190 likes | 303 Views
Group 3 Rob Lee-Own Vincent Lin Max Sobell Scott Velivis. Technical Advisor Bruce McNair December 7, 2010. Radio Frequency Identification. RFID Allows a small exchange of data wirelessly Operates on multiple frequency bands 125kHz, 13.56 MHz, 900 MHz Common Uses Credit Cards
E N D
Group 3 Rob Lee-Own Vincent Lin Max Sobell Scott Velivis Technical Advisor Bruce McNair December 7, 2010
Radio Frequency Identification • RFID • Allows a small exchange of data wirelessly • Operates on multiple frequency bands • 125kHz, 13.56 MHz, 900 MHz • Common Uses • Credit Cards • EZ Pass • Passports • Zipcar
Design Requirements • Any user of RFID should have: • the right to know when an RFID tag on his or her person is being interrogated • the option to block his or her tag’s response to the interrogation
RFID Threat Model Threat Structure Vulnerabilities/Safeguards Additional Controls
RFID Threat Model RFID/Proprietary protocol vs TCP/HTTP: Transport protocol No built in security; similar challenges Encryption (HTTP: SSL, NFC: PKI/secure channel) Validation (HTTP: CAs, NFC: hardware verification on reader) Just a channel on which to send data!
Threat Structure Assets - Personal Information – CCs, passport - Authentication - office building access Perpetrators - Anyone with a laptop and reader Threats - Jamming, Tracking, Replay
Vulnerabilities/Safeguards RFID stack in software Security by obscurity - Attacker learns frequency and protocol Unencrypted signal/content Malicious reader
Additional Controls Encrypt data Physical safeguards Faraday cage Microwave tags Or
Constant Blocking • Exploits the “Complete Reset” command of the 13.56 MHz protocol (Auto-ID Center).
Smart Blocking • Exploits ‘ACK’ in slotted ALOHA (Slotted Terminating Adaptive Collection Protocol)
Detection • Our device is battery constrained • Cannot block constantly • Blocking is power hungry • Reading an RFID does not take a lot of time • <1ms • How can you detect an RFID Interrogator? • Need to know how RFID works
Inductive Coupling • Similar to how a transformer works • The change in current determines rate of change of magnetic flux • Replace a traditional antenna with coils of wire
Modulation • Amplitude Shift Keying (ASK) • Vary the amplitude at discrete levels • Frequency Shift Keying (FSK) • Vary the Frequency by discrete amounts • Phase Jitter Modulation (PJM) • Vary phase by small amounts • 99% of energy is unmodulated carrier
Detection Method • Look for an RFID interrogator in the frequency domain • Almost all activity on the 13.56MHz band is RFID communication • Once energy is detected above the noise floor of the frequency band the blocking routine will begin
Development Tools • Proxmark 3 • Snoops on interrogator-tag communications • Performs detailed analysis • Emulates an interrogator • Emulates a tag
Development Tools • Universal Software Radio Peripheral • 8 MHz instantaneous RF bandwidth • “Full duplex” with the right daughter boards • Open source GNU Radio
Budget • Laptop Computer $1000 • USRP $700 • LFRX $75 • LFTX $75 • Antenna $30 • Proxmark 3 $400 • HF Antenna $60 • RFID Tag Bundle (x2) $24 • Shipping (est.) $100 • Total $2464
Schedule / Goals • Proof of Concept • Interrogator-tag communications characterized • Constant Blocking • All interrogations detected and blocked • Smart Blocking • All interrogations blocked reactive to detection
Special Thanks! • Bruce McNair • Eric Andersen • Dominick Lagana • Kevin Tiu • Joe Martin