Tag Info

Hot answers tagged

43

Any Faraday cage will do the trick. So a shielding of just about anything conductive, be it aluminum foil, conductive paint, wire mesh, or any of a number of similar alternatives is going to be opaque to radiation. That means no radio waves in or out, which means the RFID signal is blocked. Note that the size of the mesh has to be significantly smaller than ...


18

Next time you go to the shop leave your card in your wallet and try as much as you can to pay for your purchase. Try with several different card readers to be sure. If you can't pay, then it's pretty well protected. If you can, well... I can't speak for that particular wallet but it is certainly possible to block RFID in that manner. It just depends if they ...


16

For home locks, I think that the proper way to analyze it is to think about money, and more specifically insurance. You put the kind of lock that will please your insurance company; with a custom lock, chances are that your insurance company will ask for more money every month -- or refuse to give you money if you are burgled (even if the burglar came in ...


12

The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own. However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).


11

To be precise, an aluminum foil can do the trick. I hope your RFID Blocking wallet is actually blocking them. I am afraid that it is hard to test the practical way as it is happening unless you are a an IT expert in that field Or a RFID hacker ;) However there are good products available that promises against RFID theft. sample : ...


10

The principle has been used before, your wallet will act as a Faraday cage. This means that the inside of your wallet cannot be affected by electronic fields. This prevents the RFID from being read out. However normally a Faraday cage is closed, so as long as your wallet is closed with the card inside and the metal completely covering your card, you should ...


9

Can't be much worse than my garage door opener, whose remote just has a button on it. Everything depends on the implementation, but just doing something a little different will ward off anyone but a determined attacker, and there's no defeating a determined attacker. By the way, door locks can't possibly be the most important security concern. Just guessing ...


7

Visa and other credit card manufacturers use the EMV standard to authenticate credit/debit card transactions. The Wiki article explains it better than I can, but this is a highly technical topic - it will take time to read and understand. You should also see the answers to similar questions about NFC/RFID/EMV. Essentially though, the demonstrated cloning ...


6

Have a look at Major Malfunction's (Adam Laurie) work in this area: http://hackaday.com/2007/03/25/rfidiot-rfid-io-tools/ http://www.youtube.com/watch?v=3vAvesYoHeo and many others - good fun stuff, not too expensive to get started edit: Just spotted this post on Proxclone that you might also be interested in


6

Conceptual view: there is authentication, and there is authorization; these are distinct activities. Authentication is about making sure of who you are talking to; authorization is about deciding what some individual is allowed to do. You actually want to keep them separate. RFID tags implement authentication: through the electronic conversation between the ...


6

The secret of credit card transaction security is that by law (in many jurisdictions) the card issuer is responsible for fraudulent transactions after a certain limit, not the card holder. Since they already assume the bulk of the liability, most (all?) simply make the jump to say that the card holder is not responsible under any circumstances for fraud. ...


6

Is RFID a superset of NFC? (or vice versa?) To quote from the the Wikipedia article "NFC standards cover communications protocols and data exchange formats, and are based on existing radio-frequency identification (RFID) standards..." So RFID is just a name for devices that use radio frequencies to communicate and NFC is one of these. Is all RFID / ...


5

Have a read of the How to get into RFID auditing question as there are some very useful links there. Contactless cards and RFID cards are just a small computing core with some limited functionality and a radio transceiver which not only powers the card when a radio signal is present, but also receives and transmits data within a small range. The key usual ...


5

You can check this paper : http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf It's from a talk given by Charlie Miller at BlackHat 2012 : Near Field Communication (NFC) has been used in mobile devices in some countries for a while and is now emerging on devices in use in the United States. This technology ...


5

You only need one RFID device, its the Proxmark3. There are many protocols and frequencies used by RFID and the Proxmark3 tries to support all of them. It is open source hardware and software and breaks every commercial RFID card I know of. The real problem with RFID is that you have a very limited power usage so you are forced to use weak crypto systems. ...


5

In favor of the mechanical locks is that they are cheap and simple (and so less likely to break down). (Even if you do deploy a fancy RFID system I bet you have a mechanical lock put in as well, because it costs next to nothing and gives you a fall-back in case the Access Control fails.) However, in most high security environment you are likely to want ...


