4

I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of these vulnerable too: personal id cards, driving licenses, etc? I see that these might vary in different countries so how do I indentify if a card uses technologies that might be abused liked that?

  • 1
    Please do not edit to add extra questions. If you have another question please ask it. You can add a reference to this one if you like. – Rory Alsop Jul 5 '14 at 10:22
  • Gen - no. Post it as another question. Folks can move their answers over there. – Rory Alsop Jul 5 '14 at 16:34
6

which cards are vulnerable to such abuse?

First of all you need to recognize whether the card has RFID capabilities or not. These may be advertised with logos, icons (usually the three curved lines also used to indicate "WiFi" in some contexts), or in writing. You can also check on the supplying bank/company/entity, or look for telltales such as "My card does not work..." in the FAQs or forums. Also the issuer's support hotline, if available, should be tried first.

Another possibility is to inspect the card itself (some RFID antennas are visible by placing the card in front of a very strong point light, such as some hi-power LED torches; you can try and see if a RFID reader beeps, even if it does not recognize the card, or better yet, if a recognized RFID card has suddenly problems if waved in front of its reader while being pressed against the unknown card. Normal plastic and chip cards do not interfere with RFID cards; RFID cards, of course, do). If you have an expired card of the same issuer, you can try cutting the old card apart, and if it has a RFID coil inside, chances are that the new issue is RFID too.

Now that you know it's RFID, what information/operation is needed to complete a transaction or get the information on the card? A few RFID credit cards require a PIN to be entered manually (which somewhat negates the ease of use of a RFID...), for example.

If the only thing needed to get something you wouldn't want gotten from the RFID is to skim it with a reader - your knowledge or confirmation aren't required - then by definition that card is vulnerable.

How do I prevent RFID scanning? Would a wallet with aluminium plates on both sides do the job?

There is a common misconception about "shielding" RFID. Passive RFIDs don't have a power source, so they get it from the incoming scanner field through inductive coupling. The shielding works both by limiting the energy transfer (so the RFID doesn't "wake up") and by decreasing the signal-to-noise communications ratio (so the RFID and the scanner don't "understand" each other).

The absorption of the shielding depends, for any given material, on the frequency being used; for smart cards we want good absorption in the 13-14 MHz range.

Different materials - even metals - have different shielding properties at different frequencies; for example, aluminum won't stop low frequencies (or stationary magnetic fields: a magnet will still work even if wrapped in aluminum foil). Steel sheet or soft iron sheet will screen low frequencies and absorb much of the magnetic component, but will leak at very high frequencies.

So, while an aluminum foil will create a Faraday cage stopping dead most high-frequency RF, microwaves, etc., it may not be enough to screen an inductively coupled RFID smart card from a juiced-up, savvy scanner. A single layer of aluminum foil will not stop any except the cheapest, more shoddily constructed readers. Of course, more layers will increase protection.

You would perhaps be better off with jamming -- using a shield made of a valueless (e.g. expired), but still working, smart card of the same make and model. Or "sandwiching" the real card between two valueless ones. Not only will the middle card receive less power, but the outgoing signal will be mixed with two others on the same frequency (activation delay makes this method not completely safe, though).

Otherwise, you can use 30-mil magnetic iron foil (looks very much like aluminum), or have the wallet lined with Near-Field Cobaltex which is almost as good and weighs less.

For the truly paranoid, apart from several layers of Cobaltex, there are metamaterial shieldings (e.g. silvered-nickel-iron or nickel-cobalt-copper mesh from several suppliers, from Achron to Laird Technologies) which are significantly more expensive but have even more stopping power. And you don't need a lot of material to line a wallet after all.

You can then test the effectiveness of the shielding by using a shielded credit card to try and pay at the next gas station. If it doesn't work, you smile happily, take the card out of the wallet and tell the gas guy "Sorry, it usually works even from inside the wallet". If a reader at one inch can't interface, it's unlikely that a pirate reader will be able to do it from much farther.

It would also be interesting to build a coil tuned to 14 MHz and connect it to a rectifier, buffer capacitor and buzzer stage. It would suck most of the energy from the scanner field, converting it into an audible sound and giving the alert. Basically the same thing as a near field probe, except it could be completely passive: it takes quite a lot of energy to run a blind skim a RFID at a distance, so the scanners are probably heavily up-juiced and give off radiation enough to be detectable. (It would also possible to build an active scanner detector by tweaking this design).

1

Technically all RFID cards are scannable given the right equipment. Some vendors implement protections like randomly generated keys etc, so the only surefire way to protect your cards is to wrap them in a faraday cage. Aluminium may work, however it really does depend on the strength of the scanner. You can buy scan-proof wallets online.

-1

I know that modern US Passports use RFID technology, not sure about driver license, at least not in FL,CA,TX,SC,AZ,NE,CO or NY. All RFID is vulnerable to RFID hijacking. The best way to protect against this type of attack is to cover the object with aluminum foil. Fortunately, many companies make faraday cage wallets, so we won't necessarily have to cover our belongings in aluminum foil.

  • 4
    Well, no, RFID is not automatically vulnerable. It depends on the implementation. Actively, a PIN may also be required to complete a transaction. Passively, the RFID might be equipped with a pressure switch, so that the antenna doesn't receive unless someone is actually holding the card between two fingers (e.g. venturebeat.com/2012/02/18/…). Also, a "Faraday cage" is not necessarily helpful against inductive coupling; see omniscienceisbliss.org/rfid.html – LSerni Jul 5 '14 at 12:02
  • @lserni Thanks for the correction and I value your input. – injector Jul 7 '14 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.