufacturers provide no tag security at all, and the ones that do sell those tags at a premium. As part of a security solution, SkyeTek supports several proprietary encryption algorithms that are tailored to provide security for specific markets such as ticketing.

In addition, for those seeking to expand the security of their existing solutions, SkyeTek readers can overlay security on top of existing proprietary tags, the company claims. SkyeTek supports standards-based security algorithms, including TDEA and AES ciphers and SHA-2 hashes, which can be applied in addition to proprietary methods.

Reader-driven security is useful in areas such as product authentication and consumables authentication, as it allows for anti-cloning and anti-tampering. For example, a reader can enforce tag usage constraints by enforcing expiration dates and limiting the number of times a tag can be read. To prevent counterfeiting and cloning, applying a hash algorithm tied to the tag ID prevents the contents of the tag memory from being cloned or replicated on an unauthorized tag. Most proprietary security-enabled RFID tags are not immune to cloning.

SkyeTek’s standards-based approach enables secure support for generic tags, saving customers up to 70% over systems using proprietary security. SkyeTek’s security uses the same standards-based encryption that is used in e-commerce and that has been adopted by the government and military.

More information is available at SkyTek’s website.