Is the newly adopted NFC technology going to be safe?

Question

I got sent a link today talking about how the business card company "Moo" is implementing a chip into their cards that will allow NFC connections to do many things such as share contact info, open a website, open a social media page, etc etc.

So I personally don't know a ton about NFC or the connection it establishes, but to my knowledge all it is, is a radio connection. So once the chip and device realize they are connected it runs a command, probably something like

if device=connected{
do this
} else {
end / don't run command
};

I was wondering, just how secure can this connection be? Just off the top of my head I feel like it poses a major security risk to a couple threats, just a list I thought of:

You tap the card and:

• The chip installs software (keylogger)
• The chip steals something (Apple keeps your payment info in general settings of the app store)
• The radio signal is intercepted by a third party

How possible are these scenarios? Should anyone be concerned with using the new NFC cards?

(Sorry not really sure what to tag this)

Answer 1

NFC is a standard for a packet transmission.

The packet can have a payload.

The payload can be harmful, but would require a program listening for that payload to do harm.

So no, this can't happen unless a user installs a sent malicious app, visits a dangerous webpage, or a program that accepts NFC packets has a vulnerability.

Why? Well really what you send over NFC is just a file. The user then has to open the file. This can be a web shortcut, a program installer, a text file, so forth and onward. However these files can NEVER auto execute. They must be opened. If there is a program waiting for a file, it will open that file, but the program must be the foreground application or a service handler in front of the OS NFC communicator.

What does this mean for security?

Just like many other systems, this means bad users are the danger here. If a file is sent and causes harm, it is because the user allowed it to be sent and cause harm by using a programmed designed to accept these NFC packets of doom.

Should I be worried about NFC?

Short answer: No.

Long answer: You should be careful. Just like the HTTP, NFC is a protocol. You must take in a malicious program to have something bad happen.

How do I avoid this sort of thing happening?

Disable NFC, and if you must use it, use best practices:

• Don't accept NFC from sources or people you don't trust, or aren't confirmed safe

• Don't leave NFC on if you're not using it(just like BT, wifi, a stove...)

• Don't view, accept, or install content you don't trust(as general, not just over NFC)

By following these tips, and being safe, NFC is no more dangerous than bluetooth.

EDIT: Addressing someone reading the communication over the air: NFC has an extremely small travel distance(due to the power used). If anything is next to you, your device, and the thing you're communicating with, ask if it is necessary for it to be there. If the answer is no, don't use NFC.

Answer 2

NFC is just another medium like wires, wifi, microwave, light-comms, etc. It will be incumbent on the security professionals to create and guide their safe use whether it is for payments, data sharing or any other purpose.

Being an invisible medium probably brings its own risks in terms of awareness, but there is nothing intrinsic beyond its invisibility that suggests it will be any more or less secure as a medium.

As for your scenarios, I don't think the medium is relevant, only the systems that use the medium and they will depend on secure design, architecture and implementation like any other.

People have been talking about this issue for some time now in a security context and awareness is definitely growing.

Answer 3

A couple of points. NFC is not really "new" in the Technology sense. Several years old, but has only had limited adoption in specific areas. That being said, it is used quite a bit in specific areas.

3 year old presentation from MIT

As with any technology, there are always security concerns. The exploit scenario you allude to may or may not be possible, depending on the modes in question, the applications, and the permissions set on the devices. Your questions are pretty broad and non-specific, and with technical exploits the devil is always in the details.

Answer 4

Unfortunately "NFC" isn't a very well-defined term and can mean many different things in different contexts. Principally there's the NFC Forum that defines a couple of industry quasi-standards:

• NFCIP-1: NFC Interface and Protocol, which actually is a 'real' standard co-published as ISO 18092 and ECMA-340, is a half-duplex radio protocol to transfer data at medium bitrates (~100 to 800 kbits/s) over short distances (specified less than 10cm) between two parties, an initiator and a target. Not by accident this protocol is mostly compatible to ISO 14443, which has been used for similar purposes for a longer time.
• NDEF: NFC Data Exchange format, which is a compact binary data storage and message serialization format.
• RTD: NFC Record Type Definition, a specification format for NDEF messages
• NFC Tag types 1 through 4, which define radio protocol and logical message storage particulars for several passive NFC Tags. These are essentially just passive data storage units with a radio interface.
• Several message formats (via RTDs) and expected semantics for common use cases such as, and this is where your business cards come in, business cards, smart posters, etc.

Two important aspects here: The NFC Forum specifies nothing at all that would be classified as a "security feature", except for lock bits. Generally, after writing a message to a tag, you can set a bit and then the tag will be read-only and resist further attempts to write to it. And: NDEF messages are just that: messages. There's no executable code or other active magic involved here.

In the business card use case (which, as you see, was not invented by Moo), you write an NDEF message to the card, that essentially says: »I'm a business card, this is my name: ..., this is my phone number: ...«, etc. Another device can then (using NFCIP) contact the tag, read out the message, and prompt the user for further actions (such as: add the contents of this business card as a new contact into the phone book).

There are other NDEF message types that are a little hairier: A call request contains a phone number and the expected semantics when reading the message with a phone is that the user is immediately asked whether they want to call that number.

Again: No security properties are implemented or claimed. Nobody knows where the data that is read from the tag comes from. But since it's not actually a computer program or code, you 'only' get security problems if the parser in the reading device is broken or the device does things without user consent. Of which there were some instances in the past.

Answer 5

This NFC basics link should clear some of that up. You can even try your hand at it Here.

It's being used a lot today, mostly passive tags such as in business cards and this sticker that showed up in Australia around 2 years ago (I think) : [large pic removed. Ed.]

Edit: I forgot to mention the "tags" are quickly replacing QR codes due to their ease of use and simplicity, and only store a very small amount of data such as a url, app link (for an app store) or a "contact card" for your phone. I don't know the limits of it, I don't dabble.

If you read the first link there, you'll see "passive" tags like the ones I've mentioned. These don't execute anything, just store a line of text, like an invisible barcode scanner. The other option is "active" devices, which is probably your smartphone or something similar, they are more powerful. But active devices won't take action they weren't designed to do and normally ask "what do you want to do with this url?". Unless a security concern is discovered, and I'm sure it will be quickly patched, there is very little to worry about. NFC is even encrypted so outsiders can't listen in.