5

The thought is probably that since it is inside you it can't be stolen, so obviously it would be more secure than a form of ID that could be stolen. I think it's pointless, and actually potentially hazardous to the user: It would only last a few hours. It's powered by stomach acid, once it's out of the stomach it would stop working. What are going to do, ...


4

The inherent problem I see is that different RFID tags respond to different frequency interrogators. In other words, my work RFID tag needs a different reader than my car key. I am unsure if there is a one-size fits all reader, but some places sell kits for tinkering, which may be insightful: ThinkGeek SparkFun What I'm finding so far is that it seems ...


4

Once you have a reader, you can get a reading framework here : www.rfidiot.org This python framework was created by Adam Laurie and is compatible with most of the readers. With this framework, you will be able to read most of the tags. For some of the tags, it is possible to carry various attacks on the tags itself.


4

WRT to smart card being used as an authentication factor for computer access, the private key on the smart card can be protected by a PIN/password. So the smart card auth can also provide the additional factor of "what you know" in addition to "what you have." For most users, the risks are acceptable when compared to the cost of managing ...


4

RFID is a very broad term. There are active (powered) RFID tokens and passive RFID tokens. Most likely you are thinking of passive (backscatter) RFID. The next thing to think of is the range. Common commercial RFID dongle systems use the HF band and have very limited range. I only have experience with UHF RFID readers (915 MHz North America). These ...


4

Whether you need the signature depends on the signature type. The main standard for RSA signatures is PKCS#1. With that standard, a RSA signature is "just a signature": it can be verified with the public key and the signed data, but it embeds no data by itself. The signature is an additional element. If you just want to compare the signed data with some ...


3

Yes, it's possible to have a PUPI collisions. (It's called pseudo-unique, after all, not unique.) This can happen with probability 2-32 if the PUPI is chosen randomly, or more if it isn't. The question is, so what? How is a PUPI collision harmful? The primary intent of the PUPI is to be unique at a particular point in space-time: an RFID reader emits a ...


3

TL;DR: Physical locks are simpler and therefore less prone to failure. Proximity cards (e.g. RFID) are superior in every other way. Picking a lock is a side-channel attack that grants access to an individual who does not need to have ever encountered a valid access token (in this case, a key). It's quick, highly effective, and leaves no audit logs (other ...


3

Might sound glib, but often a quick Google gives information on which companies use which card providers. I would always use this first if the company won't tell you before the test. Have a look at Major Malfunction's extensive back catalogue of rfid presentations, as he discusses issues such as this. Try ...


3

Network bandwidth is a scarce resource in RFID protocols. Active tags have a double edge sword when it comes to security. For one they are able to support more bandwidth and therefore larger key sizes. The "problem" is that active tags also have a longer range, and there for an attacker further away is able to obtain a challenge response. Passive tags ...


3

I guess I am a bit late to the party on this question, however I'll add some quick information on wallets containing faraday cages. I have one myself, and they do in fact work very well. I have tested it pretty thoroughly, and not once has signals been able to leave the wallet, with the exception of when I have it open, then it works as intended. Here is ...


3

It an block RFID reading, but that's not to say that someone with a high gain antenna won't be able to read the chip. Worth remembering that although a faraday cage does block radio signals (mostly, but let's not over complicate this!), a metal lined wallet isn't actually a faraday cage because it's not grounded. Kristin Paget (formerly Chris Paget) is a ...


3

It is possible the wallet will work. It depends a lot on how it is manufactured. Keep in mind many people on here have told you to test it at a store reader. These readers are designed to read from a short range. A higher power reader that a thief may have can read much further. Also many of these wallets are only shielded on the outside. My company, ...


3

At least 217 feet. Please keep in mind this is an Ultra High Frequency UHF Gen 2 RFID tag meant for use in item sales, tracking, and inventory. This is not the same RF technology in use by access cards. Those are generally Low Frequency (LF) and have a much longer wavelength, which results in a shorter demonstrated distance of 12-19 inches, although that ...



Only top voted, non community-wiki answers of a minimum length are eligible