Viruses May Affect Radio Frequency Identification Tags

Posted in Technology by Naughty Bits | Comments (0) | Email to a Friend!!! | digg | Fark | StumbleUpon

Everyone knows the barcodes and the more recent chips replacing them, used for product identification in shops and other similar cases. But what people didn't know till now was the fact that there's a possibility that those little tagging gadgets are also vulnerable to viruses which may affect both machine and man.

To demonstrate that such a scenario is a possible one, a group of three researchers at the Amsterdam's Free University have designed their own RFID reader, giving it a common type of bug called an SQL injection vulnerability. Then they created the malware needed to exploit that specific vulnerability, showing that it would spread automatically as described.

According to the study conducted by Melanie Rieback, Bruno Crispo and Andrew Tanenbaum, despite the extremely low memory capacity available on such chips, an infected RFID tag read wirelessly by a scanner is strong enough to mess up the database that processes contained information.

"Everyone working on RFID technology has tacitly assumed that the mere act of scanning an RFID tag cannot modify back-end software and certainly not in a malicious way. Unfortunately, they are wrong", the scientists said.

"An RFID tag can be infected with a virus and this virus can infect the back-end database used by the RFID software. From there it can be easily spread to other RFID tags", they added.

Consequently, such infected chips could cause some real damage if they fall in the wrong hands - criminals or militants could use an infected RFID tag to upset airline baggage handling systems with potentially devastating consequences, as the scientists mentioned. Not to mention about the whole chaos that could be created in supermarkets using this technology.

"This is intended as a wake-up call. We ask the RFID industry to design systems that are secure," Tanenbaum said in an interview.

Moreover, civil liberty groups fear infected RFID chips could also lead to an invasion of individual privacy rights and undesired surveillance systems.

Send to a friend!