下列影片主要介紹以$250的設備就能原距離盜錄RFID(0'15"至1'30")~
The $250 proof-of-concept device - which researcher Chris Paget built in his spare time - operates out of his vehicle and contains everything needed to sniff and then clone RFID, or radio frequency identification, tags. During a recent 20-minute drive in downtown San Francisco, it successfully copied the RFID tags of two passport cards without the knowledge of their owners. Paget's device consists of a Symbol XR400 RFID reader (now manufactured by Motorola), a Motorola AN400 patch antenna mounted to the side of his Volvo XC90, and a Dell 710m that's connected to the RFID reader by ethernet cable. The laptop runs a Windows application Paget developed that continuously prompts the RFID reader to look for tags and logs the serial number each time one is detected. He bought most of the gear via auctions listed on eBay.
下列影片介紹www.spiveytechnologies.com的可防非法存取之RFID產品~
It is a novel application of simple circuitry to prevent access to any information stored on the chip of a contactless RFID device. In its normal or “locked” state, the device’s antenna is detuned; effectively analogous to shorting the antenna. In this condition, it is impossible for a reader to access the chip and prevents the chip from transmitting any information; the card is completely disabled. Being completely disabled also prevents the chip from being detected and the card from being tracked. To use a card that incorporates ‘Dead Bolt’ technology, the user positions it near the desired reader, as they would with any such RFID enabled card, then applies and releases a gentle and intuitive pressure. Using time tested piezo technology, this pressure activates our circuitry which momentarily retunes the antenna, “unlocking” the card. Once the antenna is retuned, the reader can energize the antenna, access the chip and the chip can transmit its stored information. As highlighted, this is a momentary condition. Duration of reader access to the chip can be varied to the requirements of the device provider. For purposes of demonstration the card in our video is set at 200 milliseconds. At the end of the predetermined access period our circuitry automatically detunes the antenna, returning the device to its normal or “locked” condition and again, positively preventing access to the chip.
下列影片介紹Verayo.com的RFID PUF(Physical Unclonable Functions)技術~
To understand unclonability, it is important to understand how RFIDs can be cloned. The first, and perhaps more difficult, method would be to somehow copy the contents of one RFID chip to another. This can be achieved if an attacker gets access to another same kind of uninitialized RFID chip as the one the attacker is targeting. The second, and easier, method would be to program a ghost RF device to act like a RFID chip. Such devices are available on the internet, an attacker would skim the information exchanged between the real RFID chip and reader and then replay the same information using such devices to attack the system.
PUF technology makes it effectively impossible to clone Verayo RFID chips. Even if an attacker gets hold of an uninitialized Verayo RFID chip, and copies all the contents from one RFID chip to the other, including the PUF parameters stored in the Vera M4H IC, the PUFs in the two chips will show very different characteristics. No two PUF based RFID chips will generate the same response to any given challenge. Hence, in the example above, if the same challenge is given to a fake wrist-watch with a copy of the real Vera X512H RFID IC, or a fake ticket with copy of the real Vera M4H RFID IC, the PUF will not provide the expected response to any given challenges.
PUF based RFIDs address the issue of skimming and replay by ghost RF devices as well. In case of Vera X512H IC, each PUF based RFID can generate virtually unlimited number of challenge response pairs. To address the issue of skimming and replay attack, the system should, ideally, use a new challenge response pair every time. A ghost device that would have skimmed the previous exchange between the chip and the reader would not know the new response and fail. In case of a Vera M4H IC, the reader selects a random challenge each time, hence it is almost impossible for an attacker to give a Vera M4H IC a challenge that will be used by the reader for authentication.