RF-ID chips can be cracked using cheap technology, U.S. computer experts said Saturday. The radio frequency identification (RFID) system, commonly used in car locks or gas cards uses a relatively simple code that criminals can easily decipher, making it easier to steal a car or get a free tankful of gasoline, said experts at Johns Hopkins University and RSA Laboratories.
“Millions of tags that are currently in use by consumers have an encryption function that can be cracked without requiring direct contact. An attacker who cracks the secret key in an RFID tag can then bypass security measures and fool tag readers in cars or at gas stations,” Rubin said in a statement.
The Johns Hopkins researchers say that if other radio frequency ID systems are vulnerable, the new field could offer far less security than its proponents promise.
Made by Texas Instruments Inc., the RFID system studied for the report uses a device that prevents a car from starting unless both the right key and the correctly coded RFID chip are used.
The fuel-purchase system uses a reader inside the gas pump that recognizes a key-chain tag waved nearby and automatically charges a designated credit card.
More than 150 million of the TI transponders are embedded in keys for newer vehicles built by at least three leading makers and in more than 6 million key-chain gas tags, the researchers said.
The problem is that the mathematical key used to code the verification system is too short, the experts said. They bought a commercial microchip costing less than $200 and programmed it to find the key for a gasoline-purchase tag. The researchers linked 16 such chips together and cracked the key in about 15 minutes.
eWEEK.com has a Special Report on RFID. More information on RF-ID is available at MIT’s Autoidcenter.org, EPCglobal, RFID.org, RF-ID Journal, buyrfid.com, ACSIS.com, RFID toolkit, rfidtalk.com and nocards.org. WiFi Planet overviews RF-ID technologies.
Related Daily Wireless articles include Cat Fight over RF-ID, Mad Cow RF-ID, Handheld RF-ID Readers, Airport RF-ID, Tracking RF-ID, Digital Angel, RF-ID: From Soup to Nuts, Tracking Ship Movements - And You, Homeland Insecurity, Marathon RF-ID Tagging, Port Security with RF-ID and RF-ID Tracking from Space?.
.gif)
