RFID Access Control Insecurity

•

3 likes•1,462 views

Albert Hui

Technology Business News & Politics

RFID is Everywhere Copyright © 2007 Albert Hui Image from Wikipedia

How RFID Works Copyright © 2007 Albert Hui Inductive Coupling Backscatter Coupling

RFID Tags / Cards / Transponders Copyright © 2007 Albert Hui Trossen Robotics EM4102 Tag Kit

Ampoule Implant Copyright © 2007 Albert Hui Image from VeriChip Image from New York Times story “High Tech, Under the Skin”

RFID Implant Application Copyright © 2007 Albert Hui No more forgetting your keys! Totally worth it. Image from AmalGraafstra’sflickr.

A Matter of Frequencies Tradeoffs among: cost (antenna length) read distance resilience to interference Copyright © 2007 Albert Hui

UHFID – Supply Chain Tracking Pros: very low cost tags (US$0.05 ea. in volumes of 100 mil) long range (typical 20’ between 2 antennas) anti-collision (for simultaneous tag reads) Cons: serious interference from liquids and human body Copyright © 2007 Albert Hui

2.4GHz – Toll Payment System Pros: very long range (typically 30’) Cons: transponders are battery powered, hence have a lifespan (typically 5 years) transponders are very expensive Copyright © 2007 Albert Hui

2.4GHz – Singapore ERP Image from Wikipedia Traffic demand management system from Mitsubishi. Copyright © 2007 Albert Hui

LowFID Pros: signal less prone to metal/liquid interference Cons: high tag cost (due to longer copper antenna coil) Copyright © 2007 Albert Hui

LowFID – Animal Tracking Myriad proprietary standards, a reader may not even recognize existence of an incompatible chip. If your lost pet end up in a shelter without reader that can read your chip, God bless you. Compatibility info here. Copyright © 2007 Albert Hui

LowFID – Access Control “EM cards” (EM4102 / Unique) HID ProxCard Hitag 1/2/S Q5 TI-RFID 64bit / 1088bit ... Copyright © 2007 Albert Hui

8.2MHz – EAS (Anti-Theft) 1-bit tag (absent / present) Detachable / deactivatable. Copyright © 2007 Albert Hui

HighFID Pros: low cost because antennas can be printed on labels / substrate Cons: serious interference from metals Copyright © 2007 Albert Hui

HighFID – Access Control ISO 14443A Mifare ICAO passport LEGIC ISO 14443B HID iCLASS Calypso ISO 15693 (“vicinity cards”) Copyright © 2007 Albert Hui

Compromising RFID-Based Security Systems Copyright © 2007 Albert Hui RFID Attacks

#1: Defeating EAS Jamming Shielding bag lined with 30 layers of aluminum foil (Faraday cage) Detaching most tags are detached with strong magnet Deactivating strong magnet Copyright © 2007 Albert Hui

#2: Skimming HF tags are proved skimmable from a distance up to 25cm [KIRS06]. Copyright © 2007 Albert Hui

Defense Against Skimming One word: Metal coating. Copyright © 2007 Albert Hui

How Simple RFID Door Lock Works Copyright © 2007 Albert Hui DooRFID from RFID Toys

“Unique ID”-Based Systems Security premise: tag has unique ID Copyright © 2007 Albert Hui

#3: Cloning Attack Custom-built RFID tag emulator. Better yet, Q5 tags has EM4102 emulation built-in! Copyright © 2007 Albert Hui IAIK DemoTag

Cloning Attack with Q5 Demo Copyright © 2007 Albert Hui

#4: Relay Attack G.P. Hancke, “Practical Attacks on Proximity Identification Systems”, Proc. IEEE Symposium on Security and Privacy, May 2006. Copyright © 2007 Albert Hui

#5: Cryptanalysis Exxon Mobile’s SpeedPass payment system has been compromised [BON05]. Weakness lies in TI’s flawed proprietary cipher. Mifare Classic has been compromised [KON08]. Weakness lies in NXP’s flawed proprietary cipher. Copyright © 2007 Albert Hui

