I was reading this article from Life Hacker, How to Automate Your Phone for Every Room in the House with NFC Tags. The idea is to place NFC tags around your house, car, etc. so that you phone will automatically do some action when you touch the tag. Clearly, this seems to be a security challenge. In many ways it would be similar to QR code attacks, where you are trusting something with low physical security that as a human you cannot decipher; however, a QR code would require you to actively load a reader and focus on the code, where NFC just need to be nearby with a service running in the background.

I am curious what security concerns come in to play with NFC tags and how to defend against these threats. For example, some tags could be reprogrammed without the user's knowledge or a tag may be cloned. Are there available methods for protecting integrity and confidentiality?

Ruling out things like payments and phone to phone connections, just looking at read-only tags, are there feasible passer-by attacks, and if so, what are some protections measures for users? Could NFC be used to trigger undesired, unplanned, or unauthorized commands on a reader/phone?

Edit: It looks like Wikipedia actually describes some attacks, many of which are familiar for any wireless type of technology (open medium)

  • QR code attack would have to target the reader and know whether it will do anything automatically, a reader that first asks confirmation to do anything is (itself) immune to malicious QR, (only the user clicking yes on every QR is) – ratchet freak Apr 17 '13 at 7:17
  • A simple attack on QR code is to replace an expected code with another. If there is a flyer with a QR code and a note "click here to go to the page", if someone places a sticker over the code you may not be able to tell the page has been substituted. – Eric G Apr 17 '13 at 16:24
  • You might want to read the questions tagged near-field-communications. There is a lot of information on the security of NFC available on those other questions, which may be helpful to give you additional background. – D.W. Apr 17 '13 at 19:56
  • I reviewed the other questions when originally authoring, but I wanted to talk about malicious things which can specifically be done with a limitation of tags instead of more complex and interactive systems like payments, etc. – Eric G Apr 17 '13 at 21:10

There are a few details about how NFC works that you are missing that prevent this from being a serious issue.

First, you can easily configure your device to only process tags with your approval and it is clear what the behavior of the tag is when you are asked for approval (the URL can be displayed for example).

Second, the complex actions that the article is talking about are only possible because the NFC tag stores a unique ID which corresponds to a macro on the phone. Without the user programing the macro ahead of time, the behaviors would not occur, so it is not a viable means of hacking the phone.

Third, many NFC tags can be rendered read-only. This prevents re-write and would prevent someone from reprogramming an existing tag in place. They could still remove the tag completely and add a new one, but doing so in someone's home could be tricky and wouldn't accomplish much for the prior mentioned reasons.

It still would be unwise to setup your phone to automatically go to URLs pulled from NFC without confirmation, but other than that, the amount of damage that can be done by a tag is relatively limited since the capabilities of tags in general is fairly limited.

What isn't covered would be what a maliciously formed content could do as far as unchecked input. This isn't really much different from any other kind of activity with a phone though. You still have to be in fairly close proximity and approve the action unless they find an overflow in the actual protocol itself (which would be no different from if they found a similar problem in the wifi stack).

| improve this answer | |
  • Are there no public use of such tags? I imagine over time people would see the convenience over even QR code. Imagine a museum with a tag on the placard next to a painting. With any type of input you can require a check before processing. I imagine a limited attack would be changing the codes to that of a different code (turn on airplane mode vs turn on) if you cloned it to do a limited DoS. – Eric G Apr 17 '13 at 16:28
  • 2
    @EricG - An NFC tag can not turn on or off airplane mode on a phone. Instead, an application like NFCTasker writes out a string "tasker:j2d8302j3f8sh" and then stores a reference in it's DB to say that when it sees that code, it should turn on airplane mode. To any phone other than the one that made the tag, it would do nothing. There might be a vulnerability where you could put some random overflow in the content, but it would be very challenging and device specific (if even possible). Also, read-only tags can't be reprogrammed, the tag would have to actually be replaced. – AJ Henderson Apr 17 '13 at 16:32
  • I understand how the Tasker scenario works, but that doesn't mean its not possible to write an application that is always listening and reading tags and would automatically launch a URL. The scenario in my last comment was finding a tag with a specific action which is known, then cloning, and replacing another tag elsewhere with that cloned value. As I noted, it would be limited attack to that person, messing with trust in his/her own tags. – Eric G Apr 17 '13 at 19:34
  • @EricG - or they would just realize that someone replaced the tag. Their phone wouldn't do anything that they hadn't programmed it for. It isn't really much of a threat, more of a practical joke, like taking a screen shot of someone's desktop and hiding their icons. – AJ Henderson Apr 17 '13 at 19:58

Historically whenever a new mobile communications technology comes out the technology that uses it has usually been shown to be vulnerable from the start. This has happened with Ethernet, WiFi, Bluetooth, and I highly doubt that NFC would not be on the list.

