Pro Hackers Take On RFID Down Under

By Mary Catherine O'Connor

Aug. 29, 2006—Companies pay Joshua Perrymon and Robert McAdam for performing ruinous acts on their infrastructures. The pair's firm, Pure Hacking, does what is known as ethical hacking, or penetration testing, and serves it up with a consultation service, detailing the holes in the companies' existing security measures and providing steps they can take to protect their data better.

Pure Hacking has, in the past, focused on corporate firewalls and security protections for onsite servers and applications, both in wired and wireless networks. Now, they've begun testing the vulnerabilities of RFID systems and are performing security audits for companies deploying RFID technology.

Robert McAdam

Perrymon says Pure Hacking is focusing on both the operational and technological risks associated with insecurities in an RFID system, and that the company uses a structured auditing process similar to those performed by the National Institute of Standards and Technology (NIST) the International Standards Organization (ISO). He says that aside from enabling its clients to improve information security, Pure Hacking can also save them significant amounts of money by "identifying security risks early, instead of down the road of when an attack comes."

Perrymon and McAdam interview executives and key employees at the firm being audited and perform surveys in order to understand how its RFID system is deployed. From this information, they ascertain the operational risks linked to its operation. "We ask about policies and procedures, and recommend new ones," says McAdam.

The client's technological risks are assessed through hands-on penetration testing. "We'll identify possible attack areas, and then go in with a rogue reader and simulate an attack," says McAdam. This consists of trying to read one of the firm's deployed tags with an unauthorized interrogator, trying to clone or change data encoded to the tag, or using an interrogator to manipulate the tag to identify the configuration of the data encoded to its chip.