RFID skimmer
RFID skimmer
An RFID (Radio-Frequency Identifier) skimmer can be loosely defined as a device that is used to collect mass information from RFID systems. An RFID skimmer can signal RFID tags in its vicinity and record the responses. Used at a checkout line, for example, an RFID skimmer could acquire credit card numbers and other information from individuals with RFID tagged belongings. An RFID skimmer can be powerful enough to pick up signals from RFID tags in a wide radius. This means that identity thieves can quickly walk through a crowded area and leave with a wide range of information. An RFID skimmer could be used to recover the information from a remote key fob to start a car. Once the skimmer had the information, the user could trick the car into unlocking, making theft very easy and also very difficult to prove in court, because the car would show no evidence of forced entry. Credit card information acquired with an RFID skimmer could be used to make unauthorized purchases on a card holder’s account. If the card holder was unfortunate enough to have RFID encoding on his or her identification as well, the RFID skimmer could collect that information as well, making fraud even easier. It is alarmingly easy and inexpensive to build a reasonably high powered RFID skimmer, which has raised questions about the safety of RFID technology.
Radio Frequency Identification (RFID) skimmer is a device used to collect mass information from RFID devices. While there are legitimate uses for an RFID skimmer, such as devices used to control inventory at supermarkets and other large stores, it is possible to abuse an RFID skimmer. In the wrong hands, an RFID skimmer could be used to quickly collect a great deal of data about a large number of individuals who might be unaware of the security breach.
RFID tags are small devices which can store a limited amount of information. The RFID tag responds to a query from an RFID scanner, relaying information about the object it is attached to. Devices which can read RFID tags are generally known as scanners, because they are used to scan objects with embedded RFID tags. An RFID skimmer is equipped to work exactly like a scanner, but usually has a sinister purpose.
RFID technology is used to identify inventory in stores, books in libraries, and other things for which rapid electronic cataloguing is highly useful. A growing number of companies and countries are using RFID technology to identify their workers and citizens as well. In the United States, for example, passports have embedded RFID devices which customs agents can quickly scan to get information about the passport bearer. Corporately, RFID tags are used to clock employees in and out, as well as manage information about them. Credit card companies have also begun to offer tags with RFID capabilities, so that consumers do not even need to take out their wallets to pay.
A Radio Frequency Identification (RFID) skimmer is a device used to collect mass information from RFID devices. While there are legitimate uses for an RFID skimmer, such as devices used to control inventory at supermarkets and other large stores, it is possible to abuse an RFID skimmer. In the wrong hands, an RFID skimmer could be used to quickly collect a great deal of data about a large number of individuals who might be unaware of the security breach.
RFID tags are small devices which can store a limited amount of information. The RFID tag responds to a query from an RFID scanner, relaying information about the object it is attached to. Devices which can read RFID tags are generally known as scanners, because they are used to scan objects with embedded RFID tags. An RFID skimmer is equipped to work exactly like a scanner, but usually has a sinister purpose.
RFID technology is used to identify inventory in stores, books in libraries, and other things for which rapid electronic cataloguing is highly useful. A growing number of companies and countries are using RFID technology to identify their workers and citizens as well. In the United States, for example, passports have embedded RFID devices which customs agents can quickly scan to get information about the passport bearer. Corporately, RFID tags are used to clock employees in and out, as well as manage information about them. Credit card companies have also begun to offer tags with RFID capabilities, so that consumers do not even need to take out their wallets to pay.
An RFID skimmer can signal RFID tags in its vicinity and record the responses. Used at a checkout line, for example, an RFID skimmer could acquire credit card numbers and other information from individuals with RFID tagged belongings. An RFID skimmer can be powerful enough to pick up signals from RFID tags in a wide radius. This means that identity thieves can quickly walk through a crowded area and leave with a wide range of information.
An RFID skimmer could be used to recover the information from a remote key fob to start a car. Once the skimmer had the information, the user could trick the car into unlocking, making theft very easy and also very difficult to prove in court, because the car would show no evidence of forced entry. Credit card information acquired with an RFID skimmer could be used to make unauthorized purchases on a card holder’s account. If the card holder was unfortunate enough to have RFID encoding on his or her identification as well, the RFID skimmer could collect that information as well, making fraud even easier.
It is alarmingly easy and inexpensive to build a reasonably high powered RFID skimmer, which has raised questions about the safety of RFID technology. For the time being, users are advised to be aware of what information they may be inadvertently broadcasting with RFID tags, and to take steps to ensure the security of that information. Frequent review of financial accounts to quickly detect fraud should be done in any case, but especially if you own RFID enabled credit cards or identification.
Radio-Frequency Identifier (RFID) technology has become really popular because of the various advantages it comes with. However, RFID systems such as passports, national identity cards, credit cards etc have become a serious security concern. Two electrical engineering students (Ilan Kirschenbaum and Avishai Wool) from Tel Aviv University wrote a paper titled “How to Build a Low-Cost, Extended-Range RFID Skimmer.” The paper demonstrates just how very simple it has become to ‘skim’ the RFIDs in your office key or car key. An RFID skimmer can therefore be loosely defined as a device that is used to collect mass information from RFID systems.
An RFID skimmer is used to collect legitimate information such as controlling inventory in supermarkets or pharmacies. However, sometimes the RFID skimmer can be used to collect illegitimate information thus causing a security breach. The device can be used by identity thieves as part of a relay attack system where the attacker uses the victim’s information to for example make purchases or start a car. Crimes of theft and fraud using an RFID skimmer are therefore very easy to commit.
How an RFID skimmer works
It is quite easy to build a low cost, portable, high powered RFID skimmer. In their paper, Kfir and Wool described a relay-attack on an RFID system that violates the implication that the RFID tag must touch the RFID reader at a range of 5 – 10 cm. Their system architecture involves two devices, a “leech” and a “ghost”, that communicate with each other. The RFID skimmer was able to read ISO-14443 tags from a distance of approximately 25cm, used a lightweight 40cm-diameter copper-tube antenna, and was powered by a 12V battery. An RFID skimmer application can run on a small laptop or a mobile phone connected to an RFID reader. Any sounds and images will then be recorded from a nearby webcam.
An RFID skimmer signals RFID tags within its vicinity and then records the responses. Depending on its power, it can pick up signals in a wide radius and surreptitiously read the contents of simple RFID tags.
Users are therefore advised to be careful with the information that they hold with RFID tags so as not to expose sensitive information to willing ‘wrong hands’.
Security breaches using an RFID skimmer
1. Thieves can collect information from your wallet without your knowledge.
2. Thieves can hack information from your VISA, MasterCard or American Express RFID credit card from as far as a foot away. The RFID reader is used to obtain the full name of the card holder, the credit card number and the expiration date. If this information can be read, then this means that the card can be cloned in a matter of seconds and someone else can pass themselves off as you. They can use your card to make unauthorized purchases.
3. An RFID skimmer can be used to read your car key RFID tag. The user then tricks the car into unlocking and speeds off with the car. This theft is unique by the fact that no sign of forced entry can be seen.