There is some research on the topic here. The main concerns with the communications aspects of the technology are the interception of communications, data corruption or modification, and data insertion. These can be countered to a certain extent with the use of good encryption schemes. This does not address the issue that as in the case of every other technology a good deal of the security of the solution is in the implementation, in this case the readers, and the tags.

On the reader side, the concerns are the software design and coding. Routine programming errors like unsanitized inputs and privilege escalation apply here as they do with any other application. There is also concern about how the hardware is designed in that it could be vulnerable to side channel attacks, or be wired up to the rest of the phone in a way that compromises security.

The problem with security around the tags is that even if you make them extremely hard to re-program with malware you cannot prevent people from buying their own tags and putting malware on them.

So, there are vulnerabilities in the design of NFC that could be exploited to intercept communications, for example being used to spy on transactions or attempting to clone a credit card. There are also possibilities that someone could modify the data in transit, for example increasing the payment on a credit card. These would work for all implementations of the technology.

The other mode of attack will be on the implementation of the technology, for example finding exploits in the NFC code for iOS or Android, or an implementation on a specific brand or model of phone, or NFC chip implemented in a host of phones.

| improve this answer | |
  • I didn't realize there were attacks on the encrypted communication between endpoints to allow cloning of payment cards when using an active end point. I thought that was only present for cloning passive cards. Did I miss a successful attack vector for active clients? – AJ Henderson Apr 17 '13 at 13:53
  • In terms of MiTM attacks on the NFC or easdropping, is there any type of verification or integrity check when reading a NFC or is it really your reader is listening for some id code in a broadcast/anycast type fashion? – Eric G Apr 17 '13 at 16:30
  • @AJHenderson, AFAIK there's no way to clone a complete card, that won't stop people from trying, especially if there are other, non-disclosed vulnerabilities. Most likely it would be passive card like many travel card systems use. – GdD Apr 17 '13 at 16:35
  • @GdD - I thought I had heard of a cloning vulnerability for Paypass, but that may have required knowledge of some card holder information and I believe it was limited to passive devices. As I understand it, active devices (such as Google Wallet) use a pretty strong authenticated encryption system to avoid third party disclosure. I could be wrong on that though which is why I didn't speak to it in my answer. – AJ Henderson Apr 17 '13 at 16:37
  • @EricG, if you mean is there some sort of authenticity check like SSL certificates then no, if you mean an integrity check like a CRC check then yes, but that would be easily generated to match the data. – GdD Apr 17 '13 at 16:38

After doing some research, it would seem one of the bigger threats would not be to intercept or manipulate a transmission, but to simple remove a tag. By this, I mean if you are expecting a tag or other RFID type device to be there and it's not, that is a threat.

For example, on the home automation front, let's say you removed all your light switches and replaced them with NFC tags. If someone was to cause the NFC tag to fail or to become corrupted you would be in the dark. This may sound trivial, but in a more advanced use this could be a real risk. As Michahelles et al. note:

if everyday objects have embedded RFID tags, simple con-straints, such as that goods can only be in one place at a time or that a train can’t leave the rail track, would let attackers estimate the system’s state and possibly predict its future actions.

While I would imagine that most large business may use some more advanced, two way, signed, or "smart" tags. I can see many small business using off the shelf basic tags for inventory or tracking. If you can clone a tag, then you can steal inventory and put your cloned tag inside an empty box. If you simply knock a tag out, you may cause costly delays in shipping.

So it would appear the interesting risk to consider is not in malicious content being loaded on a tag (as AJ Henderson pointed out, if you care about security, you should confirm any unknown action before letting it do something on your reader/phone), but what damage can be done in the physical world if an expected marker/trigger goes offline.

There of course can also be privacy concerns with any type of real-world interactive technology. If a QR code or NFC had a link with a tag used to identify a physical location that you then visited in a browser, it could be used to track your physical location.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.