The new Samsung SGS3 is equiped with Near Field Communications, which is basically an RFID reader inside the mobile phone. The RFID reader can be programmed to execute commands or run programs.

What are the vulnerabilities of using NFC on the mobile phone?

  • 1
    Are you looking for known vulnerabilities or possible attack surface? Jul 24, 2012 at 0:03
  • Clarification, NFC is capable of two way communication. RFID is not. Jul 24, 2012 at 5:38
  • @Bernie White RFID is two way, one sends a command to the microchip on the card and if responds. RFID is just one form of NFC, there are others, like direct phone to phone.
    – ewanm89
    Jul 24, 2012 at 7:16

2 Answers 2


I think it all depends on particular usage scenario. Because potential attacks can involve for example:

  • Over/underflow in software handling nfc communication
  • The same in regard to application software that is using nfc
  • Potential electrical overload of nfc transceiver
  • Information disclosure - if there is some "harmless" service code used to test nfc during development
  • If nfc usage does not involve human acceptance any vulnerability in application software can be exploited without you even knowing about it
  • Without strong authentication device spoofing can be possible

All of these are potential threats to nfc, as to any wireless technology you might say. So as long as you will be aware that this is wireless and it means that anyone has access to it, and you institute a reasonable precautions you should be ok :). As a final word if it is not needed all the time turn it of :).

  • Do you have any supporting references? Jul 24, 2012 at 5:36
  • 1
    Beside common sense ;) no quick search can get you this also Security Engineering by Ross Anderson can give you a pretty good grasp of protocols failures. Jul 24, 2012 at 5:43
  • 1
    I suspect an electrical overload of the NFC transceiver would overload the cell antenna first, due to the size and design of them. I've not looked at the SGS3, but I'm pretty sure (after taking a look at it) the SGS2 has rudimentary over-current protection on the antenna. This increases the chance that the antenna module can be replaced in the event of strong electromagnetic induction, rather than the board getting fried. I still wouldn't try putting it on top of a mass spectrometer's electromagnet though!
    – Polynomial
    Jul 24, 2012 at 8:38

Nick von Dadelszen presented details of NFC's security challenges at last November's Kiwicon security conference. The audio is available at http://risky.biz/KiwiconNFC and presentation is available at https://www.lateralsecurity.com/downloads/Lateral_Security-Mobile_and_RFID-KiwiconV.pdf

Another good paper is Practical Relay Attack on Contactless Transactions by Using NFC Mobile Phones

The threats are enabled by the Internet facing aspect of a phone and applications that coexist on the phone in addition to the phone being both a security token transmitter and reciever.

The studies suggest ways this emerging technology can be implemented to enhance security as as well as well as issues to watch.

----Addition for Black Hat Day One Demo link--------

Your question was addressed on Black Hat Day One with a demo http://www.extremetech.com/computing/133501-black-hat-hacker-lays-waste-to-android-and-meego-using-nfc-exploits

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .