Nitesh Saxena Computer and Information Sciences University of Alabama at Birmingham

1. Nitesh Saxena Computer and Information Sciences University of Alabama at Birmingham Security and Privacy In Emerging Systems (SPIES) group http://spies.cis.uab.edu Center for Information Assurance and Joint Forensics Research (CIA|JFR) http://thecenter.uab.edu/

2. Outline • Background • What NFC is • NFC Applications • What all one could do with it • NFC Attacks/Fraud • What all can go wrong • NFC Defenses • How things could be fixed

3. Outline • Background • What NFC is • NFC Applications • What all one could do with it • NFC Attacks/Fraud • What all can go wrong • NFC Defenses • How things could be fixed

4. RFID System Overview An RFID system usually consists of RFID tags and readers and a back-end server. Tags are miniaturized wireless radio devices that store information about their corresponding subject, such as a unique identification number. Readers broadcast queries to tags in their radio transmission ranges for information contained in tags and tags reply with such information. reading signal back-end database ID Reader Tag

5. (Some) RFID Applications

6. Near Field Communication (NFC) • NFC technology enables smart phones to have RFID tag and RFID reader functionality • Phones can be used as payment tokens • Next generation of payment system • For example, Google Wallet App uses this function • Already deployed in many places • Just like RFID, it uses wireless radio communication

7. Outline • Background • What NFC is • NFC Applications • What all one could do with it • NFC Attacks/Fraud • What all can go wrong • NFC Defenses • How things could be fixed

8. NFC Applications Google Wallet ISIS

9. Google Wallet Vision

10. NFC Applications Patient Id+ Mobile Ticket Purchase – Austrian Federal Railways

11. NFC Applications NFC Tags Sharing

12. Other Applications Interactive Experience NFC at Museum of London Posters / Replacement to QR Codes Productivity (Phone Use Cases) Automatic Pairing with Bluetooth Connect to Wifi Make a Call/Text to a number Change settings automatically Check ins / Locations / Other social activity Open Apps SleepTrak (health monitoring) …many manymore

13. Outline • Background • What NFC is • NFC Applications • What all one could do with it • NFC Attacks/Fraud • What all can go wrong • NFC Defenses • How things could be fixed

14. Wig model #4456 (cheap polyester) Viagra medical drug #459382 Das Kapitaland Communist-party handbook 500 Euros in wallet Serial numbers: 597387,389473… 30 items of lingerie The RFID Privacy Problem Good tags, Bad readers

15. NFC Privacy Problem • Should you worry? • NFC is near field (one has to tap to read!) • Yes, unfortunately • Researchers have shown that it is possible to eavesdrop NFC signals from a distance larger than its typical communication range • [Kortvedt-Mjølsnes; 2009]

16. Chase Bank ATM Card US Bank Credit Card • Porn Movie Ticket • UAB Office Building Access Card Doctor’s Prescription The NFC Privacy Problem Good tags, Bad readers

17. Wig model #4456 (cheap polyester) Viagra medical drug #459382 Das Kapitaland Communist-party handbook 500 Euros in wallet Serial numbers: 597387,389473… 30 items of lingerie The RFID Cloning Problem Good readers, Bad tags Counterfeit!!

18. Chase Bank ATM Card US Bank Credit Card • Porn Movie Ticket • UAB Office Building Access Card Doctor’s Prescription The NFC Cloning Problem Good readers, Bad tags

19. Relay Attack I: Ghost-and-Leech response query query query response response

20. Relay Attack II: Ghost-and-Reader Server Variant of a Man-in-the-Middle attack [Drimer et al., 2007]; demonstrated live on Chip-and-PIN cards Malicious Reader Authentic Reader Ghost

21. Reader and Ghost Relay Attack • Fake reader relays information from legitimate NFC tag to “Ghost” • relays information from the legitimate tag to fake tag • “Ghost” relays received information to a corresponding legitimate reader • Happens simultaneously while user performs transaction with legitimate NFC tag • But for a higher amount • Impersonating a legitimate NFC tag without actually possessing the device. • While at a different physical location

22. NFC Malware Problem Youtube video: http://www.youtube.com/watch?feature=player_detailpage&v=eEcz0XszEic

23. Outline • Background • What NFC is • NFC Applications • What all one could do with it • NFC Attacks/Fraud • What all can go wrong • NFC Defenses • How things could be fixed

24. Chase Bank ATM Card US Bank Credit Card • Porn Movie Ticket • UAB Office Building Access Card Doctor’s Prescription The NFC Privacy Problem Good tags, Bad readers

25. Chase Bank ATM Card US Bank Credit Card • Porn Movie Ticket • UAB Office Building Access Card Doctor’s Prescription The NFC Cloning Problem Good readers, Bad tags