A Few Take-Homes: Do not use an RFID access control that relies solely on the uniqueness of the card ID. Use RFID access control that use modern, mathematically proven crypto, e.g. MifareDESfire. Do not leave your access cards behind or lend them to other people. Copyright © 2007 Albert Hui

Recently uploaded

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

Scalable LLM APIs for AI and Generative AI Application Development Ettikan Karuppiah, Director/Technologist - NVIDIA Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...

apidays

Manulife - Insurer Transformation Award 2024

The Digital Insurer

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

As privacy and data protection regulations evolve rapidly, organizations operating in multiple jurisdictions face mounting challenges to ensure compliance and safeguard customer data. With state-specific privacy laws coming up in multiple states this year, it is essential to understand what their unique data protection regulations will require clearly. How will data privacy evolve in the US in 2024? How to stay compliant? Our panellists will guide you through the intricacies of these states' specific data privacy laws, clarifying complex legal frameworks and compliance requirements. This webinar will review: - The essential aspects of each state's privacy landscape and the latest updates - Common compliance challenges faced by organizations operating in multiple states and best practices to achieve regulatory adherence - Valuable insights into potential changes to existing regulations and prepare your organization for the evolving landscape

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

TrustArc

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

Building Digital Trust in a Digital Economy Veronica Tan, Director - Cyber Security Agency of Singapore Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

apidays

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Martijn de Jong

The Good, the Bad and the Governed - Why is governance a dirty word? David O'Neill, Chief Operating Officer - APIContext Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

apidays

Artificial Intelligence Chap.5 : Uncertainty

Khushali Kathiriya

ICT role in 21st century education and its challenges

rafiqahmad00786416

presentation ICT roal in 21st century education

jfdjdjcjdnsjd

MINDCTI Revenue Release Quarter One 2024

MIND CTI

Effective data discovery is crucial for maintaining compliance and mitigating risks in today's rapidly evolving privacy landscape. However, traditional manual approaches often struggle to keep pace with the growing volume and complexity of data. Join us for an insightful webinar where industry leaders from TrustArc and Privya will share their expertise on leveraging AI-powered solutions to revolutionize data discovery. You'll learn how to: - Effortlessly maintain a comprehensive, up-to-date data inventory - Harness code scanning insights to gain complete visibility into data flows leveraging the advantages of code scanning over DB scanning - Simplify compliance by leveraging Privya's integration with TrustArc - Implement proven strategies to mitigate third-party risks Our panel of experts will discuss real-world case studies and share practical strategies for overcoming common data discovery challenges. They'll also explore the latest trends and innovations in AI-driven data management, and how these technologies can help organizations stay ahead of the curve in an ever-changing privacy landscape.

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc

Whatsapp Number Escorts Call girls 8617370543 Available 24x7 Navi Mumbai Call Girls Service Offer Genuine VIP Model Escorts Call Girls in Your Budget. Navi Mumbai Call Girls Service Provide Real Call Girls Number. Make Your Sexual Pleasure Memorable with Our Navi Mumbai Call Girls at Affordable Price. Top VIP Escorts Call Girls, High Profile Independent Escorts Call Girls, Housewife Women Escorts Call Girl, College Girls Escorts Call Girls, Russian Escorts Call girls Service in Your Budget.

Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model

Deepika Singh

This presentations targets students or working professionals. You may know Google for search, YouTube, Android, Chrome, and Gmail, but did you know Google has many developer tools, platforms & APIs? This comprehensive yet still high-level overview outlines the most impactful tools for where to run your code, store & analyze your data. It will also inspire you as to what's possible. This talk is 50 minutes in length.