26. Relay Attack I: Ghost-and-Leech response query query query response response

27. Selective Unlocking • Promiscuous reading is to blame • Currently, NFC supports selective unlocking via PIN/passwords • Works in practice but passwords are known to have problems especially in terms of usability • Our approach – gesture-enabled unlocking

28. Relay Attack II: Ghost-and-Reader Server Variant of a Man-in-the-Middle attack [Drimer et al., 2007] Malicious Reader Authentic Reader Ghost

29. Authentication is not Enough • Alice’s device must authenticate the whole transaction • So Alice’s phone knows that the reader charges $250 • But Alice doesn’t • The big screen on the malicious reader says $5 • Even if phone displays the correct amount, Alice may not look at it • Or make a mistake due to rushing

30. Our Approach: Proximity Detection • A second line of defense • rather than relying upon the user • Verify phone and reader are in same location • Each device measures local data with sensor • We use ambient audio • Send authenticated data to server • Server checks that the data is the same in both measurements • Or at least similar enough • Then approves the transaction

31. Advantages of our Approach • Does not require explicit user action • Does not change traditional NFC usage model • Extremelydifficult for attacker to change environnemental attributes • Geographical location not sent to server • users’ location privacy is protected (unlike the use of GPS coordinates) • Compatible with current payment infrastructure

32. Implementation and Evaluation • Sensor data collected by two devices in close proximity • Capture audio from cell phone’s built-in microphone (two Nokia N97 phones) • Recorded 20 consecutive segments from two sensors simultaneously at different pairs of locations • At 5 different locations

33. Detection Techniques • Techniques based on time, frequency or both: • In both domains tested: • Euclidean distance between signals • Correlation between signals • Combined method: frequency distance and time-correlation • Best results achieved for combined time-frequency based method

34. Time-Frequency Distance Technique • Our new Time-Frequency-based technique • Calculating distance between two signals: • Calculate Euclidean distance between frequency feature vectors • Calculate Time-based correlation between signals • Distance defined as DC = 1 - Correlation • Both distances combined for classification • Combined as a 2-D point in space

35. Test Results • Time-Frequency distance measure: Numbers are distance measured squared

36. Detection Techniques • Used simple classifier to detect samples taken at the same locations • Simple-Logistics classifier from Weka • 10-Fold classification: • Data divided into 10 groups, 9 used for training, one for testing • Input to the classifier: Time-Frequency distance measure squared

37. Results • Our tests showed perfect classification: • False Accept Rate = 0% and False Reject Rate = 0% • High level of security and usability

38. Conclusions from Proximity Detection • Designed a defense for the Reader-and-Ghost attack • Promising defense • without changes to the traditional RFID usage model • without location privacy leakage • also applicable to sensor-equipped RFID cards • Audio is a stronger signal compared to light • More experiments are planned in the future • Paper: ESORICS [Halevi et al.; 2012] • Media Coverage: Bloomberg, ZDNet, NFCNews, UAB News, etc…

39. NFC Malware Problem Youtube video: http://www.youtube.com/watch?feature=player_detailpage&v=eEcz0XszEic

40. Malware Protection via Gestures • Malware actions are software-generated • Legitimate actions, on the other hand, are human-generated • Human gestures will tell the OS whether an access request is benign or malicious • Luckily, for NFC, a gesture that can work is “tapping” • An explicit gesture could also be employed

41. Tap-Wave-Rub (TWR) Gestures • Phone Tapping • accelerometer • Waving/Rubbing/Tapping • proximity sensor • Waving • light sensor

42. TWR Enhanced Android Permissions

43. Initial Results Phone Tapping (accelerometer) Tap/wave/rub (proximity sensor)

44. Conclusions from TWR • Initial results are promising • The approach is applicable for protecting any other critical mobile device service • SMS, phone call, camera access, etc. • TWR gestures are also ideal for selective unlocking

45. Take Away from the Talk • NFC is a promising new platform with immense possibilities • However, a full deployment requires careful assessment of security vulnerabilities and potential fraudulent activities • Many vulnerabilities similar to RFID • Except Malware – a burgeoning threat to NFC • Other attacks possible – such as phishing via malicious NFC tag • Security solutions need to be developed and integrated with NFC from scratch • Research shows promise • Phone is almost a computer; so lot could be done (unlike RFID) • User convenience or usability is an important design metric when developing security solutions

46. Acknowledgments • Students – the SPIES • Jaret Langston, Babins Shrestha, Tzipora Halevi, Jonathan Voris, Sai Teja Peddinti, Justin Lin, BorhanUddin, AmbarishKarole, Arun Kumar, Ramnath Prasad, Alexander Gallego • Other Collaborators More info: http://spies.cis.uab.edu http://spies.cis.uab.edu/research/rfid-security-and-privacy/ Thanks!