Powerful Google developer tools for immediate impact! (2023-24 C)

wesley chun

GenAI Risks & Security Meetup 01052024.pdf

lior mazor

Webinar Recording: https://www.panagenda.com/webinars/why-teams-call-analytics-is-critical-to-your-entire-business Nothing is as frustrating and noticeable as being in an important call and being unable to see or hear the other person. Not surprising then, that issues with Teams calls are among the most common problems users call their helpdesk for. Having in depth insight into everything relevant going on at the user’s device, local network, ISP and Microsoft itself during the call is crucial for good Microsoft Teams Call quality support. To ensure a quick and adequate solution and to ensure your users get the most out of their Microsoft 365. But did you know that ‘bad calls’ are also an excellent indicator of other problems arising? Precisely because it is so noticeable!? Like the canary in the mine, bad calls can be early indicators of problems. Problems that might otherwise not have been noticed for a while but can have a big impact on productivity and satisfaction. Join this session by Christoph Adler to learn how true Microsoft Teams call quality analytics helped other organizations troubleshoot bad calls and identify and fix problems that impacted Teams calls or the use of Microsoft365 in general. See what it can do to keep your users happy and productive! In this session we will cover - Why CQD data alone is not enough to troubleshoot call problems - The importance of attributing call problems to the right call participant - What call quality analytics can do to help you quickly find, fix-, and prevent problems - Why having retrospective detailed insights matters - Real life examples of how others have used Microsoft Teams call quality monitoring to problem shoot problems with their ISP, network, device health and more.

Why Teams call analytics are critical to your entire business

panagenda

Recently uploaded (20)

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...

Manulife - Insurer Transformation Award 2024

AWS Community Day CPH - Three problems of Terraform

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

Data Cloud, More than a CDP by Matt Robison

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

Boost Fertility New Invention Ups Success Rates.pdf

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

Artificial Intelligence Chap.5 : Uncertainty

ICT role in 21st century education and its challenges

presentation ICT roal in 21st century education

MINDCTI Revenue Release Quarter One 2024

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model

Powerful Google developer tools for immediate impact! (2023-24 C)

GenAI Risks & Security Meetup 01052024.pdf

Why Teams call analytics are critical to your entire business

RFID Access Control Insecurity

1. RFID Access Control Insecurity Albert Hui, GCFA, CISA albert.hui@gmail.com

8. UHFID – Supply Chain Tracking Pros: very low cost tags (US$0.05 ea. in volumes of 100 mil) long range (typical 20’ between 2 antennas) anti-collision (for simultaneous tag reads) Cons: serious interference from liquids and human body Copyright © 2007 Albert Hui

9. 2.4GHz – Toll Payment System Pros: very long range (typically 30’) Cons: transponders are battery powered, hence have a lifespan (typically 5 years) transponders are very expensive Copyright © 2007 Albert Hui

12. LowFID – Animal Tracking Myriad proprietary standards, a reader may not even recognize existence of an incompatible chip. If your lost pet end up in a shelter without reader that can read your chip, God bless you. Compatibility info here. Copyright © 2007 Albert Hui

18. #1: Defeating EAS Jamming Shielding bag lined with 30 layers of aluminum foil (Faraday cage) Detaching most tags are detached with strong magnet Deactivating strong magnet Copyright © 2007 Albert Hui

26. #5: Cryptanalysis Exxon Mobile’s SpeedPass payment system has been compromised [BON05]. Weakness lies in TI’s flawed proprietary cipher. Mifare Classic has been compromised [KON08]. Weakness lies in NXP’s flawed proprietary cipher. Copyright © 2007 Albert Hui

27. A Few Take-Homes: Do not use an RFID access control that relies solely on the uniqueness of the card ID. Use RFID access control that use modern, mathematically proven crypto, e.g. MifareDESfire. Do not leave your access cards behind or lend them to other people. Copyright © 2007 Albert Hui

RFID Access Control Insecurity

Recommended

Recommended

More Related Content

More from Albert Hui

More from Albert Hui (15)

Recently uploaded

Recently uploaded (20)

RFID Access Control Insecurity